Analysis

  • max time kernel
    157s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2024, 00:47

General

  • Target
    Lunar Client v3.2.3.exe
  • Size 1.0MB
  • Sample240306-a46wcafd54
  • SHA256 560b03c4ba18e5a443f74a69727db0eabac6f455bb836757d620cc51615a92ea
  • MD5 SHA1 SHA512 SSDEEP
Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe
    "C:\Users\Admin\AppData\Local\Temp\Lunar Client v3.2.3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Lunar Client.exe" | %SYSTEMROOT%\System32\find.exe "Lunar Client.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1228
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Lunar Client.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:760
      • C:\Windows\SysWOW64\find.exe
        C:\Windows\System32\find.exe "Lunar Client.exe"
        3⤵
          PID:4532
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3956 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:824
      • C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
        "C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe"
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4464
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "chcp"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5316
          • C:\Windows\system32\chcp.com
            chcp
            3⤵
              PID:5368
          • C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
            "C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\launcher /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\launcher\Crashpad --url=https://f.a.k/e --annotation=_productName=launcher --annotation=_version=3.2.3 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=25.9.8 --initial-client-data=0x56c,0x574,0x578,0x4b0,0x57c,0x7ff61b90d208,0x7ff61b90d218,0x7ff61b90d228
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5456
          • C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
            "C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1884 --field-trial-handle=1888,i,10648751790173059650,5195044129314531065,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6040
          • C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
            "C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\launcher" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2072 --field-trial-handle=1888,i,10648751790173059650,5195044129314531065,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6064

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              main.log

              • Path C:\Users\Admin\.lunarclient\logs\launcher\main.log
              • Size 750B
              • SHA256 8a1f2fba1ad590919c818a02b250b29c9500123126c3da62f332f9d6e9bee1a1
              • MD5 SHA1 SHA512

              launcher.json

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json
              • Size 2B
              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
              • MD5 SHA1 SHA512

              launcher.json

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json
              • Size 306B
              • SHA256 a7b7f2886cbb7bdb258982c6e622ef4981a2d43d198572aa6b562a0ddc68d60d
              • MD5 SHA1 SHA512

              launcher.json

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json
              • Size 444B
              • SHA256 2801fcae5837560a7bfa1f060f378a0daab06fa9cbec20c7aff8955eea3bbe6b
              • MD5 SHA1 SHA512

              launcher.json

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json
              • Size 511B
              • SHA256 90a3990a8043179b74ab487249567de2c9a557f2d5df306823e2e86333624dd5
              • MD5 SHA1 SHA512

              launcher.json

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json
              • Size 533B
              • SHA256 00187c609a5820897549a13145638cb0cc68bf1ed9287ae7bb8817c32103a258
              • MD5 SHA1 SHA512

              launcher.json

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json
              • Size 614B
              • SHA256 fb9646b89d9e862ffe84daefc47b3eeb9698817e6540e9bc137a3fd6c5a46489
              • MD5 SHA1 SHA512

              launcher.json

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json
              • Size 592B
              • SHA256 5e74cdf0066dcf159b9170d5d63a7d4aee92a60b42ad90a476e5d0bce52b4f4b
              • MD5 SHA1 SHA512

              launcher.json

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json
              • Size 511B
              • SHA256 883f1e90544dc10e68ebdc371a28978d54ccd6c3049579d9a661d4ca91bb572f
              • MD5 SHA1 SHA512

              launcher.json

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json
              • Size 511B
              • SHA256 e9acaf2d3ac9a4f96fcc58a07f1f050dea36fade75a34d482c7b3e2435ded042
              • MD5 SHA1 SHA512

              launcher.json

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json
              • Size 511B
              • SHA256 71efbffe605718b2ca9076bf1078aa8db3ce00037154430becd33fba59ded9d4
              • MD5 SHA1 SHA512

              launcher.json

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json
              • Size 587B
              • SHA256 9969d06546fd4ba4f6f7445ad4d43e197145c45c0a257e198bf6a82b8e354ffd
              • MD5 SHA1 SHA512

              launcher.json.tmp-96861301247585e3

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json.tmp-96861301247585e3
              • Size 410B
              • SHA256 328c458a470476769f6def18d380d5c39b9183a751749c550d0bdd72f2920990
              • MD5 SHA1 SHA512

