egregor | 77c6385d064b1053db2f29e83e6ea83a2c33098b34ae6c4508bf969a97ed7008

Analysis

max time kernel
165s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
边界AI-Chat桌面版v1.3.1（windows端）.exe
Size 168.4MB
Sample240519-eeb2wshb98
SHA256 77c6385d064b1053db2f29e83e6ea83a2c33098b34ae6c4508bf969a97ed7008
MD5 9dedc5d5277b659b146bc13dc991a0fb
SHA1 9cef3e16a2df740d774dfa0626b9ecf33553aab4
SHA512 399010ef6de3f62fe5b8ffc743cdf62ed155b57dbf0cd6c2c51d75e2ef6b1cb36a254a6c6dd746abd70154cbc83c6fa95cead52c60b953315b6ed46e0622fc4a
SSDEEP 3145728:eawGQC/BhjqHLGPAr7ccRYUtAs4qAO6YWAbe94Y/LepyWycfH:R/vqrDrjH4qAO66beSH0WyWH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

egregor discovery ransomware

Malware Config

Signatures

Detected Egregor ransomware 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023481-564.dat	family_egregor

Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
ransomware egregor

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	边界AIChat桌面版.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	边界AIChat桌面版.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	边界AIChat桌面版.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	边界AIChat桌面版.exe

Executes dropped EXE 7 IoCs

pid	Process
4024	边界AIChat桌面版.exe
4500	边界AIChat桌面版.exe
828	边界AIChat桌面版.exe
3184	边界AIChat桌面版.exe
2392	边界AIChat桌面版.exe
1696	边界AIChat桌面版.exe
5112	边界AIChat桌面版.exe

Loads dropped DLL 21 IoCs

pid	Process
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
4024	边界AIChat桌面版.exe
4500	边界AIChat桌面版.exe
828	边界AIChat桌面版.exe
3184	边界AIChat桌面版.exe
4500	边界AIChat桌面版.exe
4500	边界AIChat桌面版.exe
4500	边界AIChat桌面版.exe
2392	边界AIChat桌面版.exe
1696	边界AIChat桌面版.exe
5112	边界AIChat桌面版.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\chat\chrome_200_percent.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\sr.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\vk_swiftshader.dll	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\am.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\it.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\kn.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\ms.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\sl.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\icudtl.dat	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\snapshot_blob.bin	边界AI-Chat桌面版v1.3.1（windows端）.exe
File opened for modification	C:\Program Files (x86)\chat\resources	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\swiftshader\libGLESv2.dll	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\resources\app-update.yml	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\hr.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\nl.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\sw.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\th.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\de.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\en-US.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\hu.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\lv.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\sk.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\vi.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\resources\app.asar.unpacked\node_modules\rcedit\LICENSE	边界AI-Chat桌面版v1.3.1（windows端）.exe
File opened for modification	C:\Program Files (x86)\chat\chrome_100_percent.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\hi.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\ro.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\ta.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\tr.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\zh-CN.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\bn.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\ca.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\he.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\ko.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\resources\app.asar.unpacked\node_modules\rcedit\package.json	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\LICENSE.electron.txt	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\gu.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\LICENSES.chromium.html	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\vulkan-1.dll	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\边界AIChat桌面版.exe	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\fr.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File opened for modification	C:\Program Files (x86)\chat\resources\app.asar.unpacked\node_modules	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\resources\app.asar.unpacked\node_modules\rcedit\bin\rcedit.exe	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\chrome_100_percent.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\libEGL.dll	边界AI-Chat桌面版v1.3.1（windows端）.exe
File opened for modification	C:\Program Files (x86)\chat\resources\app.asar.unpacked\node_modules\rcedit\lib	边界AI-Chat桌面版v1.3.1（windows端）.exe
File opened for modification	C:\Program Files (x86)\chat\swiftshader	边界AI-Chat桌面版v1.3.1（windows端）.exe
File opened for modification	C:\Program Files (x86)\chat\resources\app.asar.unpacked\node_modules\rcedit\bin	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\resources\app.asar.unpacked\node_modules\rcedit\lib\rcedit.js	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\vk_swiftshader_icd.json	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\es-419.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\fa.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\id.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\ja.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\lt.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\nb.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\pt-BR.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\da.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\en-GB.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File opened for modification	C:\Program Files (x86)\chat\resources\app.asar.unpacked	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\resources\app.asar.unpacked\node_modules\rcedit\bin\rcedit-x64.exe	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\pt-PT.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\locales\ru.pak	边界AI-Chat桌面版v1.3.1（windows端）.exe
File created	C:\Program Files (x86)\chat\v8_context_snapshot.bin	边界AI-Chat桌面版v1.3.1（windows端）.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	边界AIChat桌面版.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	边界AIChat桌面版.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	边界AIChat桌面版.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
3832	边界AI-Chat桌面版v1.3.1（windows端）.exe
828	边界AIChat桌面版.exe
828	边界AIChat桌面版.exe
3184	边界AIChat桌面版.exe
3184	边界AIChat桌面版.exe
2392	边界AIChat桌面版.exe
2392	边界AIChat桌面版.exe
1696	边界AIChat桌面版.exe
1696	边界AIChat桌面版.exe
5112	边界AIChat桌面版.exe
5112	边界AIChat桌面版.exe
5112	边界AIChat桌面版.exe
5112	边界AIChat桌面版.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3832	边界AI-Chat桌面版v1.3.1（windows端）.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 4500	4024	边界AIChat桌面版.exe	102
PID 4024 wrote to memory of 828	4024	边界AIChat桌面版.exe	103
PID 4024 wrote to memory of 828	4024	边界AIChat桌面版.exe	103
PID 4024 wrote to memory of 828	4024	边界AIChat桌面版.exe	103
PID 4024 wrote to memory of 3184	4024	边界AIChat桌面版.exe	104
PID 4024 wrote to memory of 3184	4024	边界AIChat桌面版.exe	104
PID 4024 wrote to memory of 3184	4024	边界AIChat桌面版.exe	104
PID 4024 wrote to memory of 2392	4024	边界AIChat桌面版.exe	106
PID 4024 wrote to memory of 2392	4024	边界AIChat桌面版.exe	106
PID 4024 wrote to memory of 2392	4024	边界AIChat桌面版.exe	106
PID 4024 wrote to memory of 1696	4024	边界AIChat桌面版.exe	107
PID 4024 wrote to memory of 1696	4024	边界AIChat桌面版.exe	107
PID 4024 wrote to memory of 1696	4024	边界AIChat桌面版.exe	107
PID 4024 wrote to memory of 5112	4024	边界AIChat桌面版.exe	118
PID 4024 wrote to memory of 5112	4024	边界AIChat桌面版.exe	118
PID 4024 wrote to memory of 5112	4024	边界AIChat桌面版.exe	118

C:\Users\Admin\AppData\Local\Temp\边界AI-Chat桌面版v1.3.1（windows端）.exe
"C:\Users\Admin\AppData\Local\Temp\边界AI-Chat桌面版v1.3.1（windows端）.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Program Files (x86)\chat\边界AIChat桌面版.exe
"C:\Program Files (x86)\chat\边界AIChat桌面版.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Program Files (x86)\chat\边界AIChat桌面版.exe
  "C:\Program Files (x86)\chat\边界AIChat桌面版.exe" --type=gpu-process --field-trial-handle=1612,10748636360396850709,1268137334641988370,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1620 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4500
- C:\Program Files (x86)\chat\边界AIChat桌面版.exe
  "C:\Program Files (x86)\chat\边界AIChat桌面版.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,10748636360396850709,1268137334641988370,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1928 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:828
- C:\Program Files (x86)\chat\边界AIChat桌面版.exe
  "C:\Program Files (x86)\chat\边界AIChat桌面版.exe" --type=renderer --field-trial-handle=1612,10748636360396850709,1268137334641988370,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Program Files (x86)\chat\resources\app.asar" --no-sandbox --no-zygote --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2372 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Program Files (x86)\chat\边界AIChat桌面版.exe
  "C:\Program Files (x86)\chat\边界AIChat桌面版.exe" --type=renderer --field-trial-handle=1612,10748636360396850709,1268137334641988370,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Program Files (x86)\chat\resources\app.asar" --node-integration --no-sandbox --no-zygote --preload="C:\Program Files (x86)\chat\resources\app.asar\build\electron\preload.js" --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2392
- C:\Program Files (x86)\chat\边界AIChat桌面版.exe
  "C:\Program Files (x86)\chat\边界AIChat桌面版.exe" --type=renderer --field-trial-handle=1612,10748636360396850709,1268137334641988370,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Program Files (x86)\chat\resources\app.asar" --no-sandbox --no-zygote --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Program Files (x86)\chat\边界AIChat桌面版.exe
  "C:\Program Files (x86)\chat\边界AIChat桌面版.exe" --type=gpu-process --field-trial-handle=1612,10748636360396850709,1268137334641988370,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2724 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome_100_percent.pak

