4ef73303cbf4258a6ff87a80daf95ddc43b82e5f4ed9c6ae64392c66ed231549

Analysis

max time kernel
1200s
max time network
1175s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
02/05/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HS Loader.exe
Size 84.1MB
Sample240502-c9963aeh2s
SHA256 4ef73303cbf4258a6ff87a80daf95ddc43b82e5f4ed9c6ae64392c66ed231549
MD5 ef8f5ad81a05cb403af561c136a722d6
SHA1 f8b097f07cb5dd5f6000713de9915f1266654263
SHA512 63c4c7e0da3241c64edcdd0ba2718d90a7ea5f0265e20f8f37d75c3a99e9050c1bcc28a363a0260f98e06a2b42809115731ad0c4017c54017c4088550ffac176
SSDEEP 1572864:J4gPXMoFM+VpdW9QMBSiFeKChjdVhboBNtDkaFx7qAJjq1elX15Wz7:J4AcV6WSMwiFeKOortDtFx7qASelX156
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
684	HS Loader.exe
4016	HS Loader.exe
3864	HS Loader.exe
10420	HS Loader.exe

Loads dropped DLL 14 IoCs

pid	Process
2424	HS Loader.exe
2424	HS Loader.exe
2424	HS Loader.exe
684	HS Loader.exe
684	HS Loader.exe
684	HS Loader.exe
4016	HS Loader.exe
3864	HS Loader.exe
4016	HS Loader.exe
4016	HS Loader.exe
4016	HS Loader.exe
4016	HS Loader.exe
10420	HS Loader.exe
10420	HS Loader.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
6	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	HS Loader.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	HS Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	HS Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	HS Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	HS Loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	HS Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	HS Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	HS Loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	HS Loader.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
10924	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
1148	tasklist.exe
7628	tasklist.exe
7668	tasklist.exe
8256	tasklist.exe
7860	tasklist.exe
7776	tasklist.exe
7736	tasklist.exe
7520	tasklist.exe
8176	tasklist.exe
7808	tasklist.exe
7888	tasklist.exe
8264	tasklist.exe
8120	tasklist.exe
8008	tasklist.exe
7952	tasklist.exe
7824	tasklist.exe
7560	tasklist.exe
7544	tasklist.exe
7504	tasklist.exe
8300	tasklist.exe
8064	tasklist.exe
7976	tasklist.exe
7968	tasklist.exe
7720	tasklist.exe
7712	tasklist.exe
6260	tasklist.exe
7568	tasklist.exe
7496	tasklist.exe
7456	tasklist.exe
7696	tasklist.exe
7896	tasklist.exe
7868	tasklist.exe
7596	tasklist.exe
7512	tasklist.exe
7904	tasklist.exe
8048	tasklist.exe
7844	tasklist.exe
7372	tasklist.exe
7576	tasklist.exe
7480	tasklist.exe
7472	tasklist.exe
8240	tasklist.exe
8084	tasklist.exe
7760	tasklist.exe
7448	tasklist.exe
7684	tasklist.exe
8220	tasklist.exe
7852	tasklist.exe
7424	tasklist.exe
7876	tasklist.exe
8208	tasklist.exe
8148	tasklist.exe
7768	tasklist.exe
7308	tasklist.exe
7428	tasklist.exe
8016	tasklist.exe
8072	tasklist.exe
7388	tasklist.exe
7640	tasklist.exe
7676	tasklist.exe
8164	tasklist.exe
8128	tasklist.exe
7960	tasklist.exe
7044	tasklist.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
684	HS Loader.exe
684	HS Loader.exe
684	HS Loader.exe
684	HS Loader.exe
684	HS Loader.exe
684	HS Loader.exe
11020	powershell.exe
11020	powershell.exe
11020	powershell.exe
11200	powershell.exe
11200	powershell.exe
11200	powershell.exe
10420	HS Loader.exe
10420	HS Loader.exe
10420	HS Loader.exe
10420	HS Loader.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2424	HS Loader.exe
Token: SeDebugPrivilege	1148	tasklist.exe
Token: SeShutdownPrivilege	684	HS Loader.exe
Token: SeCreatePagefilePrivilege	684	HS Loader.exe
Token: SeIncreaseQuotaPrivilege	4288	WMIC.exe
Token: SeSecurityPrivilege	4288	WMIC.exe
Token: SeTakeOwnershipPrivilege	4288	WMIC.exe
Token: SeLoadDriverPrivilege	4288	WMIC.exe
Token: SeSystemProfilePrivilege	4288	WMIC.exe
Token: SeSystemtimePrivilege	4288	WMIC.exe
Token: SeProfSingleProcessPrivilege	4288	WMIC.exe
Token: SeIncBasePriorityPrivilege	4288	WMIC.exe
Token: SeCreatePagefilePrivilege	4288	WMIC.exe
Token: SeBackupPrivilege	4288	WMIC.exe
Token: SeRestorePrivilege	4288	WMIC.exe
Token: SeShutdownPrivilege	4288	WMIC.exe
Token: SeDebugPrivilege	4288	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4288	WMIC.exe
Token: SeRemoteShutdownPrivilege	4288	WMIC.exe
Token: SeUndockPrivilege	4288	WMIC.exe
Token: SeManageVolumePrivilege	4288	WMIC.exe
Token: 33	4288	WMIC.exe
Token: 34	4288	WMIC.exe
Token: 35	4288	WMIC.exe
Token: 36	4288	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4288	WMIC.exe
Token: SeSecurityPrivilege	4288	WMIC.exe
Token: SeTakeOwnershipPrivilege	4288	WMIC.exe
Token: SeLoadDriverPrivilege	4288	WMIC.exe
Token: SeSystemProfilePrivilege	4288	WMIC.exe
Token: SeSystemtimePrivilege	4288	WMIC.exe
Token: SeProfSingleProcessPrivilege	4288	WMIC.exe
Token: SeIncBasePriorityPrivilege	4288	WMIC.exe
Token: SeCreatePagefilePrivilege	4288	WMIC.exe
Token: SeBackupPrivilege	4288	WMIC.exe
Token: SeRestorePrivilege	4288	WMIC.exe
Token: SeShutdownPrivilege	4288	WMIC.exe
Token: SeDebugPrivilege	4288	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4288	WMIC.exe
Token: SeRemoteShutdownPrivilege	4288	WMIC.exe
Token: SeUndockPrivilege	4288	WMIC.exe
Token: SeManageVolumePrivilege	4288	WMIC.exe
Token: 33	4288	WMIC.exe
Token: 34	4288	WMIC.exe
Token: 35	4288	WMIC.exe
Token: 36	4288	WMIC.exe
Token: SeShutdownPrivilege	684	HS Loader.exe
Token: SeCreatePagefilePrivilege	684	HS Loader.exe
Token: SeDebugPrivilege	6260	tasklist.exe
Token: SeShutdownPrivilege	684	HS Loader.exe
Token: SeCreatePagefilePrivilege	684	HS Loader.exe
Token: SeDebugPrivilege	6668	tasklist.exe
Token: SeIncreaseQuotaPrivilege	7328	WMIC.exe
Token: SeSecurityPrivilege	7328	WMIC.exe
Token: SeTakeOwnershipPrivilege	7328	WMIC.exe
Token: SeLoadDriverPrivilege	7328	WMIC.exe
Token: SeSystemProfilePrivilege	7328	WMIC.exe
Token: SeSystemtimePrivilege	7328	WMIC.exe
Token: SeProfSingleProcessPrivilege	7328	WMIC.exe
Token: SeIncBasePriorityPrivilege	7328	WMIC.exe
Token: SeCreatePagefilePrivilege	7328	WMIC.exe
Token: SeBackupPrivilege	7328	WMIC.exe
Token: SeRestorePrivilege	7328	WMIC.exe
Token: SeShutdownPrivilege	7328	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 684	2424	HS Loader.exe	81
PID 2424 wrote to memory of 684	2424	HS Loader.exe	81
PID 684 wrote to memory of 3340	684	HS Loader.exe	83
PID 684 wrote to memory of 3340	684	HS Loader.exe	83
PID 3340 wrote to memory of 1148	3340	cmd.exe	85
PID 3340 wrote to memory of 1148	3340	cmd.exe	85
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 4016	684	HS Loader.exe	86
PID 684 wrote to memory of 3864	684	HS Loader.exe	87
PID 684 wrote to memory of 3864	684	HS Loader.exe	87
PID 684 wrote to memory of 4636	684	HS Loader.exe	89
PID 684 wrote to memory of 4636	684	HS Loader.exe	89
PID 4636 wrote to memory of 4288	4636	cmd.exe	91
PID 4636 wrote to memory of 4288	4636	cmd.exe	91
PID 684 wrote to memory of 2392	684	HS Loader.exe	92
PID 684 wrote to memory of 2392	684	HS Loader.exe	92
PID 684 wrote to memory of 3484	684	HS Loader.exe	94
PID 684 wrote to memory of 3484	684	HS Loader.exe	94
PID 684 wrote to memory of 4048	684	HS Loader.exe	95
PID 684 wrote to memory of 4048	684	HS Loader.exe	95
PID 684 wrote to memory of 1092	684	HS Loader.exe	96
PID 684 wrote to memory of 1092	684	HS Loader.exe	96
PID 684 wrote to memory of 2628	684	HS Loader.exe	97
PID 684 wrote to memory of 2628	684	HS Loader.exe	97
PID 684 wrote to memory of 3868	684	HS Loader.exe	98
PID 684 wrote to memory of 3868	684	HS Loader.exe	98
PID 684 wrote to memory of 1724	684	HS Loader.exe	100
PID 684 wrote to memory of 1724	684	HS Loader.exe	100
PID 684 wrote to memory of 4192	684	HS Loader.exe	102
PID 684 wrote to memory of 4192	684	HS Loader.exe	102
PID 684 wrote to memory of 3952	684	HS Loader.exe	103
PID 684 wrote to memory of 3952	684	HS Loader.exe	103
PID 684 wrote to memory of 576	684	HS Loader.exe	104
PID 684 wrote to memory of 576	684	HS Loader.exe	104
PID 684 wrote to memory of 860	684	HS Loader.exe	105
PID 684 wrote to memory of 860	684	HS Loader.exe	105