              launcher.json.tmp-968613071874e12b

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json.tmp-968613071874e12b
              • Size 614B
              • SHA256 f69efa0c895c4de3ff79c6359061a1ff9c7e3279c822785b016170fb79e7404c
              • MD5 SHA1 SHA512

              launcher.json.tmp-9686130968fa1516

              • Path C:\Users\Admin\.lunarclient\settings\launcher.json.tmp-9686130968fa1516
              • Size 587B
              • SHA256 f980e4439488418ce3126dc8993219397d2f5a6b512ba97a850cb540518bc5c7
              • MD5 SHA1 SHA512

              D3DCompiler_47.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\D3DCompiler_47.dll
              • Size 403KB
              • SHA256 fef5da9f912903904115c1f69a76b2ad1391e5c855897a09fef43e5e403ebe58
              • MD5 SHA1 SHA512 SSDEEP

              Lunar Client.exe

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
              • Size 745KB
              • SHA256 9e62c65c6ef544b275c088b0e4f94a80f0e62eb36bc8462ed6d97dcf5bff294b
              • MD5 SHA1 SHA512 SSDEEP

              Lunar Client.exe

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
              • Size 1.0MB
              • SHA256 09b98931321c02b9942c496f99ae70ff39047c28fc874faad95813aa14a95e53
              • MD5 SHA1 SHA512 SSDEEP

              Lunar Client.exe

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
              • Size 2.2MB
              • SHA256 e13b0b68ee94862f9353c030d1aa874f25e9de2bef195582676fa498f62af6e6
              • MD5 SHA1 SHA512 SSDEEP

              Lunar Client.exe

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
              • Size 2.3MB
              • SHA256 b4fef90fd7c5188574fc9d44fd6b48fa79d13877be42b4f0caee9758276f0a43
              • MD5 SHA1 SHA512 SSDEEP

              Lunar Client.exe

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe
              • Size 4.1MB
              • SHA256 707dd7c5a36bd07d2df5a616060e61020aff5981aee6b78adca625e666c03a22
              • MD5 SHA1 SHA512 SSDEEP

              chrome_100_percent.pak

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\chrome_100_percent.pak
              • Size 132KB
              • SHA256 99ca6947d97df212e45782bbd5d97bfb42112872e1c42bab4209ceedf66dc760
              • MD5 SHA1 SHA512 SSDEEP

              d3dcompiler_47.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\d3dcompiler_47.dll
              • Size 192KB
              • SHA256 d33336bc3241db18fd8437686dae0542d8e7b235630608358fdeec21b37e8048
              • MD5 SHA1 SHA512 SSDEEP

              ffmpeg.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll
              • Size 1.1MB
              • SHA256 89174f3943d6811b169f7666e408ee4f7b39dfb0f41e6bd5d31d4685bc9878b7
              • MD5 SHA1 SHA512 SSDEEP

              ffmpeg.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll
              • Size 507KB
              • SHA256 1c8102be613121cab0713194f7c4b770ef841b145c90221af19071fdf14802ae
              • MD5 SHA1 SHA512 SSDEEP

              ffmpeg.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll
              • Size 1.9MB
              • SHA256 ebdf7c7ab13dd0c71772dd088022a31d00ef131c3ac92eed117837f29270669a
              • MD5 SHA1 SHA512 SSDEEP

              ffmpeg.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\ffmpeg.dll
              • Size 2.1MB
              • SHA256 15132bf73173e49ac0a64aa08c87457e3ff01f0fb769b8c33f592e8d63f72cc7
              • MD5 SHA1 SHA512 SSDEEP

              icudtl.dat

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\icudtl.dat
              • Size 850KB
              • SHA256 f569f21e3f49a77e73fcfa53b175c4a7af13e9f674d2df45c34635e5a2a83e3f
              • MD5 SHA1 SHA512 SSDEEP

              libEGL.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\libEGL.dll
              • Size 293KB
              • SHA256 b52c1886be8027f136e3aba57e80007519c492672a70aaa49c6989129f21614e
              • MD5 SHA1 SHA512 SSDEEP