Path C:\Program Files (x86)\chat\chrome_100_percent.pak
Size 121KB
SHA256 5ae14147992a92548bcad76867dd88cdfcdb69d951c8720920cce6fb135e3189
MD5 06baf0ad34e0231bd76651203dba8326
SHA1 a5f99ecdcc06dec9d7f9ce0a8c66e46969117391
SHA512 aff6616e56781ebb925a0ca146245ad3b2827250b32261c0c7c0d5b10b20a343a17fc3761c95d93104163e77b2eae3f1f9cbd3cb2b377f49b42bea39bdd09b91
SSDEEP 3072:IKzw9bpNhO54UCZID2DGb0+VvfGGY304F2DExm/KLQ2I:IKzw9pOHCZg0Gb0OveGe04mExhLY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hi.pak

Path C:\Program Files (x86)\chat\locales\hi.pak
Size 201KB
SHA256 acc53ca41a9a04a57c1f18fea58cc4329b8add0ded37f9f7d7a73584a910d6c9
MD5 262a8aef9a1160a55b193c4a0caf0e73
SHA1 5ce45534b4d133c7f65ee03b8c2e14f3a7afc209
SHA512 6b8b910588607bb080e66384c10e8d72803fdac3b2acbc65dff54ba32563a0768dc11af6806fabb82f7bf877333f6dd30d61a6630ef5b2ae291fcc59f3246fbf
SSDEEP 3072:UAEvTccwfKS53cdEVhkJoCO/S/KBfvTHef+aNBKfzzrRE3b8RLljlj5Vh5cVmlQe:UOxzwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 c44607a865e7a6db05552baa0ef71f9887d96acd00d123854b44996bc27c0e33
MD5 45574510c534a8195f53b30e3810239e
SHA1 10bfa95a2f25df14dfe6a55a9e73d9fa5becdb60
SHA512 b59d4c8e07748b68da51b2163a2ebafd51cdc546a1776a1105c19f6727dad697692d4fcb137578bb43dc615342a08c2e9e103384b80fc81c3c669aecc9c443c8
MD5 SHA1 SHA512

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\LICENSES.chromium.html
Size 4.5MB
SHA256 03f1d245e6a2facca9edbdaad108169e0765dd9101875bc2d123797994b9e80f
MD5 d4a79b5d46f0931b9eb7125fd40baff0
SHA1 3a38fb263dde2251b9fe157b5fddec7acb07c53e
SHA512 17cf94805f11d499ff12d8e42cb262ceecbeb265f56338e0837d291f6a7ed7f8135a025dbe99fdb2e2bb299f2267bed9365976ea51269aafd4c3220cffef9339
SSDEEP 24576:thgBBmnLiLArZ62BrcrnKHq/kUkBAwi9QxruE:rYBmLAehN6KK+xV
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\chrome_200_percent.pak
Size 181KB
SHA256 dd8146b2ee289e4d54a4a0f1fd3b2f61b979c6a2baaba96a406d96c3f4fdb33b
MD5 57c27201e7cd33471da7ec205fe9973c
SHA1 a8e7bce09c4cbdae2797611b2be8aeb5491036f9
SHA512 57258aa169bec66abf0f45a3e026bb68751fb970b74bd0cb465607fa3b2a89967e832d92d8f675f0449bb6662fcb7786d05f0597124cc8e18bb99a47245779b4
SSDEEP 3072:0DQYaEM+9bOhO54UCZISfRIGMR+F8fQnYw9pGbXGYoDd+qHqRxmeK/rIM0:0DQYaF+9bQOHCZVWGMRe8InVXYopym74
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\d3dcompiler_47.dll
Size 3.5MB
SHA256 2630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df
MD5 2f2e363c9a9baa0a9626db374cc4e8a4
SHA1 17f405e81e5fce4c5a02ca049f7bd48b31674c8f
SHA512 e668a5d1f5e6f821ebfa0913e201f0dfd8da2f96605701f8db18d14ea4fdeac73aeb9b4fe1f22eaeffcdd1c0f73a6701763727d5b09775666f82b678404e4924
SSDEEP 49152:sXMoHAsisjBFjJMLhHELxJm8ZU8W/GBj5Z535TMpinAizxkl/cD11bqCG7jHbOkD:srZOb8W/G5hnAizxz7NZy9AG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\ffmpeg.dll
Size 2.5MB
SHA256 81cab2e7ff56c8a06421419a2dac9481b87d5e50ef6f89a40e9de2d28d4998f2
MD5 54f1cb94776e46864f987eaf0593fbb6
SHA1 f3a9957e79ef290b31e600726b0eef771858b1bd
SHA512 f5aacf89877ac29f4da3263cc7b37b5f25a3425762f96bad90a8389dc596ccef470292f548a1dfce891abd47f4df10d6f2a95fa2f1a4d3a59c2da2ed972c91cc
SSDEEP 49152:DHX9HL2Iv1LDjOzm8H92kpGaWJlAtksQcUfn:TX9HLjdL/OzboAHWb6kDfn
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 df876c7af43ed93eec6aea4d2d55c805009c219653cdeb368f1d048f4922b108
MD5 ad2988770b8cb3281a28783ad833a201
SHA1 94b7586ee187d9b58405485f4c551b55615f11b5
SHA512 f27e542a9c6c60fa28c5b7cc2818079341ef93aef3bbcadecad2dc11aff5b1592b19c7ebfa543ea42a3cbfec26a668641b255545fb0912056e25e852c2dedd01
SSDEEP 196608:Sf+wSv9AAQbNjliXUxR0rHf93WhlA6t6YF:S9KlQbBliXUxR0rHf93WhlA6t6k
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\libEGL.dll
Size 358KB
SHA256 9322a0e0d0c8a8be035d29e581de402284ffba4d980806596dedbec7be8a08ca
MD5 c83a0d55e9d4ba00a41c79a677c444f6
SHA1 798b64c0326459c99278eae214cfc6159f1ab16b
SHA512 121d20db79975098fdec00d4299aac57c61b3ce4bbcfa45aac79243a46052851e91b466c5f4697db039f59b02e1be7ac2f90cf6dcdc4365d8038a1387ebdeba9
SSDEEP 6144:ZesPGoRqGG68Zl1cCmYku/1haDuE4mbd2W8GgtSUIKrcO6+fBgCJNz/WuLF0hWA1:csPGoVfgEimbMTGgtD6+fBHKuLF0hh
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\libGLESv2.dll
Size 6.3MB
SHA256 8b9571808714bcd01c3156c7cd254fad104797cbe1ff6c823677b713dcc352b2
MD5 ecabe9e35db94666c73b78408aaacc33
SHA1 29368f59ad5854d775f81f10987c5813248db413
SHA512 1a39cd4fb3fdca40117f62031804e48da2f7ec63fe1e6377902b5a8d5c76b3d40b155d028481801ec4338332a486c7999ee685115d5fb4546c2ddd47b0693971
SSDEEP 98304:qY2sSNCHdB7mvvXarXEOE/HxyPX2+et5/1+wu2Ed0:NON2+ar05/Rzrv18
MD5 SHA1 SHA512 SSDEEP