C:\Users\Admin\AppData\Local\Temp\HS Loader.exe
"C:\Users\Admin\AppData\Local\Temp\HS Loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\2fkZGi0ygyFVB62CnMhe8tM5hns\HS Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2fkZGi0ygyFVB62CnMhe8tM5hns\HS Loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1148
- - C:\Users\Admin\AppData\Local\Temp\2fkZGi0ygyFVB62CnMhe8tM5hns\HS Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2fkZGi0ygyFVB62CnMhe8tM5hns\HS Loader.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\theonlyscript" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1672 --field-trial-handle=1676,i,371545780308238433,2604154850225992488,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\2fkZGi0ygyFVB62CnMhe8tM5hns\HS Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2fkZGi0ygyFVB62CnMhe8tM5hns\HS Loader.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\theonlyscript" --mojo-platform-channel-handle=1852 --field-trial-handle=1676,i,371545780308238433,2604154850225992488,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=NaN get ExecutablePath
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3484
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1092
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3868
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1724
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4192
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:576
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:860
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4896
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4240
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4376
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4632
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4652
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2236
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3876
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2816
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5036
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3940
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4844
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2080
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2868
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2888
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4624
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4780
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4992
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2428
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4812
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1188
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3576
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2440
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1268
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5072
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2824
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3732
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1856
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2316
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3824
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1440
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1540
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2848
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1452
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4764
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4804
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2140
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:920
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1760
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3552
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5148
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:5168
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:7944
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:8944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\2fkZGi0ygyFVB62CnMhe8tM5hns\resources\app.asar.unpacked\bind\main.exe"
    3⤵
    PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:5212
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:7816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:5228
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:7328
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:7348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:9996
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:7928
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:7536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:10884
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:10924
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:10932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:10980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:11020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:11160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:11200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
    3⤵
    PID:11192
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:11200
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=NaN get ExecutablePath
      4⤵
      PID:7732
- - C:\Users\Admin\AppData\Local\Temp\2fkZGi0ygyFVB62CnMhe8tM5hns\HS Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2fkZGi0ygyFVB62CnMhe8tM5hns\HS Loader.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\theonlyscript" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2872 --field-trial-handle=1676,i,371545780308238433,2604154850225992488,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    PID:10420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\71d432449ef51c8b\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 708d894f3c54f7901b5935f60edfa9e89059f13c9f3485ca0e641136c8866f92
MD5 a08c4aadd439c7ad87a30284e18fa30d
SHA1 26f9b978f793467fcd772eb93e943f45a53ab25d
SHA512 7ef5774d9cae3d95087e093bdb50e20ad317809ab0c74af15e2e4788b413c4d9bd6a289c76793e1a19b62647f92e594a39ea622e1b1d8fd6195a0eb6388026d5
SSDEEP 3:K7mYlGlll/l/lXp9ZjrPBY04FplltDP:K7Z0dPBY041z
MD5 SHA1 SHA512 SSDEEP

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\71d432449ef51c8b\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\71d432449ef51c8b\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1KB
SHA256 24ba4119cf948dc0a89cdf544a40fdcc410adb5af3647a0bac123ded94e77ffa
MD5 63b55c45c926ce755107457bf4e39931
SHA1 ff5fb21c4f0df2794351c3806fcbc2a412e70ad5
SHA512 b9a8d42f684b5904b6899fe44cf363ff805cde7806c11ab50116f798db4353eaab4e7f96d94dabca374057eeef50a442a8cf7309a0c2cda25255ebad196a174f
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

2fda47ac-ceb0-4ef0-adc2-269c0817bc18.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\2fda47ac-ceb0-4ef0-adc2-269c0817bc18.tmp.node
Size 1.4MB
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33
SSDEEP 24576:HczztZ12vAxqcdzoAyv+liT0eYiYJ869tUb/K:8zztZ12vodwW0T0NZJftm
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\2fkZGi0ygyFVB62CnMhe8tM5hns\chrome_100_percent.pak
Size 132KB
SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
MD5 a0e681fdd4613e0fff6fb8bf33a00ef1
SHA1 6789bacfe0b244ab6872bd3acc1e92030276011e
SHA512 6f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196
SSDEEP 3072:tezwJCGIekwf9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:tezw1Iek+42k3yMK18Gb0OV8ld0GecQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_1uodluxm.p2j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1uodluxm.p2j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

adf8ad49-0ec9-43b7-bc90-b578bf95f3df.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\adf8ad49-0ec9-43b7-bc90-b578bf95f3df.tmp.node
Size 151KB
SHA256 d43138ef3cb7ca53e2936e5b5547ed8e9e79cbbb66cf70d5c08796cb6ed7c913
MD5 cced65f76596bd833c8b7decc7ecc648
SHA1 cb0acdb5377579957f8cfcee4d5b721a63690bd8
SHA512 8c75405c09a188ab191ed99582661ecdd9d8548cd94af103c3ccc88cf3279cdae670336c7371c5ad96190d727c30b91845d2ec23193ef879ef81424fa00c2f5c
SSDEEP 3072:gklobkSdQBGaIz9b7X9PzxCqlfRV3Wg7ZOECHk:Mbb6A9BXXtzlnYk
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
MD5 SHA1 SHA512