              libGLESv2.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\libGLESv2.dll
              • Size 121KB
              • SHA256 d0fa91af289a5021b67797954b74a1e0188bdffd4671c841466408168632d5a0
              • MD5 SHA1 SHA512 SSDEEP

              libegl.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\libegl.dll
              • Size 235KB
              • SHA256 a78564ede93762656fc85ad3bb86149afd2b1282217e2721a9030fb5594564e4
              • MD5 SHA1 SHA512 SSDEEP

              libglesv2.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\libglesv2.dll
              • Size 155KB
              • SHA256 fe0f028834014540ec7912e1da8821a82239cf90f5c2a23ab830220ea7f863b1
              • MD5 SHA1 SHA512 SSDEEP

              resources.pak

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\resources.pak
              • Size 2.0MB
              • SHA256 0e394a1004624306e1147ce4b4e93b33fab1bdb909211b6fa04c516e0bbf886b
              • MD5 SHA1 SHA512 SSDEEP

              app.asar

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\resources\app.asar
              • Size 3.9MB
              • SHA256 c4663cd76c590e941a289c4c9a6970ce7d76f4c08758adc55935f56add3eae71
              • MD5 SHA1 SHA512 SSDEEP

              v8_context_snapshot.bin

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\v8_context_snapshot.bin
              • Size 564KB
              • SHA256 5b1f69f39f3d5865dce13ee3bdbc1af2938f5cc4c056dc9f9e213e9af346ad4b
              • MD5 SHA1 SHA512 SSDEEP

              vk_swiftshader.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\vk_swiftshader.dll
              • Size 617KB
              • SHA256 ab3d8f32e448e4457e11884b2d91b3b4dabb9ea5ade39be33af62a2b1baa5103
              • MD5 SHA1 SHA512 SSDEEP

              vk_swiftshader.dll

              • Path C:\Users\Admin\AppData\Local\Programs\launcher\vk_swiftshader.dll
              • Size 438KB
              • SHA256 45bf1c71e1e6d579aeb1d0ed2751ac2aadbdab9f102cd06736d750b1fd560a73
              • MD5 SHA1 SHA512 SSDEEP

              04e6b338-de65-464c-920b-57183b350f33.tmp.node

              • Path C:\Users\Admin\AppData\Local\Temp\04e6b338-de65-464c-920b-57183b350f33.tmp.node
              • Size 259KB
              • SHA256 7031bf1b506c31245a6505722a4be79684bca41ea65b271b314d4466032530b9
              • MD5 SHA1 SHA512 SSDEEP

              LICENSE.electron.txt

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\LICENSE.electron.txt
              • Size 1KB
              • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
              • MD5 SHA1 SHA512

              LICENSES.chromium.html

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\LICENSES.chromium.html
              • Size 1.6MB
              • SHA256 59d36568cad9abf0c206587990b7cba4d08714342a0a681dbed4867ffe657da9
              • MD5 SHA1 SHA512 SSDEEP

              Lunar Client.exe

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\Lunar Client.exe
              • Size 813KB
              • SHA256 7e6658a0f5e6e0f5d2ad965a925b7da70eb669fa6a4449b52f79c34414625c7e
              • MD5 SHA1 SHA512 SSDEEP

              chrome_200_percent.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\chrome_200_percent.pak
              • Size 191KB
              • SHA256 cb4fd141a5c4d188a3ecb203e9d41a3afca648724160e212289adcac666fbff4
              • MD5 SHA1 SHA512 SSDEEP

              d3dcompiler_47.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\d3dcompiler_47.dll
              • Size 1.8MB
              • SHA256 5410e12df2bddeea24834c743aca32d57da57b201663619845c65ab5fcb5e504
              • MD5 SHA1 SHA512 SSDEEP

              ffmpeg.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\ffmpeg.dll
              • Size 2.7MB
              • SHA256 e1ab367644f72ebcdc8eb3fcfe829ff51719559ac2a43a1600e712b16871ad65
              • MD5 SHA1 SHA512 SSDEEP

              icudtl.dat

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\icudtl.dat
              • Size 2.3MB
              • SHA256 d8667143033ca9853df9cf688662d66895ff7fd197884bbdf9a63e80abe3f21c
              • MD5 SHA1 SHA512 SSDEEP