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\am.pak
Size 142KB
SHA256 e9c78c2410d5c81e0cd5d122462e852143eea15ca69cd01b85322cede1e10806
MD5 e1b02b36ce38a843a12867d2700a1bee
SHA1 4e165fd9290921b9acbec8ff24e6987f36a2f3c3
SHA512 46ce9cc38ab338187fbf0c07a8a9fc1a96bb1d9181fb3b26741ecdc5e1b9fd2ac91b3b9e33d149bf07e6ef5879f72a589954e9314b47fd7b833677384d8b1933
SSDEEP 3072:JgSH69/92t7Rh4rgEkDvuJqXVoZSakiIJlG/yZJjhSEVILWGe/oqM0bq+o80kefy:JgsHU+1QAcx30jH8+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\ar.pak
Size 144KB
SHA256 1cdef40ba8343e7f826c2020906915efaac5e56f543cd2ed6ebf704882525d8c
MD5 985efad36a2c07c95fc304319d6cd1f1
SHA1 6bd0adbb16ca511850df5132d78322bd7c525a6c
SHA512 7176d5254dad1ef91a428087099b1729285c5a58bd2f0b20e51b340d298973be2e36ee32128f71948bff3b013f42fcba01f37eff8f80bb2926695bfb65a02316
SSDEEP 3072:IpdReHjSNsZaJBoGxGDMgxHSM2uZtE9yD7Z1K/GaQKSI1oCpI1Iik21a3:IpdRPNs/rx5CpI1Zs
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\bg.pak
Size 154KB
SHA256 1bb8c5ce9215d42ba9ceec52f86fbff46df668ce48ff56bd1cbe96adadf4922c
MD5 26a0431ff9f22716c55f68f7e164c595
SHA1 9e9924ad447907031bc9d1cb753e0d0f66125b19
SHA512 486ab8c00646afc60193f97583324778c9010e0cc3b4c2f74554c25515c1edba92d83c44bfc6b364b388621c1631f2f51de19a325382ca5e668dac3a75bc85a7
SSDEEP 3072:VrSe5oPSFq87yy847TyNrqjnf2Ibu3RZzrzCLy8As17ap5NgT726pzsUVV4v:Vz5oPaTe47qBZzrmLy8A2+NW726pzsU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\bn.pak
Size 203KB
SHA256 f7d704207cb3340f1ace2f2e5af031e816bb86e4bf3f665907d837d094bba37a
MD5 5d7894bc1947927acac8491e1036d44e
SHA1 273b9438740d379d1a20a7c5ed4275940405a44b
SHA512 6179ce46ba48fdd110a8c7d2ae17b43b064b45d147b18e9f20223c845382dc01e0e4f3fbe549ce3a23b6f46e59050f9337465d73e748003a1e650bbfdfd21b8a
SSDEEP 1536:Tewm+hAm8ieVBEpWp2I3r18JMg+bAkcmv+hqycC9:KwmgyFVB+uHOP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\ca.pak
Size 99KB
SHA256 14e99f4d94868a454f40ee8e0f62d056e0abb303caf6e184a9a61bdec18ac271
MD5 d92f01e66dbefbe28d9ddc0a0b318258
SHA1 8c2b07df543e7b523ee6a682450eb96ace988c46
SHA512 0a27d8533128cf03568e8b1e8223188415429a8be8919cf3f81bc041ee93fb530d465d1a8313876c3db9c83b9dc04cb4ea0d9bab0dcbb3373813aedb5803725c
SSDEEP 3072:fCf/RFDWcgrI543ZL8lL+O5alaDEScUI48XV790bzRh4g2pvnAkpxlCFVdRP3IC+:fMZdWcg9O5aSEScUI48XVJ0nz2xnAkpL
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\cs.pak
Size 101KB
SHA256 9651b8f3304c70d96dcca76cfffad90ce8afcab6231ffd8e4e9beade3d510841
MD5 b7ed7dd838c0c0980d7c011a3cef03b5
SHA1 d752b7e7098e5cb2c894ac35591db2852946d497
SHA512 23a6de6b8093c8f87e84ab7cbad1910a96f228900967b16cec9852fe88f756be7d5fd45b45b4f0b4caa4db05aa315f21c73b2c1c6c32e11d55ae6b810dfed49a
SSDEEP 1536:srGb98e75SSPCK4MCg33zxf/lNC/bheRcd78Qxkdb2E:s6b98Q6an/lA/dt78Qxkdbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\da.pak
Size 92KB
SHA256 1d1a3e38ddf282969bca2a5d893b3db4a0aed10b53eab37bb2dad7d2d18c94de
MD5 55a82964b36308b838d627e7ce708078
SHA1 c685eeae43f85346fc984d02c9fe4120f8b5467f
SHA512 57f7a23db6ffeb0be0b90005fa8c4ca22294b27da7a14e6afd70ac417b05122bd3ebacc41a168e28586a157521ca0e3093cb18d4bd7df71cdbc0f95b2925ece8
SSDEEP 1536:HJtNBG4yZ2LxcYQCsByQKSfni+ijGqXG4w8pOmPExhAjP:HJn+Z2LiqQRfi+i1X0dAz
MD5 SHA1 SHA512 SSDEEP

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\de.pak
Size 98KB
SHA256 e71f4320553f65cfd0356a4b30f3aec2eec7b4fd327866d528917b9909cfa761
MD5 9b1f23b3e07d947c0227f640560bc0a6
SHA1 17908d26037c885655a40e470fdf004a3367ebed
SHA512 72de618027466a819692425fa028d65d432e825f6eb9a3bc100dac808c4e8acaec7c515a7d7674f04f0343edff731ea07381a5159b817b86d07359e324bd829b
SSDEEP 1536:y2Rrq8E/XgkNahE4mYWfrkY629mGvXgkHxQ1NlkGfUhKxYQV4v8cOprlEb4:y2sN6hE4Xym2xH8NrS2YHPyrlq4
MD5 SHA1 SHA512 SSDEEP

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\el.pak
Size 172KB
SHA256 a3431d3ac720f871c33d7e522cf506b2fa8ea1872bac02a4b4b427a6d063af38
MD5 5949036e7e364f5c97fec60c80a4740c
SHA1 6380125302942906a7ffac45c724c9a1c392a50b
SHA512 017fd71ba9ca2718e138fd1baf8893bf0e6ae86d947774671a72ffba6bcf330d039e313a949ca3c869186155c7243059885931a7de0804ed9ce4faf0989de94a
SSDEEP 3072:sUW3IqANGXGBCiJFTYHDuLX9GhF3IwiRm5fpFQ5Squ/EFMeELO+7IKh52h7QPbYt:sUW3IDBCiJFMHDuLYF3I/Rm5fpFUzFMg
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\en-GB.pak
Size 82KB
SHA256 c4fdfa9c6f30ad657bf12ccb95f70542a0fade45d8490259a4507629f4b33299
MD5 32f8d0492b73ce67df70c2f6b65a9db6
SHA1 eb7cb21681e65869a931f50d83b19d06f60d28b5
SHA512 04d80661d37c5c99657f9ac268674c058fec4a25fd9aa30c0a2113558e51aab4cb2f01baea3d8625d744df29575944a19f8575579f872c0716876819e933d693
SSDEEP 1536:KJhTO/Rb8bYdQaWTHjdDqz4Rr5mU85iBxgxSOiJedMJr14h6guNfm3ggl+q0vMy:KJBmGCWHj/7BxgEo6K3ggl+q2
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\en-US.pak
Size 83KB
SHA256 d1d3f892be16329c79f9a8ee8c5fa1c9fb46d17edfeb56a3d9407f9d7587a0de
MD5 bd8f7b719110342b7cefb16ddd05ec55
SHA1 82a79aeaa1dd4b1464b67053ba1766a4498c13e7
SHA512 7cd1493e59e87c70927e66769eb200f79a57e1eb1223af4eb4064088571893d3e32cbc4b5ece568fd308992aad65684aa280dc9834f2b5d327bdee514b046e5e
SSDEEP 1536:7+Ckxbj6E0fYSKD0hQ2trhjUJ5dBxgrSO0JedMVrBfhQuNfD3ggl+C+fZMwG:KC6jEYSP+Bxge3Q43ggl+CxwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\es-419.pak
Size 97KB
SHA256 64df687bbb37bcd92e609f7e3bf950ee5629b693ff8636607285f5753b1bdaae
MD5 a6de020b1ec17664d99aa372dfc3aeef
SHA1 b7c2e6af4854252df86ea49c625f15ee094c891b
SHA512 6af0488ea1632e6aad16b149166319dd9039f00da56c740c196dbcfc5265a0c225581450efe616e0d9a82e6d6a5bb50f2e0ee90f095628dfc5acb9f2d160193b
SSDEEP 1536:N3WHMcmkjRbIZrMMZLXGKedePcHYTKKx0KWFsMH5BYh9VXj4VHiS:N3fcl8ARh+qCS
MD5 SHA1 SHA512 SSDEEP