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\LICENSES.chromium.html
Size 8.8MB
SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
MD5 2675b30d524b6c79b6cee41af86fc619
SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\chrome_200_percent.pak
Size 190KB
SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
MD5 c37bd7a6b677a37313b7ecc4ff01b6f5
SHA1 79db970c44347bd3566cefb6cabd1995e8e173df
SHA512 a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb
SSDEEP 3072:ADQYaE/N6Mrvy/3JP29W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ADQYaSN6svyd242k3yxgx5GMRejnbdZR
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\ffmpeg.dll
Size 2.8MB
SHA256 bf744924cf808c38d4f5762dcdda440b2f6b491794ca0c46c15a04d3297d6a1a
MD5 22d50afb406613ac0789e382ce32313b
SHA1 b9178d1aa98cd33c0b7e092aa0aebc97ed256a06
SHA512 dc73666abff6ba7f521f2443d4273076b12b289a47581a3beaf7f6a358f381eb70f9cc0039cdea7a271667a55c52de54b354a005481a65b9afda2505e697d62a
SSDEEP 49152:RF5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQWSCu:RFvSkJXv+tiLAD0+DWS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\icudtl.dat
Size 10.2MB
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\libEGL.dll
Size 477KB
SHA256 43d0e9d697ea51e229d4ccc53cdfeec54c79d6745071ef882dc5d651ae91fc6b
MD5 e624a4ce2174b99bf0f79dda1ce7a77b
SHA1 a823daf4e44a1d49fd6c83bca47da72de5cd3c94
SHA512 e56f8ed42e8edb85e7e5ad2645b1c51883137dfd80ad6e62f95a1915a8368c03231c2c17bf57722ed61529ae39116dbaf51191b0640ed9ce634703425f300c89
SSDEEP 6144:r8hd1BSjuMmof2SEXVVfgV8hxN7h2NdIEOg51f0FticyQ:r8DXSjZmof2SEsmN12NdIE7f0FticyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\libGLESv2.dll
Size 7.3MB
SHA256 798c4173428eccea4950d20662312a42f622c3936cc9e2e1e86f1c2b832274da
MD5 6202ae2b5c4e131abc14aa25747300b8
SHA1 af3f8f11aac179476c09ee2a34b14fbb88531ee5
SHA512 ec26b39af649aa86f65e85e598b6bb96ed2193667115e8292227553b6597948fb9bf71b11f85e9dfb982fed330e72d9aa5d7ec120937810d7b40b1c6879d01f8
SSDEEP 98304:8wY1sQqaLe2Egto8U4r5Pp6TlITQZ3QW888888888tb8dDi:TNaSgtvroZQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\af.pak
Size 447KB
SHA256 6981249837ad767fc030edc8838878a5e493fb08cc49982cffaed16cfbeb564d
MD5 917a688d64eccf67fef5a5eb0908b6d4
SHA1 7206b01bbc3fd8cc937db9050dd8ac86cf44d8cc
SHA512 195dbec8463cf89990232296c5c927e1501f0c2e01a7be7c6a6acae651853ce1edb23d639af65979b39a3c61979119c3a305acfa3aadf0cb93e241c5e57f4534
SSDEEP 12288:/cqYYWk0o+wZiSMKVQ2uM2Z12JynA7PIrfsdgSTCSQ2fs37KQOb5t/tn6A/HiaHU:ynk0ofMSMaTuM2Z12JynA7PIrfsdgST4
MD5 SHA1 SHA512 SSDEEP

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\am.pak
Size 727KB
SHA256 12e9e1bec1c46e5ea706157726e17a4429acf288a5754fa183bd9b4cf7d3853b
MD5 3cfd7c5bb92ab72c63e003208a9e4529
SHA1 165d2f69ab6a6e237f0fec943b5577123cefea87
SHA512 cd7c7837d758ea66abc871503cda6fe99ff45990405e60c1133e7c1f4cb29ee69723c9558bb2d3eccb42948da57351f4f095062616686ab2e255acd3c86236f0
SSDEEP 12288:LMlGLQXTZou76VIx2TERZ3ej5dMNzLY5S9ZSVrBO0Pcx30jH8+F:Lc9XTZsVIxJRZuj5dMNzLY5S9ZSVrBOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\ar.pak
Size 794KB
SHA256 3ca47b9c436723f837a53b2904b51efdf13ab6cad2f3ef4fe48a1115847eccbf
MD5 3c2ab7363018db1f20b90acbc305cb4c
SHA1 60b9cf453178ad0e60faf20d137a0c7eabde65c9
SHA512 589beb3e95e93f30341933c9b9826210e6bf3e9c1ad8f113d9d8a98fa5a526f81e454ee3357fb55d60d67a4890ce33e964ba2fa810e1771a6b7e82746492313a
SSDEEP 12288:EyBYh5/N/RaWH4gzWvwU5Twikcb5uNi3+D2qeTT:E3aR/5D+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\bg.pak
Size 828KB
SHA256 a5eb7038ed956bad7704a722f05691474ff709dffbad92b8e31dbb869ad58334
MD5 a69f6075863d47b564a2feb655a2946f
SHA1 062232499ff73d39724c05c0df121ecd252b8a31
SHA512 930ce3938aa02a8bcc609a64bd86b7e6164d63baad157a980fd079859a6bee5db87bd1f7a74a71108f8368bc9c6154bf14a2dba1abf269f572bc262614bcf1db
SSDEEP 24576:T3ChsqKaElYMdAs1axUjHh373Zj93aAK5kVDgQwRunpKd2ao57JqueRSnQFwN/6B:TChsqKaElYtUjHh373Z53a1kVDgQw1dn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\bn.pak
Size 1.0MB
SHA256 87670ff2ceb1ebc38fce2c3b745ac965f3de5de3133d99ed33933a8f3e99d874
MD5 d43ce80ddca3fab513431fa29be2e60a
SHA1 3e82282e4acfec5f0aca4672161d2f976f284a0c
SHA512 1d33ca9bacb91ef328f89a14777a704000bf30fe59aa1cbbbff34d8bad266c98d78c9e411e289e834e76eb721dd98934426a565cd5b3436d5a103abe37f7612a
SSDEEP 3072:PAUxhq6CLf6bXs8iQ2Zc2EadKZ0ZfQ0/QeIyTtPukkBBbpUDDM5JiXldW:4K46CjYYZ82IypPubBbf5IlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\ca.pak
Size 503KB
SHA256 d9c45d55a9a5661063b9bbebb0615de8f567f3925d04fd10938da9617c6220e0
MD5 2d30c5a004715bc8cd54c2e21c5f7953
SHA1 fed917145a03d037a32abac6edc48c76a4035993
SHA512 b3803551f53d290d8839789f829afc9c1e12052c81ba20d5e01fb3d2bacd5d1e97bd4c05074322eed17fdec04c9176c655076faec8a3aef17c39fb999e0c1fcf
SSDEEP 12288:KhBp7kcELygV3z5PAF4N3Mw2juwHzejm0t3lvq8E9oCRaIs3cmlLEY2CJkEydROC:Khh4V8RPS9lMN4MZRg5P56iq
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\cs.pak
Size 518KB
SHA256 397134d1834f395f1c467a75d84ef2e8545cb0f81e94dbe78b841fbbdaad802d
MD5 06e3fe72fdc73291e8cf6a44eb68b086
SHA1 0bb3b3cf839575b2794d7d781a763751fe70d126
SHA512 211594c30ad4f5ca8813596b59751168c60dfa0d13f24f2aa608fce82d21c2de3de69fe007c4bde1602da8aa7ea81ec0f15e173abc1224362c36b493b425b425
SSDEEP 12288:ljXB+Hdo1ryvJvtQW5EK8VPDNOQ3SCmPs:ljXwHO1uvJ195EK8V5ObCmPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\da.pak
Size 468KB
SHA256 0b9da7bd6531a7ebe7d8188b320c0953adcfbaf654037f8265261a12e63d3c87
MD5 1939faa4f66e903eac58f2564eeb910e
SHA1 bace65ee6c278d01ccf936e227e403c4dff2682d
SHA512 51588d2fe724e6c407724ea6f46883ded39397af744effaf672f75952a6a734e61e93e59f446080317f2a2b3fa1b45e7405f90fe0b226c44c9f3dd9a4e130a87
SSDEEP 6144:+luvzrGLXfBlzV0qV5cU3sVEs7a7wlTwUJwa7obRR2vJub51NrXBDUd4JTGqfwI:+HbzszaoQR5rrBTpz
MD5 SHA1 SHA512 SSDEEP