              libEGL.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\libEGL.dll
              • Size 469KB
              • SHA256 e142752e073c0051a0beb963981af70263ed673959515545521a7941d3230838
              • MD5 SHA1 SHA512 SSDEEP

              libGLESv2.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\libGLESv2.dll
              • Size 1.4MB
              • SHA256 87d2c78d6c313c0274ad38fb8a7f183fd409bad5fac633d08c3b4a78fa960e61
              • MD5 SHA1 SHA512 SSDEEP

              af.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\af.pak
              • Size 381KB
              • SHA256 7bb75adef02d28819f1bd3b42fa46ed56d6dfbeae072341997b09b8c1f52d8dc
              • MD5 SHA1 SHA512 SSDEEP

              am.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\am.pak
              • Size 619KB
              • SHA256 685ecdff01d4ae92be1d900ef00fd8632616bc41f18a56e682528f312d4a5167
              • MD5 SHA1 SHA512 SSDEEP

              ar.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\ar.pak
              • Size 680KB
              • SHA256 acc1b352ea206c25afe88a614346b468f4f78bf23f886883a38dae905d121dc0
              • MD5 SHA1 SHA512 SSDEEP

              bg.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\bg.pak
              • Size 706KB
              • SHA256 3fd27d562e32f1a052e924b6c468486acf0b2af42dd1ad2270e83d115d4b3f65
              • MD5 SHA1 SHA512 SSDEEP

              bn.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\bn.pak
              • Size 911KB
              • SHA256 2bb70dc94361267e755169dde430ea31aa21b4daf31b5eed78901b27bc596a2e
              • MD5 SHA1 SHA512 SSDEEP

              ca.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\ca.pak
              • Size 430KB
              • SHA256 02d60b97f70c31f5c5003108321fc3ac3c79bf39a36392c3adaf7735b9cc1c1d
              • MD5 SHA1 SHA512 SSDEEP

              cs.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\cs.pak
              • Size 441KB
              • SHA256 c1020222b90558a6a8a07f24756b183594641ef77562d35e7899e1489d0ebd8e
              • MD5 SHA1 SHA512 SSDEEP

              da.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\da.pak
              • Size 400KB
              • SHA256 dab543bcc1a8abf057f720f9f448e45ca5cfd1c424826bce8933174bb2eccad7
              • MD5 SHA1 SHA512 SSDEEP

              de.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\de.pak
              • Size 427KB
              • SHA256 6283ec48cddd08c387a36ec71fff87c2ab0ef27449e8971eba2d76a6136b1708
              • MD5 SHA1 SHA512 SSDEEP

              el.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\el.pak
              • Size 611KB
              • SHA256 8061d32c26e915c8655c78817d4cded808543cb9de852a9f20962ee693a3aa89
              • MD5 SHA1 SHA512 SSDEEP

              en-GB.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\en-GB.pak
              • Size 329KB
              • SHA256 0a77c0f1088dbc896a8b2ed46ee71c6065fbed08b172438438902d45e4ec2991
              • MD5 SHA1 SHA512 SSDEEP

              en-US.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\en-US.pak
              • Size 351KB
              • SHA256 69c1a2e1b30d83612decf1a8dd7b124a04f58e9f2465876726f02f7f7d5eb54a
              • MD5 SHA1 SHA512 SSDEEP

              es-419.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\es-419.pak
              • Size 425KB
              • SHA256 5fcf21564ceec93eb64d2002de165a55c1875859975e0bf9035cbe96f258b50d
              • MD5 SHA1 SHA512 SSDEEP

              es.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\es.pak
              • Size 425KB
              • SHA256 468e0143c978a948c62d4a3dc743099a4147d39773a6112b303692d0e335810e
              • MD5 SHA1 SHA512 SSDEEP

              et.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\et.pak
              • Size 384KB
              • SHA256 41883af1e49cc180fb48e02659e75b0169d974d77373cf7bb2a4ea02dd654e26
              • MD5 SHA1 SHA512 SSDEEP

              fa.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\fa.pak
              • Size 629KB
              • SHA256 9068dc6c71fd8bbc1a4f3b2009689472d1fd2c096b7e8afb3e089a46b98d8b38
              • MD5 SHA1 SHA512 SSDEEP