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\es.pak
Size 99KB
SHA256 eb22282dbf211f64142ef4dfac2c1d811d65decd617c4a3d1c892967dc72ac07
MD5 06a2c6940def84d9327083aee446f446
SHA1 a542fd511568ae5f90e86259d427b7792ec52d03
SHA512 23d0547ca962419bd6013f094de67a6f20779440674fef3bd38ae613c72daef6072a217d7832e1c62dd68bdfdb1eeba241ac302f72cb710015d8924f8e6797c1
SSDEEP 1536:4WEvWNjkrLWpitv9dYjMFxdYM3vRgT5gFW9XXh0KuQhdKPrrL1P35y:FyWGrCCIuAHrUPF34
MD5 SHA1 SHA512 SSDEEP

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\et.pak
Size 88KB
SHA256 b3baf825f9b237565260ba2935fe9acf2ae381e3bfc6fbf837dbfe6fb83314b5
MD5 ac38b14b7663b5e4e98baa6bc47143a1
SHA1 d41c2be94d6b5aaeb23c17b9a6c453a5ac9dceba
SHA512 930a9ef5b3cfabec18b18b52d6b3da8f91e6c4d4b03e311ff34eb8f5af85c6b91077c7cc1bda609f114935d6b287a503f5e1ee792548cef0a5686bf4a3c433d4
SSDEEP 1536:ytYvkLi/3D2xLdhUVhdg9wDuLECdhj5psMH51:mYwi/SxhqqwCLXjgMHH
MD5 SHA1 SHA512 SSDEEP

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\fa.pak
Size 138KB
SHA256 8ea08e9874892edefcbdc55c393dc00fe451f3c7f29b57d7105377349eb4bfc4
MD5 a6c8f787f9f3ef00bc38673f806e69f3
SHA1 6be8d4a7afc97748b1bf619d10086a6d27c1a519
SHA512 64668ae3d459c95f22e580c2f637c8b739ecd7c177243d505544b4b55f0c70710cd99ac71215412d04845e170d47e7ef69e9cde1e698c8898692a950619388db
SSDEEP 3072:OhXSXB4RtQa8z96NS9/W2ESEmGzR2XQmN4O63RwcQpfujEdrh+TwatK/E3oLAi4p:DXB4RtQa8z96NS9/W2ESEmGV2XQmN4OE
MD5 SHA1 SHA512 SSDEEP

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\fi.pak
Size 91KB
SHA256 bfc24d41ea8e362bb1a18c11860d2217fc100b1a422cf54629c7d0c6640d5ed7
MD5 8cb6cf7f173c2deac78fa136c8eb94c6
SHA1 c873e1cd9a2db4997683574f1a6fa2f6c53143e4
SHA512 e8600b3fdca4c0c0f27d3959087616235c537b8ba6cbc85177cf96f2a9b50add40989d56c9ed92c5793fd3b55515ff611a6e273d622a1c25a301d35cb52d2d4d
SSDEEP 1536:tBOwc312QywYFTTqIZq3Ik7PTKk18ZlHoR8lrc6hjjATcM1nhii+mdX:tBFK12QHYFTTTq4UPTKk18ZlIRErc6hi
MD5 SHA1 SHA512 SSDEEP

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\fil.pak
Size 101KB
SHA256 75d473ffd351a828bd7854067ad986908efefdfb75800650587b8bef09f9ff2a
MD5 91e33c418c453abcbb8ea4fc89d4b673
SHA1 11a4293e6a1e1a9dba94b80ab812f305bf70abd9
SHA512 b77b1533fb26832f9de21dc361ad58088d7aedf26bfb1111872cbb1b0da8b8f9061b8ea9c561fd645b8d683110998c71acbfedc02d9399e4f4aedb8c717cf97c
SSDEEP 1536:vwCpxKjpleB3IWdYhJvpsFzmNvuNpEWnGk7lMAM64CzPEphYkZz1F3aZ6tMD:ICWdMNdypuMAaCzK7xy6tW
MD5 SHA1 SHA512 SSDEEP

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\fr.pak
Size 107KB
SHA256 b387afb8c8ae3c3ce90728fb7eb39a39ec789c6e7bfe4dbd2b5d49e72434db1f
MD5 5d2e3041fb2154b01cfc628935aeb183
SHA1 620a2aaba08d430251e408cf99186ae0439f8a60
SHA512 8709fbc3e63e94f61918872128134bd3636ce69765437272c99f1529801b97283d4baa4b3e61f2dea73cfdecae0321ba30c903d6055068d62d024843d6213974
SSDEEP 3072:F8oHs3sxbJqchuQkykClc3wwTyaNsIGKByroFDuFcmq0lcaO2NGcJh:FLysxdqcDkykClKyvIGKgrwDuFjjGCh
MD5 SHA1 SHA512 SSDEEP

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\gu.pak
Size 194KB
SHA256 a49597e67fcf93448c89e07f9cc3519b3b1b77505bc30adf3f25c250718eec0c
MD5 7e5416a501994ffbebab3edc57756b3b
SHA1 c350fd10c8d7584f6d92612d9afce4c62e0e54ea
SHA512 611276c8d8a42c4258c9ae33f3e95b9b44932aa04c27d985dc70893cad75135b9d4ee74c1bb7c96449053debf5e0cc2e261ae1909b0b13126193b955069382bf
SSDEEP 3072:4aPa1A626c8Z3i81cKHdO3Iu62oY/m3BeQOR0I2v2wCbflLMWsCBDn3kSH87pHhV:9IF9P
MD5 SHA1 SHA512 SSDEEP

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\he.pak
Size 122KB
SHA256 7420e94f19bd61f33950e120f29c9783305f218d089f0a7d3ea3451655cdda1f
MD5 b73d141efba773482bcc09853c4598cb
SHA1 b1768edbe4c2efdb39a3d5629999bb9f9280e595
SHA512 f61e2d92dd77a24301d9c658560fcc9ceeb59a7ddf3eebf1872aaef2de5f8607b95bfef61ad386d5705c796b032f0471a85d43dd2a5e6d9da3725e466382b3d8
SSDEEP 3072:TTEfIz1jQWX2XklH/piG5fnS3XTnZJF5sID:TTN1j72XklH/piG5fnyXTnZJF5sID
MD5 SHA1 SHA512 SSDEEP

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\hr.pak
Size 96KB
SHA256 e55d011ac0cc50d33bf22d43a9c5a6b59f5c31bd2884789efee124929be9a7fa
MD5 0b263bb9ce59ac162811f06f441f5944
SHA1 073d6a9de44affc840c68a0e8c5562c922ba1582
SHA512 64d69dcf063e4328ea3874ea0d3c29d2387117cd3927096dd6ce12624f802ccac4cdb8157757d70be8656c5a9757538f84d946eff48878c4763cd2bfae274d87
SSDEEP 3072:cnRvKdAGCxleZvlpEsypakZUaO6TMMoHIz7cyoKbx9i:0RDILKe
MD5 SHA1 SHA512 SSDEEP