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\de.pak
Size 500KB
SHA256 6d787033c94755cc80c187ed8a9de65808bb4d7968354bbb94b7868ac2e8d205
MD5 2163820cd081fdd711b9230dc9284297
SHA1 c76cc7b440156e3a59caa17c704d9d327f9f1886
SHA512 920fa2a10f7aa7f1f6d911fe2a77eded0384617d8fd863943afd99a584dab3fb2ea3e5d2e20bca529689a99fdf303912007f2918c62482d8a90194a810f6e535
SSDEEP 6144:Vsu6moWkxlRnY43K7UpHa63gXya/nOdxIHa3AnO1a265QM5GR6mszMRQI2Cga:VsU4e43K7UpxgCaPoCwM5Vmv2Cga
MD5 SHA1 SHA512 SSDEEP

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\el.pak
Size 907KB
SHA256 eb46d9860835b69d33b2583d1e52b20238b666b967bf00906424e3c8a161ed64
MD5 a14d8a4499a8b2f2f5908d93e2065bf7
SHA1 1473a352832d9a71c97a003127e3e78613c72a17
SHA512 427271d12590f8ea3f11b83e4c0ce79c55c289573c5f6e5c70c789b28a5181f295a3c9b1a4bdd1f731f338e6edb1e06318ea6410ceac546128a84ff8f2ec0b40
SSDEEP 24576:ovf5YcXPdGgx11hxi9c9N+JXDsSYSmqHMuD2fpoLwj3BAVH8+VdQ5tNDQo32Etfd:2f5YcXPdGgx11hxi9c9N+JXDsSYSmqHe
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\en-GB.pak
Size 408KB
SHA256 f4d45ccc89834376f35d4d83fe5b2d5112b8cc315fcb03228720749aae31c805
MD5 9d9121bdc9af59b5899ce3c5927b55d8
SHA1 568626a374cd30237c55b72c74b708da8d065ec1
SHA512 149a8acf256dc12f62706f72ad8ec88cbfdf7f8dc874bcd9facf484cdb00e7c5787f5e1bbc12b5bbe1b19b6524e7e8a1c7dba2838abeb9aafa3ce89795fd22ae
SSDEEP 6144:A8iCFs0mZ2dXipvrIQoqbh7GMP9eRT/LfaY1+/845prSQBE0RbhU:AJCyeXipvrI7IGMuT/7o5ZSsU
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\en-US.pak
Size 411KB
SHA256 0fd74bb69ad35b3f9391fa760bf0eb0ee73d2bea0066244577ef2abd269513de
MD5 626f30cfd9ad7b7c628c6a859e4013bd
SHA1 02e9a759c745a984b5f39223fab5be9b5ec3d5a7
SHA512 9ce902f21fef70c5b5af444b532b36c9a00d896878cb4021c9b1dc07aa3277d956bca65ee0adb68467eec113e535b60a8a5fb5414c7d0ca761ceae5c43b7d9a9
SSDEEP 6144:MOoiE2KSqdBEuUu6/9meKMP9e7X9ifaY3yzq5J7SKn0F/lOSwH:n5EC2B4bKMwX9cj5hSwSwH
MD5 SHA1 SHA512 SSDEEP

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\es-419.pak
Size 496KB
SHA256 8f7b8776e61e3ed5aa33b1a571ac834653b54b12a499d956b95d567b7e1ba987
MD5 6f4613a4a88af6c8bd4ef39edeee3747
SHA1 c8850a276d390df234258d8de8c6df79240c8669
SHA512 e5933dcb2aaaa2018ba8b13f4af3dc8a950640ac60acb1b56ad6de24541701d0ffc1f4cb28c7932af924bfd673edcee20bf649156ab95ea9499ec43c703ea141
SSDEEP 3072:iEsyQDjcRy2VdU1P2BCA6bKVjnE4rHOniSb8p5Yl+lblmwoab5uIay5LlZi+SLFv:iEsyQvt2ECiOX3p5YWm85wLFaoImYA
MD5 SHA1 SHA512 SSDEEP

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\es.pak
Size 495KB
SHA256 848d422be1b8fae74786ed6d6dfa7dd2e97b798b4a9ba1d929085e425b2a54e0
MD5 a24e01a4947d22ce1a6aca34b6f2a649
SHA1 750c2550465c7d0d7d1d63ad045b811b4a26dc55
SHA512 02fc4ce96aa523ebc204243bbec3347b09cb20bcc0ba66cf9532a6fb26c48f7f2396bbb833f1916f8f081ffc9c6cd2de07315e66c5115042a0b44270fa4468c1
SSDEEP 6144:NPKK+SmGmQaXDFY1+hM03GgDE7pF+E8y1l4Fj05fYrK3osSl6PZjHu:ZKKDmXXDdq01ap4y1lEj05Qr0osTO
MD5 SHA1 SHA512 SSDEEP

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\et.pak
Size 449KB
SHA256 84866ccaf2ec39486f78e22886bef3fe75c1eb36e7a7c071471040e12018db28
MD5 82a07b154cb241a2ebe83b0d919c89e9
SHA1 f7ece3a3da2dfb8886e334419e438681bfce36cf
SHA512 07319d155bdf9e27762ecb9ef6871430bef88b1af129450eb65aa798ebaa4e02b25b0cf9bde3b12ff1b04a3d14241569b73d6af895d2e85dd7b24d393e7317e9
SSDEEP 6144:2Ve10hVbtjvP4cCJ1ONRCOeP+sEmThFC0jmFohH4fSpY0lgtim0DM5Oju43sPZCo:+eQtjvP4cnre/tHmFoh99M5Oj+x
MD5 SHA1 SHA512 SSDEEP

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\fa.pak
Size 738KB
SHA256 dae7e7c87026cd4e8a4cd813cc71def32c86ed47865ce6da5383b66b7021c5bc
MD5 c770cfb9fbabda049eb2d87275071b54
SHA1 20e41b1802c82d15d41fadaf3dcd049b57891131
SHA512 cda117a60c853f12ade579c34fce22d992b33df1f5001a237767b6e642d5c775c3387bcee05d6557fe5a2f6235f93258954a697d3b9812d2550c4801869f4751
SSDEEP 12288:DCD38/+r28u313uyqoe+slXcfqEdvRmXzoT4WmdAQifaQ2XxFHGk62BtMX9OxRdn:DCDo+r28u313uyqoe+seqIvRmXzoT4Ws
MD5 SHA1 SHA512 SSDEEP

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\fi.pak
Size 459KB
SHA256 7a3249514585491eb47fe4b579edc27ccc48761e7ad6bc11d113b257132c5dd2
MD5 fe011231bbc8b3a74652f6a38f85bc88
SHA1 2b851e46738d466b3a5a470de114d15051b6eb6b
SHA512 2a4e5c1409347b4b514556c81ef32c8ae118add28e3469717b13045c8424fed9b817c7988629050ed3e732e0cdca181891b6a8b9e64e4c8d65f004d7c8db9796
SSDEEP 6144:K+2JevEiMD19i//8e36bwFh20RtrZs6TIOEysaI9LL59YWyHrE5WacpoPWmMWO4C:K+9Hs19S/rKJam59YdHrE5WaipKYn
MD5 SHA1 SHA512 SSDEEP

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\fil.pak
Size 519KB
SHA256 91149190c856195fb330605686acf09c7197e5b7efe37fe2a7c76bb8fb08cc89
MD5 7354de570c8132723c8e57c4ccb4e7c4
SHA1 177780faf460e3c8a643a4d71c7a4621345a8715
SHA512 a8487a6a7fd46d62e78ca4262de49e12c120268561ee61a642c45efa48116edebeb40cf9e8be229db0bbf06bb6b5457cc54399a08ee6a603e5540ef5ca482798
SSDEEP 6144:VJPfDjGZPitD/ty3DQZIbpiWFevNnGFZ338mC5oVms68ARrq8:VhGAodn7C5Sm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\fr.pak
Size 537KB
SHA256 52aa0a18ace6347b06a89e3851a1b116812c022dbe41da8942278878b5409cee
MD5 d8b4bc789a0c865fb0981611fb5dcdbc
SHA1 33f9f03117f0bba56a696f2fa089ba893ee951a2
SHA512 58d19e5a3c68c901fa2a0c327a45b410ab9b9e6c39298db48eed25345453dce1a4633afe6277cf53ed558e160065b89c0e38a32caeced47e79783dbda4d74f26
SSDEEP 12288:V06pImfHXFZLiQphDDq6QuaMV5wKzvOtXDZ/MYnYtgLXfyzEi5Qx0JSWkv40wCns:VNfqsVaC5WK
MD5 SHA1 SHA512 SSDEEP