              fi.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\fi.pak
              • Size 392KB
              • SHA256 052a72c9d6f2bb55f02fb1c5c4c68525a32b8cc9120c270d07d7b813d604f7dc
              • MD5 SHA1 SHA512 SSDEEP

              fil.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\fil.pak
              • Size 442KB
              • SHA256 e8f03c2e9c88adb04648ef93f9ea3cff87641638ac97c9a6752b751e7f7a8a20
              • MD5 SHA1 SHA512 SSDEEP

              fr.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\fr.pak
              • Size 459KB
              • SHA256 cd21cae54eb6cb115771d1afe14d17822e13332759f8710d6386a6e4277c11c8
              • MD5 SHA1 SHA512 SSDEEP

              gu.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\gu.pak
              • Size 886KB
              • SHA256 0f0fee8a2f22f80a0c4a758e7f4fd90d40be4048dcab0d824135caa5e92efd5d
              • MD5 SHA1 SHA512 SSDEEP

              he.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\he.pak
              • Size 549KB
              • SHA256 ad20b3d634130c247f4ff954f1a5c56687523e5610f2ec6085e257126c4513a4
              • MD5 SHA1 SHA512 SSDEEP

              hi.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\hi.pak
              • Size 928KB
              • SHA256 71830814b8c7028a114a53a4e715ffa8da12f01d920455242a0cbc35fef48e6b
              • MD5 SHA1 SHA512 SSDEEP

              hr.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\hr.pak
              • Size 428KB
              • SHA256 08fc2b1e6b9652d809a7550f1343b3ee54ebcbad0fe74b009aab6ef926c0279b
              • MD5 SHA1 SHA512 SSDEEP

              hu.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\hu.pak
              • Size 116KB
              • SHA256 501909e79b6c7f6a2bdeb91f08284a9f1cebe01c88162d3b9348b88ce867c0a5
              • MD5 SHA1 SHA512 SSDEEP

              id.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\id.pak
              • Size 377KB
              • SHA256 bd512e36a88f0d7e6fecc0b559adb2761589947fef9c253dc350cd8d6ea889f2
              • MD5 SHA1 SHA512 SSDEEP

              it.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\it.pak
              • Size 417KB
              • SHA256 95bbf94625cf0476124763cebedcf5ee46148bb6b5c006f86540a02e8d8c883c
              • MD5 SHA1 SHA512 SSDEEP

              ja.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\ja.pak
              • Size 15KB
              • SHA256 1d12e76c4d4afa230ea3fa986a29144405baee3588e6a7d3a13507c547575fd0
              • MD5 SHA1 SHA512 SSDEEP

              kn.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\kn.pak
              • Size 1023KB
              • SHA256 0c8e0b6a8398d7b9ab9cac634e4a7ce4453540358e79ac6e9c5633efb4182fe9
              • MD5 SHA1 SHA512 SSDEEP

              ko.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\ko.pak
              • Size 429KB
              • SHA256 56100d20a59fe6cb333f57ffdef90157324ae1b90194e852478daa8c46d29de9
              • MD5 SHA1 SHA512 SSDEEP

              lt.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\lt.pak
              • Size 463KB
              • SHA256 ecb4ecbd96575f6f984f60e85ab1ebb0067e73174ff9912941ee1aaa28516d93
              • MD5 SHA1 SHA512 SSDEEP

              lv.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\lv.pak
              • Size 461KB
              • SHA256 dfb9b5ee446977dc0435cff4d66402d3a9426edb106effdbb7d86379527c5956
              • MD5 SHA1 SHA512 SSDEEP

              ml.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\ml.pak
              • Size 1.0MB
              • SHA256 a7afb3ebfa8f4d2e35dfdd5554ff2702182e73dad0fd82f8b4207a61563ed134
              • MD5 SHA1 SHA512 SSDEEP

              mr.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\mr.pak
              • Size 870KB
              • SHA256 436efbdbce605c23f855644a9ff1b04d9a3eca37de3b18de8c3e589930d54096
              • MD5 SHA1 SHA512 SSDEEP

              ms.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\ms.pak
              • Size 395KB
              • SHA256 163eb7ba5f0c61acb6443709c24e38ca6370a33f89a12e13d0a57c258a87ca16
              • MD5 SHA1 SHA512 SSDEEP