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\hu.pak
Size 103KB
SHA256 030cbf833a350946959afa0d2b699512c0b715ff7b38b613bcd16b15282b940a
MD5 0b3b9d23034926aab2e6a2f9795ea640
SHA1 01ead327ee1a66e0c741e411c4ba0185951c36c5
SHA512 15ba2136cfb870dac7bd39f287b35a756817d05003d545063b4e8f8e99698f528ccc652be83c45f6dd8b125f9f5eb7ff8bff8e95d4569542954d47b38774f3d3
SSDEEP 3072:pOp57RM5bJi/cUiG+12XPOdA4RdpE4L15o3ICJ:w0b5UiGJPGRdpEc+3ICJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\id.pak
Size 89KB
SHA256 d12d87d003bda037b411daab09d1698671f8284e4297ffc08b0558749df6495b
MD5 978465f6021894f8f1eb0db3719cc720
SHA1 da37cc7d02a2ec1ef136127314a994316f1b9c62
SHA512 6383ea1e0c731ca93a9a121e4ea919b4be9aa48ba3e288ab511dc8ab873a3099f683c9c665c3dded79ee74bfd9729623d9a8fe323d2085f4d81dcbe6cf104dfc
SSDEEP 1536:QWW93JRusj395/SWlEmiUwRIsE/lkJWB4X1CPXsAzb2ZbhcrR12scCAybJ:q93JRxj395KW/lkJZ8XsAzaZdcCscCAY
MD5 SHA1 SHA512 SSDEEP

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\it.pak
Size 96KB
SHA256 266f501703d3899000d5eb60d55ccc8f59f186e862a4a9a34910e81699ea289e
MD5 f89173cbd42ec09af2fb0a86aa5395b2
SHA1 3dc7ac0c537e2ae37c579ac7352330bd3bccab3f
SHA512 41cf233eacb47680f3d8a17b9cad17ce872c6a9c443929de776a315c0436568e8150ca75e7bcd46ff1a4814517a8c78d7694dffab00509977ac7f45676d54dcc
SSDEEP 3072:7Q4Dl5TY72Vxy1GyN4tA7kxA78dQYhYa0lR:95TY72VwEyN4tA7kxA78LYaOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\ja.pak
Size 116KB
SHA256 4d0910d196b6b5652e3e5d677ddb048b8dae1ec974593484df2838093c96fed7
MD5 25eebd1c10519b8c1c01d05c5a9c75af
SHA1 aa06f180ea9a48c7e032e52614bcf405c4dbdce9
SHA512 d278e262df63b2f816013449870f096796ec70eb0acfdc5d0700be07dd70fa87fd8c1f08fe112a919904d77bafcab0519ac13da82de1c10a03745c59a2c0bcf7
SSDEEP 1536:h1/4pety5vN4cYy146Krsg+7h8+JiwBxwNHVK:DCety5v6cYUYi98+JiKxwNHVK
MD5 SHA1 SHA512 SSDEEP

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\kn.pak
Size 223KB
SHA256 f25c8b41249c8f54224702795644c80bb5a7eaaeb6f0af5b6a1048960a27c827
MD5 f83907e5b38876e6c50480f727fc2497
SHA1 517f0d01d47c6838e008dec87f089ebfa1b036b0
SHA512 e4c1c23cd72197616e3e7a9fea5924b4ddb01d717810bd69937de49526fab9f3f368df896771eca697de77cdafa2207992cbc77a448082d65ae25894484131a9
SSDEEP 3072:Q7wEIErxPrfbgg5Gizhm7Sn/u5VDu6xkBE7JQO5Ct/jA3Nb+xnSI:CrIEB7bgum7Sn+VDu6xki7JQOoeb+xt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\ko.pak
Size 98KB
SHA256 99addd110ae7ba9fb37daf5c32ad2815172840764da0c71d0304dc9562951d61
MD5 7f61b6f66e6d22083bf0b2ca8b64309d
SHA1 748a0198780c238346781a0c1df3d84963591877
SHA512 3945e3821cd2f4a420770182ac29cc2e2db72335d934ade001c196357dcbecd33428689a7588f62e7b845f63765fa102ddb6aca07ac7e7b7104a9633015126da
SSDEEP 1536:fYfYTyuWkR7gaq9yiGAWc5kGZDbEhABAwfjy/4KIs4WgoGhO3utSwzGvFxES:fEoyfo7gPcPvWBBAL/4KiWgfqutSwaP
MD5 SHA1 SHA512 SSDEEP

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\lt.pak
Size 105KB
SHA256 9124dc353864cf6570580ae3afa0a7f09f5e3d32a61e71a64ff4cf824ad4fb29
MD5 99e0e932b751c50565af36025523fbb8
SHA1 1e5d3b2f722efe60d4d4f2d81cc5183309313547
SHA512 a94b4565acd04ddd9265de072fb2e1887c21dfa251afbf76b30824cf9de84791ed3658c6f71be17366cbc0b7f73921e045ecc125c42bad3004d189c7943c7f3f
SSDEEP 1536:oCkaWyxmV5N8FYGKcOnRZ0c5PRUqHK5rmz3MWkhnRmvmxY6SN5naWSgAGiIq:otlamvcKBnj5UibXCEOxY6SN5n0
MD5 SHA1 SHA512 SSDEEP

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\lv.pak
Size 104KB
SHA256 6861e9a4e8a9f2493f0103afa0f860c280478a64293a6de883ba9cb6a45776f6
MD5 05a27f135f550fcce9c1359730aa334f
SHA1 1e23b09f0f7aec17a64c9f09de1955ee6bc5112c
SHA512 980c32e547fae231db2758978811d49a9a631ec95a3e47f257e1387f276d94005925ec432551368eaf3dcd310cd6219902dd360aff8a67033797ed3e7fb519c1
SSDEEP 1536:hrSZdxj87IXVGchYGB6rBve+z0AhzOgUcDV0TNx4WSuAhaIyhZmE42alaqM0wV8m:hrSZ/jYqVDYGUvFUcDV+NJzYwV8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\ml.pak
Size 235KB
SHA256 cc9fd4f2d44df646c6117465f820ad390efbc9cb64eb4ff898a50cdfef8f324c
MD5 7fdcd82db37be12740f93b8511055703
SHA1 606547e1cf56a68df1299bb962fef86cc6e99e20
SHA512 f92b42994639f48e5bf949efd6b483b1502c6204d15cd32ad6fd53f0f76886d10caa802fba7317421225a214c479fbb1509a03b7f4092b0b2c47f68ab7615848
SSDEEP 768:ev3Z4LFK9/THUKN87L+YBkP4mbdBQG6PQumzFULoMh83rRKExW:ev3uITUKNgL+YBkP4mbdyZPTmUh83fW
MD5 SHA1 SHA512 SSDEEP

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\mr.pak
Size 191KB
SHA256 5f1ffe801f3701434a73d3ad3d04e9fcb6238f0f3b14e9325413910799954543
MD5 be54eb7b1f16378e07d88072912e0119
SHA1 d54ccc3aabcdf06968f6cbbd61bee3b316d062f9
SHA512 07fbe367d6caa27e24b66551f1d6fedc17702a39121c48e33d2bb6547214aa7480ac8ec8500f1f3da7c064d1174270056d6f49757e9f4d67fc44ea5b9eae993e
SSDEEP 3072:l2xcsyKRqbKMB6DYdWi02Xe0c7elhSZhSNBFvWSLQEDw5dbBHtVTYrDO6mS5:SyWFQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\ms.pak
Size 91KB
SHA256 f4f6362d9963b7d244e29e85c7ecda552ff7756621f6efc9f3b6f12940896a81
MD5 08d7bd42520462f677a3b8204feb1777
SHA1 0dfcab20465137c4ee25f285f82a499b9aa3205c
SHA512 f48373053bc7bb197308fcc3133dda664a7d1babe5e188c7498be3396ee94e43d27fd2ef233318271cf11e1ffb75dae3d0ee83f78b590690fdb84e1d0cc832ec
SSDEEP 1536:N6Oj05AvU6ryhv09/exKuYOYSjyho5yT6Uu+8usu:N6f5AvGO9/exKOIoe6U58usu
MD5 SHA1 SHA512 SSDEEP