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\gu.pak
Size 1.0MB
SHA256 ff379dd77136b9b85e7e9fcb5b261ace9c6d9184af3ba2dea35b1757b9bab6d9
MD5 225167dbdf1d16b3fafc506eb63f6d1d
SHA1 8651b77f41e3c5b019ccb124a7c8f6449a04b96c
SHA512 a353d36a87b6608578816056647de45a456f9012d399b2cb5cb7b9de867a370fcaf1a90d293f367b9b678d13991294425abd85cf77e971afa0d3e9c316952115
SSDEEP 3072:QIEt+9TXuSm4vSDnlrjqy5HIwjAwREJKVMjNiT7llj63rFWlPvpMi5eQWiYJ+WRc:QIEtYXuLUKlrjTa4/WP5c4h6vFX
MD5 SHA1 SHA512 SSDEEP

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\he.pak
Size 645KB
SHA256 e3336668aad9ad661e7f589f1a405b9c95fc771261cdf9328aca88f4be763374
MD5 d8320b09c1e138b00655db0802687bca
SHA1 01616bda6b22c70d5c6440b7451ae736eb1336cb
SHA512 5a91596d7e82dc3d692083ae45aff6fdbddd08ca17f49a020e0769f98c4218b6c9cd31e54524473b7cdccbebf4d7a7f0ff23b5075a1e1ada5cc35c3fd0172bed
SSDEEP 12288:9xsskchOxS28YeqhCdrNGmnSWqo/IQXOl60pACDXbheQCap125nVwo9Ps5plm7oM:9Bk7g5Wof
MD5 SHA1 SHA512 SSDEEP

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\hi.pak
Size 1.1MB
SHA256 c640313e10e985a58d16f928d2428ae278421a070d948733ac68fdf7312090fd
MD5 9e1788b0f3e330baf2b9356a6c853b20
SHA1 a2f4b37a418669e2b90159c8f835f840026128d9
SHA512 b9a577e084f8daeb53fad0a9423661c99cab272125899a16b0b052606a2cb88f823137f3a21b5c06b10e0235321b7faca84cd759bf406fb2dd02c2f598e92cb5
SSDEEP 3072:CaaJyCmCd3RTaIEDOGV/BB0ZV1dsuOlRLXW3XHij0TByntDPtDlSp1s4u/8WLw3k:aQDa3RTaISOOz5j5thGM
MD5 SHA1 SHA512 SSDEEP

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\hr.pak
Size 500KB
SHA256 bfeeafe2f8a9f797d20c4209181c4768fbea4a61ff2dc1f57f6cd18bc872fc13
MD5 af7aec4b45ead620463b732e16f63e47
SHA1 e6838c56b945c936fdb87389fdc80cdf7bc73872
SHA512 784ff8dc6011883e931b4b8371e5ada960120931bfdf24f81648f5092fa31db1d03e5d3cf5cd16d57ea7fb7877bb25a28533085ab42bfe40dc25ca7d9cee7ade
SSDEEP 3072:3byA6gCM6By7Nv7vr7hA8aBV08Iouo+wvxr0Xcp/AikOSAqb+HicHE0uP1P4NUFn:Ahwxfh+cwJPwd75or76l/4c
MD5 SHA1 SHA512 SSDEEP

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\hu.pak
Size 538KB
SHA256 bab09c3cb80130a4a288642633c2b31ab08b1757466d9a468bc36d276079f002
MD5 b93beeb1e35a29b310500fa59983f751
SHA1 45c0b2cab4c4a820cfc2aed4b7236ddc79a0db00
SHA512 249de5b8bd7c4755caa8b9552254d353b0d885b63bd5f7c6c8e29b3f4e447c9e8d6c0e88d5aaba0b898aa26880592b3904e19ca4797a2ac1dd757aaee782c37c
SSDEEP 6144:0sTpI7ceE8WnOL42HPs2P0Ar7ky1XB5VwFZfpadYGDuU1gGse33a5gRFxztGateg:0spI7Y8WQ+AXB5VwAtj/3a5t+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\id.pak
Size 443KB
SHA256 f175e58be47b228803aa32d2695e2fcfaf4655b65b96fb6b539b3e59593e6799
MD5 bc719b483f20e9a0b4b88969941c869d
SHA1 4d926a9aba7c350e9da8aa570a9f52534c81aa88
SHA512 ddf6108888676c1a90865daaa88198b681b685d9047b0e10f5aa08daa39a628a84732a8518606176529297bec51ce8bc39e910eeffc8b88e9585fafb694c35db
SSDEEP 6144:f91C6s7szabK6s1o8Jf+eVnjHF26miZ0FZ58VhrwkK5R3SzP7IEji40Hf:fu7Bu6F85VnjHFXmM0b58VhAf
MD5 SHA1 SHA512 SSDEEP

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\it.pak
Size 489KB
SHA256 e86ba661b3f6f7ecd2312fe90b873330c0d6516a5501a0f326875844e8d4b289
MD5 ab160b6e8bbaba8f8bde7e2d996f4f2e
SHA1 eb7eae28a693337b8504e3e6363087b3b113bc72
SHA512 14e8919e2f5a7ad2b3f310ffec590b221e6e0dc45f37efc57ff9b8ff7a3ca674d6f4b9bd65e49a98af6726fa953f2168e5c8e6101ed977e8c7ff4a51203f8d4d
SSDEEP 6144:ZckXLmyax92+fMiMNDYISIqRRRsO1StBWRT9Tjex6qipELqbPpzHi9fLwsQ2nbwb:iWmhH6mZD28HG4KUw05klot
MD5 SHA1 SHA512 SSDEEP

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\ja.pak
Size 598KB
SHA256 63ad3974baa8c160ba30448171f148d008ac19e80010fb13d3a65cf411b67ae0
MD5 dee9626a8d7cacc7e29cff65a6f4d9c3
SHA1 5c960312f873ab7002ed1cce4afdb5e36621a3ce
SHA512 ee80d58886f4ac378d6491e075062c171a715af7c42dd1785952b25a572381acd722764e8be914adbfccf2a5fa4a51968b989b632eefb9d636851f1b8ffb82e1
SSDEEP 6144:a1AxTSuPJmsKRC/uGsDKNJL+iCrtZKQ2xM6bU5B7YxVD:a2xYsKRC2GsDa9StZKQ2xM75B7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\kn.pak
Size 1.2MB
SHA256 cd297f7e872b34e63ca2d98dc2fa79085e8a2985ba8757601e4b901a3f30b013
MD5 32e5f528c6cee9de5b76957735ae3563
SHA1 74a86191762739d7184b08d27f716cfa30823a98
SHA512 92d100b1289e63fd0dc65657fb4b1e16f298735e6cd066e9122d04e3b79e0d286f15fc9f1da2c3a05af528b92bde95fcfbc493c466db2d94a0749adfbf7fb8d5
SSDEEP 12288:UNHCRmR6fkA6GjYQnbY25l67c5qBUic+E+htyR:UNiRmR6Lr5mUJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\ko.pak
Size 505KB
SHA256 0d9b23e2981412d11ecea3ade8d521a073802d9431c39d72b88f62b98e50a96b
MD5 38a95d783d627e9a83ad636faa33c518
SHA1 cb57e8e9ef30eb2b0e47453d5ec4f29cea872710
SHA512 4119b8f82107473c941c9e10b6bae97d60c9c47570cc2b40f429a95f4f5cca77eecbacd7023af439429026f6e55ad9df19998c8b98be0d04d384b310d025c0dc
SSDEEP 12288:Bv+8Jr3zNRTuTjXcq+t8OQ4EVh3IKACqX5K7GGZ+8BtPq7hUomrOedlO:x+8BWm5H86alO
MD5 SHA1 SHA512 SSDEEP