              nb.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\nb.pak
              • Size 386KB
              • SHA256 29f38d3720c948fd261a2aea7d195e861a73a1313071bd2cbf1ebcbba77c63e6
              • MD5 SHA1 SHA512 SSDEEP

              nl.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\nl.pak
              • Size 398KB
              • SHA256 3c682e37df71cc036c2b5e91064407fed8091c0306a856121e28c19e7110e1e4
              • MD5 SHA1 SHA512 SSDEEP

              pt-BR.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\pt-BR.pak
              • Size 419KB
              • SHA256 b4e0a6064dcfe876c819ec4b00f9857b84ff52cd3e845bd0c48e31ad43a23db9
              • MD5 SHA1 SHA512 SSDEEP

              pt-PT.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\pt-PT.pak
              • Size 420KB
              • SHA256 342381f89058bedd809991a0b416f48642df3c71aea10bb13e13bc15eaaf46c8
              • MD5 SHA1 SHA512 SSDEEP

              ro.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\ro.pak
              • Size 434KB
              • SHA256 b7b56396806412ac1721d2648fa98a89a069d1f58d359d8e90dd1c6b8473b9a2
              • MD5 SHA1 SHA512 SSDEEP

              ru.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\ru.pak
              • Size 711KB
              • SHA256 c5264fa2b485326e91d4df7a6e39122554ed632c0c17fa1f130205ed50e2d6b9
              • MD5 SHA1 SHA512 SSDEEP

              sk.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\sk.pak
              • Size 448KB
              • SHA256 04b179b5c3a5468f495a0620a2dbc6e312ebd76ba32b98d8cc7daafb46edc21e
              • MD5 SHA1 SHA512 SSDEEP

              sl.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\sl.pak
              • Size 433KB
              • SHA256 b36e1fe2405cc4b9f34587e30da2feadaa6f03124769b02f79333adacaddb49b
              • MD5 SHA1 SHA512 SSDEEP

              sr.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\sr.pak
              • Size 666KB
              • SHA256 b75a222db70c3f5734a75042718da599881d5e84cc52b332e9162f78b32f4819
              • MD5 SHA1 SHA512 SSDEEP

              sv.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\sv.pak
              • Size 389KB
              • SHA256 110112c2f7ff5d3c8599036669d156e96ec19e70515fbba3bbcb2043ab994680
              • MD5 SHA1 SHA512 SSDEEP

              sw.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\sw.pak
              • Size 408KB
              • SHA256 7a5d056fd317b7b60a4fbf0df39dfdd21829f2245393a21e1ddccf1a4e3b61fe
              • MD5 SHA1 SHA512 SSDEEP

              ta.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\ta.pak
              • Size 715KB
              • SHA256 9014e2f48d59a56fea22d1397967393a0e04219b045ee3e1e4ef8a5884948ccc
              • MD5 SHA1 SHA512 SSDEEP

              te.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\te.pak
              • Size 437KB
              • SHA256 abf9342b0c719fb61e609929073cba2c94209565ca8d10a977c26b145fa40188
              • MD5 SHA1 SHA512 SSDEEP

              th.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\th.pak
              • Size 765KB
              • SHA256 6f9c2f4051847dd70c097be8f72baf7ea525f965b91e5f52c6988452b3db9d19
              • MD5 SHA1 SHA512 SSDEEP

              tr.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\tr.pak
              • Size 415KB
              • SHA256 26fd3317bedd4080038d7a0003d73923fc0edd40283ef11b5ba80bb27f946c13
              • MD5 SHA1 SHA512 SSDEEP

              uk.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\uk.pak
              • Size 711KB
              • SHA256 0523b68c3320674d1565dedaf0436ec821a7175a34ac673338d6447aab20fd7a
              • MD5 SHA1 SHA512 SSDEEP

              ur.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\ur.pak
              • Size 622KB
              • SHA256 578aef61fc8b5c2e0f3765b1487f8af9f72f6506050d501fec9edcbf93c7a3e4
              • MD5 SHA1 SHA512 SSDEEP