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\nb.pak
Size 90KB
SHA256 efc934122d4232276f9f2317e5906517bd91ec2a6d76995fe8aae04eff866a50
MD5 fcbf5dc281a9ab77d7bb03751b9563e4
SHA1 e4c4e499431a3e693bc262a25ac444cbb9ef1ba9
SHA512 502eb74466ed1efeb61688e7b5f6904014e72be9f701f18ed49dec1547fcb6303fe816e4340b97b410cc1f76bc715cd836c3adbc84cda1c8ebeecc64a0f477be
SSDEEP 1536:wxNBvmrltnXCWNOw/FqFlCIm8VUvCAfh4HGwq:wxNotnSrw9qFlCIwCUh
MD5 SHA1 SHA512 SSDEEP

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\nl.pak
Size 93KB
SHA256 4669c10a7fcc8a150a641e73320547ed1b966a92fe78041a860ce4892f79b0cd
MD5 e3fc5005e01568eb856d1edcccc200e0
SHA1 b105b8d844cb2ef868d56057cde0e491b9b077db
SHA512 288cc9c97e781d2ae4a95e2fef230f3c04b8419b87840c4ede04b3d8a7798e78bbd69be37b374b179e9f10b50c8c997834cf9d8a79266c16b3dafac83ad8e9e1
SSDEEP 1536:0vVnwGlYE53Bj2Ak549WpE6KqpHRIINe8hyGaPTnrDR0QFgzQQzo0y0OvF:+VJlYE53Bj2AkSMkgHRIINeqXaPTnrl5
MD5 SHA1 SHA512 SSDEEP

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\pl.pak
Size 101KB
SHA256 ce84676f37bf97078b3d087d913a874d3c092f76b729f43d3e9553d3c9754f03
MD5 7a4ef59181d02e62cc295b676d479d7f
SHA1 84fe4e425f1684f5d3efefb7e571ae8853ef68bd
SHA512 53c8c9526f3a655af2251fd599f130606eae88692a726ba25e2b09c129ad89f00f833e6e4e1b6d82200cc110b8988b61c0a2d678c712d7c0f1b2e67b1aae1e01
SSDEEP 1536:vXmR7nK4WRMa8odxIQJ6VzgkwOo4oNsNYRh1iT3Ihh7Z:v2KLIQsgkM4rYr1iT3+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\pt-BR.pak
Size 96KB
SHA256 7cca8f6ee8b2a19c8ea53b3a2bb2af4ebbb2b8612caba87f581938e7d6aa9f18
MD5 5beaa2cb0bea5d59f461c8c076236201
SHA1 65228896fe64734a7b56a735e5b5fed8e4b85d57
SHA512 39ad2f8d072469843b939e69dc7e4dc408b366a07168234d2c45a32d6100e904646e66a966e457aacb65a2b07ec5f51dbba71fcfa3c9e4afe1684f42db01bb6a
SSDEEP 1536:73GzA0oeF/qe7LtDjInCubw0Y0X4dh1c6x0xGU/ceDrMWw4le:MjJ/v3R6lbMPCtMWB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\pt-PT.pak
Size 97KB
SHA256 7f0b86e4f6391e48fd045c8b967a1ad33d9c54f5a6ceda98d800c254dd2ec059
MD5 2ae2e6ebb6ecdc5dab094ca28167a27e
SHA1 499c9a7169ddf760d9395b5801aa90632ea6323e
SHA512 9b3f6df3d9d2dfbb5f7319c41ccaeb66ec4d30b0c0c505ecf6031abb5e36f95e0435d91d0913def09d13abf38488a9285e170d502e3e3ab2cb44effbffee3f04
SSDEEP 1536:eBrfP4FUoMp0mh5qsrLOgkzHGtdnhMxz2qKHloHtOTZ1ekP1C:EIAp0/sryTGBAtOTzek9C
MD5 SHA1 SHA512 SSDEEP

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\ro.pak
Size 99KB
SHA256 60859215a025b95a1ac06333a66d14e1698b28ae31451c999e8adc072401a86a
MD5 84d177ee0f1409e8d69b9a559fb176d0
SHA1 f22ae3c93347b0947e7d440a311f3856dc1f913a
SHA512 85fec9c41cae2191650654addeb6639c8ce09198a023e8548cbefc7778d1a0ec27214b7c755c10ff403b6435260537b9644dabb0c37d01b297323152ade5bddd
SSDEEP 1536:rHlTbd20Op16a3v0OokyVwxgr32ILpsPlJtWlhFQh6EuxWDS3299A:JIpsIgr32bPUFQh6EuxWG3Au
MD5 SHA1 SHA512 SSDEEP

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\ru.pak
Size 157KB
SHA256 5c93984215f69bc6c7a1430fedbdc619ee6ccc9e491354e3541fdc8ed1947f8b
MD5 bfc17d03eec2df2985249a96e4476a11
SHA1 5399b5054515bdb48942ac7d662d936eaf65e253
SHA512 faa2f3f0176cb8b1484e4e8fad6a019a4198f549991f4aba52453c077156e5cc00009a9c1c08cff999deaa87d2c8bc31c385b22bd10e8818e68d3fe61f07db60
SSDEEP 3072:41Jb7usri4lV+TqJXEz8dOIQgIvZBYRoKe934nfqa7cLu6t4V7Lle9X+VT+64sHO:4+ydLjZq8dOIQgIvYRo9InlGvt4BoFie
MD5 SHA1 SHA512 SSDEEP

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\sk.pak
Size 103KB
SHA256 4a09c8f22d1fe71cdfd0149599c59ec3059cd35f7dc8f33f22f967a237f7def1
MD5 800dc45f273a82862fc0b0aae4f3e908
SHA1 8cd818ee32f9ec697226659b3b86df2ba35d019f
SHA512 6fb7674ddb299efe896f3c0f2255295d0489d86f1bc492fb95d7e9eabd63847d2cf162f008e7e715a6fd3a409a1a3d6675e095ef910f52dcd28e302627f09ea1
SSDEEP 1536:Unnhrt+/FXHsfpYaQ3QxSeLh1kM+zBHCY4LgQG4Hz2wAQPc:UnmsmaQ39W1kM+zBHCY4zG4T2wZPc
MD5 SHA1 SHA512 SSDEEP

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\sl.pak
Size 98KB
SHA256 1ed9fc4abb8bef48e0fd5e10a107fb456dcb0c7a275bb789cb0728cfadfdcc42
MD5 fd9efa0cde455dafa0905dc1b06cd02e
SHA1 9371bea539436ac65dc13ea475d6ca852f236caf
SHA512 888b83e1d111ade5b2260ef2b7458928594d8bb0dba9722d4a1e343f58ee0a668a6731a99f84601149ed4e56db39073f562255850a9cdfa406c7b8236c5943ef
SSDEEP 1536:9JUhIrhHYogW4x3yPhXO95nJdFCORbhNLi/fzUeyx4bqt:9J3rhHn6xN57FCOf9i/fzoxEqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\sr.pak
Size 148KB
SHA256 362a50ec28da0af4c6b8e282ad64d45298b939a03883de22c5a33adfa919bc74
MD5 e64fbe3d0a19f6c48bd7f81a093900db
SHA1 a63d6e8c469dac2bb68f1ccdb43bbb78a769f210
SHA512 390690233c9b89eb9fc962e95066fee0e8b2356bd9816025f7f3218e442324edeec5d1e4990c073e965c66dc6126136d975aa3deeeb65b090ae6bb0b89415617
SSDEEP 3072:YECxKpkjOF/3hYoS/3yS+f15XLADE376BQn0yh9K6q+NOt3r1GLK6tWaq/k/ZP:YEc+/KoUkXMw376+n59VjA/k/ZP
MD5 SHA1 SHA512 SSDEEP