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\lt.pak
Size 543KB
SHA256 3da531a9a5870315823e74b23031cb81379d2d94ae9894a7fb1d8a8ad51a2da9
MD5 3e9119a712530a825bca226ec54dba45
SHA1 10f1b6bf2fa3a1b5af894d51b4eb47296c0dbc36
SHA512 765c872cafa1b266575b0cac09dfa796cdb860bd82e1c657397fe2aada11771f306b0a1776e4d66ff41e94b153c812592430f31e7b1ff97abe7d8e6b96d321f1
SSDEEP 12288:ciW9XReMAg80mI963AS56ziarWCB56SNU:xAAMVL7S5Xa6CBW
MD5 SHA1 SHA512 SSDEEP

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\lv.pak
Size 541KB
SHA256 ae782f1e53201079ca555baa5ec04b163188e5161242d185f04a606a49fc8c0d
MD5 e75cdda386dd3131e4cffb13883cda5f
SHA1 20e084cb324e03fd0540fff493b7ecc5624087e9
SHA512 d27bc61028031946ed6708918f921c3d681c8962b8d5507a91ab6576e3b2c462524e550305db87ede886e41fb0e49edec2d84cdbbad675282105627e01d98bf5
SSDEEP 6144:E4wNRkfYqooJw9bJ28DZyJxyNGtVF2tPlz7c4YbUSZbb3n5nygN9E9J5gosRyEAS:Okxw5P8iplzw4XkXn5vE350ypO19
MD5 SHA1 SHA512 SSDEEP

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\ml.pak
Size 1.2MB
SHA256 e2fb73353ab05eb78f9845bdbdf50b64c9fb776b7f08948f976fe64e683397c4
MD5 6e96eddfe80da6aaa87f677feef4d1d6
SHA1 8a998785d56bc32b15cee97b172cd2dcdc8508d9
SHA512 feea11dfc6ec153ab903b5828306617eedeee19daa73bd046ae47757795fecb9abce6192bb3a9561aaace7fc85ee442057b93081c6c986855b819fd38815e6f7
SSDEEP 12288:+okD5/VA2cMmsbbAxqInxblD/xn9mMRTAr6DuhQA+tHxy3ewh+5qR7dCds/fv38C:aPzqzXry3e75qR7qs/X3X
MD5 SHA1 SHA512 SSDEEP

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\mr.pak
Size 1.0MB
SHA256 0ebb125a0bdfd1e21b79914ca8e279790d41f7bac35bf2d031dd7981f1c1c056
MD5 fda40999c6a1b435a1490f5edca57ccd
SHA1 41103b2182281df2e7c04a3fff23ec6a416d6aa9
SHA512 666ceb24d2e568a00a77512295e224a6545bf6abcfa19c93aa823db5330117fcb39fde570e7601dbd41976950c3ec03634f89fc5d9203357515e6651ab0b6d32
SSDEEP 3072:3P5UK/LY0rHXWjViQm0vLJuVXrMHwrNf3FaMUCyGR93RkR3bntOubz1hzudmHwfZ:xUCY8qA0pJvC3SGINa5/pC7t2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\ms.pak
Size 465KB
SHA256 d1072514bab63af5dfbf923175d491787139f0c1b6361acb23e67543836c84ba
MD5 73096184d7bd6a9a2a27202d30a3cfa1
SHA1 ea711b29787aa8b9e9af6bde5b74103429e5855f
SHA512 e3fbee4896554e502c222b5ffe38e9d61e9db4d18cdc92ce5118b819dc60789bfd6d6c7f8444ff1763222455ab91e79bfe500e75c0e06b0de70c2c64fb043c6f
SSDEEP 6144:B304QirwGezQZU+JsxJwCuRlO0jlsUcSP5slGKsMSYlEFh:O49UzKU9xJqlOulj5VhMM
MD5 SHA1 SHA512 SSDEEP

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\nb.pak
Size 452KB
SHA256 9253122d94ccea904fb9363b8178ca9335b8380b7891f1a7a22afb3113309e72
MD5 28cc86c7204b14d080f661a388e7f2c0
SHA1 e0927ea3c4fd6875dafd7946affb74ad2db400f5
SHA512 e2524e10d145f95c028d65e47cf06fc82c7a43fcf0ecf01202278c7fb14079c03e9434e8039fd96aaee870872c9896d9f0ed575e50c19a3781cb0c94fe59b3a5
SSDEEP 12288:8ba9K5cV3MpYuwOp7fdBia+c5Io42gz4vj:oa3D/a+c5z4hzE
MD5 SHA1 SHA512 SSDEEP

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\nl.pak
Size 466KB
SHA256 844031e1de2b2872d12d5b7d42adf633c9d4b48169b1b33b7492b3b060c73558
MD5 7fc6ae561fd7c39ff8ba67f3dbaa6481
SHA1 2e3977403a204c6f0ca9a6856bb1734490a57e72
SHA512 90294ae24b7db003bc34a48f98d9e1887e87c6f605defe01ddcf9187429e8446c04a7f94bb6aadc8e61c98842163bc3702b414393ab836eb0bee038f09481c2b
SSDEEP 6144:uerc6TeVRbZy3gihngHh9gog5HHnpo+h459tmxDGpF97358OTn:uf6Teuagog5nx459tmxDGpF97WOTn
MD5 SHA1 SHA512 SSDEEP

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\pl.pak
Size 521KB
SHA256 60aa08598a81bb46ddc64a5ab0852565554c6e6262e9c5dfee09f4e3fc08d5fe
MD5 ba7a9aba68211d8639dffae0ef8b88da
SHA1 a9a26b8f0902475cb576967cbe9013028cb21da4
SHA512 a1b8bfc3e19aa1267e31838e1c1f2b0b1cfcdf56f84e967088d626b58ec64b3305043a14b12fd080498ee1d74a4192453914c393ce8f848ea5616cf88abc4eb5
SSDEEP 12288:Hg1L9OZWoOB/oZU/FmXgvh6HA7b0mPeCUdVe3mbUbEmw1QhWRH5EdL4ftiJ:Al9OjtU01Qhc55y
MD5 SHA1 SHA512 SSDEEP

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\pt-BR.pak
Size 490KB
SHA256 40dd24c5e225ed941bbaab3dcfefa993e39fbc75a1798f4f6e06424956698ac5
MD5 53d5fb849c9bab70878b3e01bffad65a
SHA1 e72af1a76539e66cef4a4eef5844b067a4e1a79f
SHA512 55357643d789d2eed72e009f08f72ba4895ba455ca00c8347a3c3790e43f8d7e4625feda438ecac840bdc52c26d2135d89bea693b61a293922b6056bde6b4516
SSDEEP 6144:OrUbPq56NTyytNBXBLilIyMyE15aKJutiOsRhkxCp:Or6C5FyT5hJKsRKxM
MD5 SHA1 SHA512 SSDEEP

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\pt-PT.pak
Size 492KB
SHA256 2fb2fd2e32b952dcbc8914f9d3aaf02bf2750b72abfee2e8b2bb08062ddd9934
MD5 0237374730fa1a92dec60c206d7df283
SHA1 62dbbd855d83ef982a15c647b5608dafb748745a
SHA512 63ec4ec44002724e22703a3bd952d1ff4062b367c4f5e3f106349bd226ad1317bef2e371fda0e099ea5c0afd32a9d2c1246c93c18d73dccf8fc2c1644a6fb6b2
SSDEEP 6144:f3O/2bF2ozwfieJVJJxhoN4lCOfVY35NKimSRri:f+/2x2od35NKtSR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\ro.pak
Size 510KB
SHA256 4a2a305668f1926cfe4bb72e8fbfde747c83ac4dd9cf535c13ae642d0b96fb79
MD5 4e692489e2ae74a4a11ca0a113048f15
SHA1 cb2b80217d5372242d656ac015c024fe1e5e77b7
SHA512 8ad9e0a79137a862def24d6963536e75b87bb71ab74dbdd43531c5c95ddd3cd834f22c6a8e3a1e03aad35ade65ecd227d5101b5be3ce3f0b7b471f5136cfd77c
SSDEEP 6144:F5F0NqPzpwXg7XTLb/7FSmo/xOfinKdoGN5PBoC1s2e/m7O3:SI0g7XTL/FSmo5OqKdN5pop/53
MD5 SHA1 SHA512 SSDEEP