              vi.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\vi.pak
              • Size 492KB
              • SHA256 326e44c27579796e4b55cc281c3e4c9bf5ad7aa87156530709cd6296350758af
              • MD5 SHA1 SHA512 SSDEEP

              zh-CN.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\zh-CN.pak
              • Size 357KB
              • SHA256 b33b23552f8f76aa43671556676298c0af54641e9f1de27a8208750148e737ca
              • MD5 SHA1 SHA512 SSDEEP

              zh-TW.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\locales\zh-TW.pak
              • Size 353KB
              • SHA256 69d888be9d5affc6086e901cf52936477101374abd8186f8e8f6cc38af826691
              • MD5 SHA1 SHA512 SSDEEP

              resources.pak

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\resources.pak
              • Size 479KB
              • SHA256 b1ef0fc15f1f2eb6762611a66ac927b65e1d741cca6770571300cec2260030ef
              • MD5 SHA1 SHA512 SSDEEP

              app-update.yml

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\resources\app-update.yml
              • Size 175B
              • SHA256 9161bcc9763091ff3670ef98eff99d004c0f67f13b5dd94715c661fae274cf33
              • MD5 SHA1 SHA512

              app.asar

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\resources\app.asar
              • Size 3.5MB
              • SHA256 a33ee867cd67ef82c90b4a72e62d49eecabfd6003264a0ead548cc53633c457c
              • MD5 SHA1 SHA512 SSDEEP

              elevate.exe

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\resources\elevate.exe
              • Size 115KB
              • SHA256 e439b50cdf14e2e9fe147a0d819ab8e675151f60f91c5c356cccd42edf4b22aa
              • MD5 SHA1 SHA512 SSDEEP

              snapshot_blob.bin

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\snapshot_blob.bin
              • Size 253KB
              • SHA256 c1c9145735032bff20b2fff50a4b92ae9cf47290f433e3f3b32e3b232d610c59
              • MD5 SHA1 SHA512 SSDEEP

              v8_context_snapshot.bin

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\v8_context_snapshot.bin
              • Size 356KB
              • SHA256 371dfa1e8735d05cb1f4f9d49fb49c1ce310cf5cbd44f1322165b7c2c97402d9
              • MD5 SHA1 SHA512 SSDEEP

              vk_swiftshader.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\vk_swiftshader.dll
              • Size 218KB
              • SHA256 517ec28afd7035a3e7c7c51f6c375bfa2267559ae90d7f7fd4b42ba327f7d2b5
              • MD5 SHA1 SHA512 SSDEEP

              vk_swiftshader_icd.json

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\vk_swiftshader_icd.json
              • Size 106B
              • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
              • MD5 SHA1 SHA512

              vulkan-1.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\7z-out\vulkan-1.dll
              • Size 418KB
              • SHA256 3b6bf58d0d09b89a5e8771bd17ebd0a9da337d88f09ac464e183db7e793a81a7
              • MD5 SHA1 SHA512 SSDEEP

              INetC.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\INetC.dll
              • Size 238KB
              • SHA256 ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
              • MD5 SHA1 SHA512 SSDEEP

              SpiderBanner.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\SpiderBanner.dll
              • Size 9KB
              • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
              • MD5 SHA1 SHA512 SSDEEP

              StdUtils.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\StdUtils.dll
              • Size 100KB
              • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
              • MD5 SHA1 SHA512 SSDEEP

              System.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\System.dll
              • Size 12KB
              • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
              • MD5 SHA1 SHA512 SSDEEP

              WinShell.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\WinShell.dll
              • Size 3KB
              • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
              • MD5 SHA1 SHA512

              nsExec.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\nsExec.dll
              • Size 6KB
              • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
              • MD5 SHA1 SHA512 SSDEEP

              nsis7z.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\nsis7z.dll
              • Size 424KB
              • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
              • MD5 SHA1 SHA512 SSDEEP

              package.7z

              • Path C:\Users\Admin\AppData\Local\Temp\nsu37C5.tmp\package.7z
              • Size 5.8MB
              • SHA256 9e465dfe4f35ae1aaecd460c72dab1edab2cd51f90980c8f1c2006159aa83d91
              • MD5 SHA1 SHA512 SSDEEP

              default.dic

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
              • Size 2B
              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
              • MD5 SHA1 SHA512