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\sv.pak
Size 89KB
SHA256 cfe9ad173d516a3e1855f00f53fcb20a53ade93fef6256e909b0f0da12723cc2
MD5 f03c7cdb6921e881c788ecb10b8ba710
SHA1 e40e1b540be2eff535e62e44931ac5bafb21e524
SHA512 7de1c83fbe86d552044e8663969b5c49aabdb762ef73788e6082aaa2117bf1f2788df6b8a28d65cb3be51a9c6bf7afadcecce716bfe7fc6dcdd646730897cdfb
SSDEEP 1536:+WqQN/eNi3A1jXUyBmEy9HdSfvlAIeQWLdP/ldOZnCMqeLKBqTPDgbyoplEFwWcB:+WHN/eNi3AFrBm80bP+HmH
MD5 SHA1 SHA512 SSDEEP

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\sw.pak
Size 91KB
SHA256 26fbb15e26f5a4c44bc0e86326fbff28686c771edd11bda6bfea178364299eaa
MD5 59e99f7b257d5f0d0575038c8332138c
SHA1 0deff978d72e4b6eb2ad0534be5cb573b3a662c1
SHA512 fd0f603d73a96fe1b40030067e6eaeeb4c6ef18bab57288a4a049ed2c687c85836d10c1b652d7d1ff2030903dd5e3fd4c222b987b87464b5aaa916a9f12d0f22
SSDEEP 1536:OQmyODcnjKKe5DzDi6j3GC1EG5gPXjaNnutVaQG0hILelOs+r2HwEG:OVyiMKKe5DzDi6j2YYtVPGyILen+r2HY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\ta.pak
Size 230KB
SHA256 2363b6a8cce7868830915303dc2825351e7ea9dfd98568e448cd8b71c7ceef90
MD5 1518a611019dbb88dbf9af005d31cc2e
SHA1 6ac31736c93779f279bf893f869f6e0a251d9766
SHA512 341fd001613772a495909420bfae00439bd0320a27d7ed10b7e76f64634ee7f9a36751b24388853723f41850d125060f7c0ca6aaf6ff0f768c5fadb7f5f42b9f
SSDEEP 1536:YbOUydPnNq7Es7nyowiy+HTE2k4ca6QVW0OmJfM1o9T5tRwL+EG5aIAuwKVn2nHS:UyVobMytRBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\te.pak
Size 213KB
SHA256 c9f427a4efa5d9835432e3a190e26d684c18c26e13fcda1b7e73d6a7527cfd4f
MD5 15d65c33aeab73a95a183643b57f5fd0
SHA1 66037e1366e4631a412fb5caa0a18efd1fb0411a
SHA512 9e99a60110126ae311e2a428ae121d4671db202c2cfae96317119f3ae67520af50a06d0ea58477a199aa39c3eb0f4f5d14954a7b7c6a9aeae8582a457cd07ab7
SSDEEP 6144:1T+QJA6UyNplq5VvQSanBgtniSsxT5dUVQtGwLwW6U:h+QJA6UyNplq5VvQSanBgtniSsxT5dUg
MD5 SHA1 SHA512 SSDEEP

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\th.pak
Size 183KB
SHA256 301966a229a09b37e5b2bf12c89522a33144c977411099b81502261c4ca554ad
MD5 d2ffd3529b4880f2e8a8d0f01ae69395
SHA1 451ebcf352234a4b343d30a172054558c259ec83
SHA512 c4d3f5c3e7b307caf6a51fd74e828fcf8eaf41a07dd198ed5844893e3b27af20cdbc7b33d58fe2ca0e487ea546a4d1fc58d99faa9e14ed0a55bfa43265211256
SSDEEP 3072:9patYcYCJFkcSCkIOBrQrvUXFIY3regw1p72RALGBK7ebhdaytAG8C5JvK0:9YLYCJFkcSCkIOBrQ7UXFIY3regw1p7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\tr.pak
Size 94KB
SHA256 81694a8258624f82dfbe0af43aa0ce5fdf1304c25a2f6735b972a2a29beb8e15
MD5 7c897de0ad3c9d9da88ffd01cc7a6e99
SHA1 4864bf127f5de75c9f3a2cd4b13b6cb56c3c0a14
SHA512 2578bce090dc69d9743684671bf6ea68efff7db900128ee0703f4eb3c34db2a92f0c805c6febc8a978d1488511250e9f133d500c551cea22d091a9150f0dd88e
SSDEEP 1536:0ZCsYG9r1r2hbi5dA6dAhn4esi3axWd57opv4NEifSJi1tZAjhpsFFBa5Y8GKhns:0fPr1C9iDAA0n4esiIpv4NEifwi1PWpW
MD5 SHA1 SHA512 SSDEEP

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\uk.pak
Size 158KB
SHA256 27d3c996804b4f4c106f12becdaeeb1ce65df53abe12658574852ab7b6643bc1
MD5 026ef6b51c0b2fc92211aa0a6a1ddbcf
SHA1 d1a5eb09b90d04fe02560b33acbb55ea4f6352c8
SHA512 b8efeeb10841dae8c23e1c8d2e939b809d4f0aaba56521e037ce5d1ab6748a119a6d064f767dfd209415b4f6ed94527132696fe8c12a71c0c5b61637414c23c8
SSDEEP 3072:5kGPb9B3Ij2WDCrhKGlYRSSRLNiXMMQOCqFHEb4UMb+v:5f9B3Ij2S/LNiXMoCqFLW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\vi.pak
Size 111KB
SHA256 7f94586012c85732d23b05dbdde2c497326d5fcab87de83aafa3594b614dbd36
MD5 b7dd26646a77979ee0c4776ba0b1a52a
SHA1 4b9ba889a4aeba5b162dada01982420527a76007
SHA512 a8f4f2decf5367c02c8847bb6873a44a3389f4b3e637ab54197df5c56cef70c293a849ed260bde922b4d6a4bda4c95ec03c9d94a837028e21f74df699c434c03
SSDEEP 3072:+WDKMPnIPPiz+sEqOa27xia1bNJoKlZpW8uTtdLpFeSIAV1vPH:RJLa7bNj7Wc+
MD5 SHA1 SHA512 SSDEEP

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\zh-CN.pak
Size 83KB
SHA256 44a9dd0a830ce2feeb81523cce7fae8a0a553f05921b34d34c7826d50ac3a1b7
MD5 dc160104962893fe87f3a5088a78926c
SHA1 775945e0c70ab40d2b7ba10e58e7e0f857a95021
SHA512 4b6bebf59513c27d5e022ae01f15fb0ecec0be4b547a1231eaa79555948c7ce92f08a7b6ddc6cea7484f945afd2eed5a29acb98afc568d21ec656b076912171a
SSDEEP 768:m6J/Bm2fvv7UJAAJ/LbAsdx0X8SpWB8fa8K67cfc8TJWTPcYM1NT+IyVnl5LMgph:3J/Zfvv8b1mtJzqWXrjk0hS9D0lecJL
MD5 SHA1 SHA512 SSDEEP

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\locales\zh-TW.pak
Size 83KB
SHA256 268041a1a95dd540cf7e92a01802b65df8c8d1c80726007da1bb8a9cba6e5414
MD5 4bc50b6f5c29ea7cb60d5b79147326e7
SHA1 c22a956b438fe25987ffb4654321dababd49d1ae
SHA512 4c65d6d3b3db84412a589ea5c9a19e609d4b47e37b752d4231dd5ce02d5ed8a9ad4eecf23e321e4f48eb96c1e14f2da2a38057e6ca4079d0b025a2266783fd85
SSDEEP 1536:AHBNlgwcxAhdmD/MC23mfQVouNsP1RhOKtoUxxVfKi5No4V3XiPNPuh95mxL9kBX:AhNlgTAhdmp8oeM/5N/9XiPm95dc8Tl
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\resources.pak
Size 4.8MB
SHA256 7b953443e3cd54a0a4775528b52fbfe5ebecbc2c71731600ed0999d227969506
MD5 d13873f6fb051266deb3599b14535806
SHA1 143782c0ce5a5773ae0aae7a22377c8a6d18a5b2
SHA512 1ab38fcb70d1958c74da2493459532b52a04b884009509a1ac8dd39f6e9e670658a52f4d19ef57f1bc71dccfdd6ceedbc18034bbcad0b500d75a97c74aac6939
SSDEEP 98304:ysP2/1jJU5BiIUBXaC1hgW4k5gvXLFnhXKwggr0jgaMi7rwrwk:VOhJU5BivJ5h6q4LFnRKwSjPkrwk
MD5 SHA1 SHA512 SSDEEP