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\ru.pak
Size 836KB
SHA256 533f9e4af2dce2a6e049ac0eb6e2dbf0afe4b6f635236520aee2e4fa3176e995
MD5 1a9b38ec75ccfa3214bef411a1ae0502
SHA1 de81af03fff427dfc5ffe548f27ed02acae3402d
SHA512 05cf20aea71cdd077b0fa5f835812809ad22c3dbebc69e38ab2c9a26ad694ab50d6985aec61633b99713e7f57408c1c64ce2fb9ccdac26661b7167853bdd6148
SSDEEP 12288:2oZ3aknfQjRo4YS7yMh/KgNzJ9fx+aAka2qSGsN8zqcnYH8eXN2hPO3j/zpbzvMX:hZ3GR/5X6Eq
MD5 SHA1 SHA512 SSDEEP

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\sk.pak
Size 526KB
SHA256 b46db20eeba11f8365296b54469fdd001579852dc1d49a01fc59d2a8bcf880a3
MD5 f117e58e6eb53da1dbfa4c04a798e96f
SHA1 e98cee0a94a9494c0cfc639bb9e42a4602c23236
SHA512 dea792a63e0557d9e868c0310ec2a68b713daf5cf926389e05a0885cdb05433d20f35d087de269f9584795da50600966b8ff5dd95583861443a1e90564a89793
SSDEEP 12288:zF2oXDdqsGk2Rspyzir+e/5CvHLg3HXLPxt9R:EoXDdqshpyk/5uLIltD
MD5 SHA1 SHA512 SSDEEP

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\sl.pak
Size 506KB
SHA256 341c33514c627501026c3e5b9620cf0d9f482ab66b10a7e0fb112c7620b15600
MD5 435a2a5214f9b56dfadd5a6267041bd3
SHA1 36bbc7ca3d998bfb1edc2ff8a3635553f96ca570
SHA512 55271935e18ac27c753431af86a7dcd1f4a768adef1b593ba8e218da34856a5f9faf9819a3ecce3f21f0607ba95100c5cb18cd1a7138ec563090d0391ad5b52d
SSDEEP 6144:Gbsq8+s/u07QLr32zTMSB29i2iM8nnbrNjSdum4ocyxPbPD+DTubVmavfDszt5T0:sLWroSB2T+E+p578c0JHjcGi/fzzCqc
MD5 SHA1 SHA512 SSDEEP

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\sr.pak
Size 780KB
SHA256 5a55320d6953efb5b565893e32e01f6dae781a16460df5502c8ba012c893edfd
MD5 8f58b2463e8240ef62e651685e1f17d8
SHA1 6c9f302aed807a67f6b93bcb79577397a5ad3cf7
SHA512 6076d43a73d5fa5192cbe597e018b268cfdc7efb94a6cb45dad5b0da9c3abf68aaf2ea06f3ad650b28a993605917b6d356339d79f8dd6962d2c40dbf4653ef83
SSDEEP 12288:qCIVob4zA74dHLYbeHIdN4SGdEDWeUnLYA1785sXMx5xMd8G37gjemS/k/C:ZSe41A0x85nxQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\sv.pak
Size 454KB
SHA256 e5cccdb241938f4a6b9af5a245abe0e0218c72e08a73db3ed0452c6ddfb9c379
MD5 e4c9ced1a36ea7b71634e4df9618804f
SHA1 c966c8eb9763a9147854989ea443c6be0634db27
SHA512 d07a4d62f22a1830d3ec44f0c347e4a7d70b35ceba126cbdc246a7b3ee7eda85e2338bab3edc7223f579964868136bb10d42c05e0e0ff9f73447b3606d9b2c4e
SSDEEP 6144:kcCDD/pC1z11OBIrkn554FwxZf1Chn4RFcmi8G96iMXSOwDE/xWcqVR5sW7Y5FcJ:vecXwIrLFy+5E5FcJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\sw.pak
Size 479KB
SHA256 c18a209f8ec3641c90ea8ced5343f943f034e09c8e75466e24dcabc070d08804
MD5 59ff4e16b640ef41100243857efdd009
SHA1 f712b2d39618ffadcf68d1f2ab5a76da5be14d74
SHA512 0e721a6cbf209ac35272ad292b2e5000d4e690062ddb498dbf6e8e6ee5f6e86d034a7303a46c2b85750245381c78efafc416ead13c1fe0ee5ec6088dd66adca2
SSDEEP 12288:/wmIzbIcvt54uCERdyU7bQg8Wo97pJ8zvgu352ub95Z4sKPe/BrufA:/azl5Bn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\ta.pak
Size 1.2MB
SHA256 30658d99d753946e9c9c02094c89be25b710db77251df6cd1a8839c29de5f884
MD5 5f80c9da0c09491c70123581a41f6dad
SHA1 3fc9560a954271cf09aaa54eec34963c72c06e85
SHA512 072c5db7fe1eb9e6c270d0e9b439cf84ebb3dc374d4f01f01f9341030883f2d6d9c6970fb6ef14bf96fccb51eade9ca762f396f89ba1d3df1230dda68557fd4a
SSDEEP 6144:GeTVtPcVpmT9Yvh54P5TzotR1cA25tm1vYpiMyy:nViVITqzy5TzccA25tm1vYpiMyy
MD5 SHA1 SHA512 SSDEEP

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\te.pak
Size 1.1MB
SHA256 d6180484b51aacbf59419e3a9b475a4419fb7d195aea7c3d58339f0f072c1457
MD5 17b858cf23a206b5822f8b839d7c1ea3
SHA1 115220668f153b36254951e9aa4ef0aa2be1ffc4
SHA512 7b919a5b451ec2ba15d377e4a3a6f99d63268e9be2865d674505584eed4fa190eaae589c9592276b996b7ce2fdfae80fda20feff9ea9adbb586308dfd7f12c2a
SSDEEP 12288:/jAoZvA07McKNnCRWtgd49+agb0DQWp5B63p1Fm6OiTlC2pFg+NFqUZrOIoXAoIm:s5G35xM/1
MD5 SHA1 SHA512 SSDEEP

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\th.pak
Size 964KB
SHA256 d051b400096922089f6daa723fac18c9640ba203b2879aac4ca89b05738dd32d
MD5 4917873d8118906bdc08f31afb1ea078
SHA1 49440a3b156d7703533367f8f13f66ec166db6e9
SHA512 30e6446bad54b86be553fa293c7a92ec221adb54b99624ed69702df75347a98697158041a45f77ece4e7ed0fda41306ef21eb27981f24f0a4e42e8306175a88e
SSDEEP 12288:OgFN2HN9LyZYA1T6z1L/LLftDjsAnILwgv1V5UBGsL3fBj8BlzEdq3Ro9lGdI9uN:OgFYdK5J5j
MD5 SHA1 SHA512 SSDEEP

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\tr.pak
Size 489KB
SHA256 afcbf02420dc724059f70d1dc6ffa51f5dd75136d9e1e8671d92d5d14955edf9
MD5 55e06cd9356d0fb6f99932c2913afc92
SHA1 aa5c532ddb3f80d2f180ad62ce38351e519a5e45
SHA512 813c180cb1aa205034497be5fc8a631ff117e5ed17cdf0ac59b7569d74d849b385852a15bbadd3146f942c58bab80d94bf0980d13ca4b4424d1cb1df0cb1a2cd
SSDEEP 6144:tgGjoIj9GAb0GKPRquxFX7gFZ7yMqPO4ppXHG42ge+54n/R+Pi1c2vdTAMTw/KUX:tgGHgo0G0RqU8wZHGe54n/C
MD5 SHA1 SHA512 SSDEEP

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\uk.pak
Size 836KB
SHA256 c2a6b16abeab6e18276bc1636555e93218763b9c99cacd0b42481b35e3a11820
MD5 381cb33c2d4fd0225c5c14447e6a84e0
SHA1 686b888228f6dd95ade94fee62eb1d75f3e0fc93
SHA512 f7a2828aa4cd85f07a5d66832f247f70951abf34f81a282dc41ec51875ba70d940353d010b605c56cc59bee47309aa311099d4e6ebd17f3c1538521d0cddf4b6
SSDEEP 12288:8Jzdfzlw5Cgnbz/T0hoaiJITt5eB3IjeAjmEFIOuHLNiXEqqbo3/d:KdfhAw56EL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\ur.pak
Size 732KB
SHA256 b9f22a23368bf1e21f3085583ecb775cce8045176721ff6ae798b06bd2810dbc
MD5 861ffd74ae5b392d578b3f3004c94ce3
SHA1 8a4a05317a0f11d9d216b3e53e58475c301d7ea5
SHA512 52ede35b7ed1fb6e51b18e450b95c3245d326f2afda646e3642ee68b714dcf9a726afe32e2759e9ea87a104f4a59e6fc2c60b3275aad8332ae1c626231e6747b
SSDEEP 12288:W2U9cmoa5DD8P4WrDD6yACLUj5DDPEFYW7BYcQYriwadcJKwUxuvco/9NjjFpvxR:1a8G5bWp
MD5 SHA1 SHA512 SSDEEP

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\vi.pak
Size 579KB
SHA256 f1458c4ce4ca708e849eb0c68a5157360ef003f3a9c95628d5ca12ada303b379
MD5 4076d3c0c0e5f31cf883198c980d1727
SHA1 db51b746216ea68803c98d7c1a5a2b45944359f3
SHA512 80e4e960218f7d84423124c34352251411baf008e821a344a0b6c2e7f1483694010f28b7de21c7e2c69abb4ec92e0d9cbddeed6279b90c47245f4cbc500cdb77
SSDEEP 12288:9t12XV1+crwJ2roEw/aBuIZgsHXW0YYEDOr9g/C508jUmBnAi9wziMHQmwtm4:L12XX+crwJ2iaLZgsHG0Y3C508ImCi9v
MD5 SHA1 SHA512 SSDEEP

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\zh-CN.pak
Size 418KB
SHA256 0f8d42d7f0b0b01aafad6ae79f0bd0ca518b2db94287b09df088bc093f15f605
MD5 3210460a24f2e2a2edd15d6f43abbe5f
SHA1 608ff156286708ed94b7ae90c73568d6042e2dbd
SHA512 f97427dba4217e01a7ed395c453d03dda4f2258cba589258da0eacfde427bf442cddef541a23e7782914433e70a9623e904a5070deba9f9d50dda20732eb5e86
SSDEEP 6144:rnmNoByFw9qnvdNzuIaG/7C5ccJu7kzDg5CJTNY6BoHHulW:r2oBew9qvfz/aJ5ccJuAg50TNY6BoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\locales\zh-TW.pak
Size 414KB
SHA256 ff3a294fd1afb1fa7aaf53fbc4396643a12ed132633c5c86f14c16b88fa94a7b
MD5 f466116c7ce4962fe674383d543c87f6
SHA1 f65bf0dc1f1b15c132674fb8ff540f7d2afe1d6e
SHA512 4851a08069fcac75e4051e53d4526789bfe6c393ab963e8263803bbf6e96cb150e9ba741650efb5ee500e8a757d8512eb17dc268cec1ab6fd3acfac62f7da27d
SSDEEP 6144:svATQ4LawqVPkG49+J+k2i2iurW4hcv50Ynzq1TfAyn7zeGTs:sY/2mG4+CW4hcv50YnzeNn7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\resources.pak
Size 5.2MB
SHA256 bba36d4d18d64d9627f54c54fd645c5ba459d25a59acc5228210bd707aef67fd
MD5 e2088909e43552ad3e9cce053740185d
SHA1 24b23dd4cad49340d88b9cb34e54c3ca0eb0d27f
SHA512 dcefacddec38d8941c7d2d7b971b6f22dd0acb4116e48891d1d48a4d88968da12b152ccb7591715c88f8e14c315e235d1c4e6852cc38b9246091c50226900de6
SSDEEP 98304:+APFNXMmWPVctFCZcSENQjxh1Z/p6uNXrwrXRVunEVvXjAfz3hIkrT7s:+APFNXMddCM0Ghz/xpkrX2nEVvXGqkXA
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\snapshot_blob.bin
Size 261KB
SHA256 2bceef4822ca7cc3add4a9dcb67c51efb51c656fce96a3b840250de15379959c
MD5 6fcb8a6c21a7e76a7be2dc237b64916f
SHA1 893ef10567f7705144f407a6493a96ab341c7ccf
SHA512 3b745740bbbe339542ef03fd15dd631fb775e6bf8ca54d6d2b9cead3aa5aafc4cab49e507bc93641e581412bbeb916a53608d5f5d971ea453779e72d2294dafb
SSDEEP 3072:8LuAqiYp4bhaz8Le7ICHKhsqdzoGq/p2Vy:hiHbhaMAIyAsqxip2Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\v8_context_snapshot.bin
Size 611KB
SHA256 4fbe07f71b706c2a2948eba9a6b1979e23c83342b190723a6ec5251b2d6dad7c
MD5 1a37f6614ff8799b1c063bc83c157cc3
SHA1 8238b9295e1dde9de0d6fd20578e82703131a228
SHA512 6677f65a0e26fdc2cff6cef0231f5e5f0713ee7c5cf7f488599a3c7ac3e8365afaec10b35d6145ea58d364151d8bcb08308765693a9797ea99b894d6e8224ac7
SSDEEP 6144:jMWiyz4J+1OFZAsXbJ8qPOzhXvKwvrBTbvUyMR/GLrOp:j2+lOF4h/DvNHvUiap
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\vk_swiftshader.dll
Size 4.9MB
SHA256 2bf61db50d0226c079c7b6516f36e76b46d1ba35cbc483dd625d8c83bef70dcb
MD5 e31749b045043630542af612b5bb7f13
SHA1 e3a5e1087c228f107fd091a760094aa8fdcd01e7
SHA512 8b53042146ebf46f7804d8922d128edbe381a2a748d9c608affe07f1c3d4ad1691bacdfb39fccf2ca73d10b2f0c58c220a765e8dbb5be9b2ae1413d3cb17f923
SSDEEP 49152:t6h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzG:4h3aMXoSHfPwksHldLiuNr
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
MD5 SHA1 SHA512

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\7z-out\vulkan-1.dll
Size 931KB
SHA256 699730471255f848f4d73ccc7bba22dfb9e3bb54c44121375e9bd9ef5c7de605
MD5 5a81c349355e332f4f8796f7b8e8be18
SHA1 646f50ce5e046e63ca2905a88b0c7d09e25a6dba
SHA512 baf82b77f780a514267428183423949aa61634a674cb700541100d047ee8e9654960e5f40048aed38c236fb00dd334fe3dfa3337eb3acec50fa2457345b89394
SSDEEP 24576:NYWOq/4Kt/Ku8n387ecbFb6Z5WoDYsHY6g3P0zAk7s5:NY65/M387R56Z5WoDYsHY6g3P0zAk7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu5EBB.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/10420-709-0x000001D2E3870000-0x000001D2E3871000-memory.dmp

Download

memory/10420-711-0x000001D2E3870000-0x000001D2E3871000-memory.dmp

Download

memory/10420-705-0x000001D2E3870000-0x000001D2E3871000-memory.dmp

Download

memory/10420-710-0x000001D2E3870000-0x000001D2E3871000-memory.dmp

Download

memory/10420-699-0x000001D2E3870000-0x000001D2E3871000-memory.dmp

Download

memory/10420-708-0x000001D2E3870000-0x000001D2E3871000-memory.dmp

Download

memory/10420-707-0x000001D2E3870000-0x000001D2E3871000-memory.dmp

Download

memory/10420-706-0x000001D2E3870000-0x000001D2E3871000-memory.dmp

Download

memory/10420-701-0x000001D2E3870000-0x000001D2E3871000-memory.dmp

Download

memory/10420-700-0x000001D2E3870000-0x000001D2E3871000-memory.dmp

Download

memory/11020-575-0x000002CFBE840000-0x000002CFBE862000-memory.dmp

Download