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\resources\app-update.yml
Size 79B
SHA256 586094101e39fb5d858508da1e41de460decf80e582c622a8c61ec122de64e00
MD5 93dbc21657a6114e1278e8ba5245fce8
SHA1 b7c50f4687440784cb0bc8a4a85f0f8b56dc956b
SHA512 ff6316ed5783680fe636f19455614e25ea238ae228533863a27b5d244a5dd36cc923e6661b6d8e64caefe6b1aef9d6e799607b144f17c0f6b081d9f15b24c3ec
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\LICENSE
Size 1KB
SHA256 365e2e848090ff97ffc97197654e8a004bd2e13f9b216618fdee394ac016cf79
MD5 972f323aee98757c51dc8402e7e7f24e
SHA1 58f6c2fde51fc0d501d196eb4107555835f0b890
SHA512 0713c51f5f738cf47e5b3525d3e98799a7f55bb85651eeecfe5224b08519f145d55add2efb283c39b1ce340a2726e0ee6b9b2178603eab90be68b4bb133f6bd8
MD5 SHA1 SHA512

Submit Download

rcedit-x64.exe

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\bin\rcedit-x64.exe
Size 1.3MB
SHA256 b8dda19cd775798beeca7b4bf6fe2d27580d38d7d8c833ea173f7a1ba529d9cb
MD5 78a23bc6548f7c06051864c8ebfabc59
SHA1 e33bf8eabdeecae85a5667aeb468e0897b110341
SHA512 4f481b7fecd47d253386da3af093e466be0a787d092edc358d1c3d727a4ac814c9a4aee856931b6823b3bef97e92054645d27bab4d4af9cc6ab555f3383c7e47
SSDEEP 24576:3EyXNImAx9NyoFP0gP/4C2bO1qIQP/JPlfg/OXnE:3EydbMyuqIQbfMO0
MD5 SHA1 SHA512 SSDEEP

Submit Download

rcedit.exe

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\bin\rcedit.exe
Size 933KB
SHA256 a4ccc63aa48137a1c05e9069c8f744103cb907593eb8f902d873bfceb19089eb
MD5 3213f5a9b6945ab5ccf86719c95fd826
SHA1 51bd273e3d5d5c2b0c466665f254630481bd0d0d
SHA512 ab67129b13626c9b7848f9421ee7a8f71fb335b709ce6d099a88fd9804188365bab5d2286f3c2daab009763fa6dab23135cf3d000b0453a86afd50200920b206
SSDEEP 12288:raKwwMP7EpEzsXMQmgEySArWgH7irNxkDzfRF3sriU8ivsAQm5:raKTk7EpEzsHfBDzzsrj8esAQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

rcedit.js

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\lib\rcedit.js
Size 1KB
SHA256 6016ac90a9ade1085d5045f5b04acba6e75f16352a407989ca18f2e60054d1ff
MD5 4d1c65dbc787732a4849a321d19d155f
SHA1 626b7b677082f86e5059c2caf1201e23f41a175b
SHA512 1111dd81544b757c6eeb7caa0d338804a2dc0073c30bbcc5a75838c17a3419758b21caf2fd3ccf42a67c4041edd9841f83727010cc1fba5d8a159ff650125e1c
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\resources\app.asar.unpacked\node_modules\rcedit\package.json
Size 765B
SHA256 ba400592180d76cc3f13d45b8a74f27b103774bc280fb6cb0e41577051e778f2
MD5 60d7e229902e7e3a50b47f883de0c6ba
SHA1 6318c5b2721445be9a66abfe5d09a39cfadc7532
SHA512 9579cbaf955a71ce4254a607304bcf1802e3702dc1715f17c206887c177dba075be768aa0d3a26d669d1f97f2e39c4c68f95ee8a63163189f9007fdbcf6cce96
MD5 SHA1 SHA512

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\snapshot_blob.bin
Size 50KB
SHA256 2c68535a259a58d001d0f28780cb0f9df7f48149644944bbb57ecfdbfb3b2234
MD5 8e1d1306a982688aa9b6c4eaf2dc6112
SHA1 e9d09697e2f4e7ab856dfd1e7d2c9faa1c29fe3f
SHA512 456536de0fbdf3a5e5cf4c0c53c81c966022e01ea4924b3d0696704355de612fb9a7605da21c81ee5f5c546b47bbe6a1fff45146a8fe5e0ef04a69d8b1a4f7dc
SSDEEP 1536:oaU4cuMHzO/db/WvwRSqJVUsjvwhmVS4u:vU1H61b/WYPJuIvw4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\swiftshader\libEGL.dll
Size 379KB
SHA256 74f934004b27fa48154876bba8710e301c75aa3d9125e6180c4486b139159801
MD5 2b35e2670411b0e46569c702723bf455
SHA1 23059a9001e1bc5d4ecd2a2995a80bce01dfc217
SHA512 822821a14f48d85a6c265530fa93c46fc781149e050576f031a6f27d0288f24f7f9b341fd7fe9179b1b32627f91b7db44301aefb73e51dfdf778b10a9d1242f7
SSDEEP 6144:cayLoJ01tUL3Q3LjSPu5FUuJiHMPyfV2Wf5gqIhCTQVBGXaZDseVMgfu1aNwqNxP:f01tSInGV26iPCTQVCaLfu1aNwGp
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\swiftshader\libGLESv2.dll
Size 2.7MB
SHA256 f3ed98d9c3e915b6c55bcb9a17e162134ce9897c5246110bc2955cac5851fe2a
MD5 6a5704a246535ee666b1cf87e10eb53c
SHA1 c9d74edd160314b780a76b5ebfda3c0cfe2e5606
SHA512 e8b2a39bb50a6117738fc593cdb07f8b4a87bc6465fd61de82cd33156ebdf5d714d389b2e74f0d284801e0ac09704a21b46a005ded8ab8ad9b9291bbbb5a43be
SSDEEP 49152:rvRd9FO9MwdFA/w1s+Glqa/KxB2CgfFK1GokWFBB4PD6xABXGfSqnVjxSEhnR3qq:jRd/CcMxgUrXr1j12eJQo
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\v8_context_snapshot.bin
Size 167KB
SHA256 96d85880d161bd37a28ad13777337e5121189a6ac45b9232c74e052d6d1e27f2
MD5 2c28ffbe331f4a32c7799bcb941dcca1
SHA1 d572497341ac1e8079531616f0bef7611dd12243
SHA512 f18ca45dbd04499bb3ea74cb59414ae4bf497be0cedd96d9f3693591198a1afeaf48ae4e7c7a0c31e31c1a128a34c990f2837fb576e0ffb288edc860b27563ae
SSDEEP 3072:ofTMT28BjuekkwYUuMGcwXDLGKLeueQTY2oanIpGia/YkjXQyY01TNgqXYla0H:UTMnRknhuncEPGKauHLoZGiOYkjfNg/L
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\vk_swiftshader.dll
Size 3.7MB
SHA256 e481daf4a92f3b1e73ba4cd85546d561a21c214ef74bfedf9c8f87319857a83e
MD5 8cafc6a2d708c9f4d3009d7e135a641c
SHA1 e2a4aaf005ffce737246a2cdac38322664ae6088
SHA512 1c9f365eb5ae2b78dec93f567c32c420e9a5706b82d51b1129cd899959404a53ca34c1fb70cc041ebd191e5ca5479b21e1505b70dbe6fc203c79fa8b930a4a0d
SSDEEP 49152:NkCQYIV3ZtjgctGIW0yPC5X/23J2/8JrtVkjY0eGrtiOjhfwqeAztw3GjaWBeRnt:bBrPaOBtB+rtiOjhtMWjaWkRKNdh2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
MD5 SHA1 SHA512

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\7z-out\vulkan-1.dll
Size 624KB
SHA256 3e04a5ad696827a41891bb61befd845004a0d0816832a69f070716c16e621803
MD5 7949e1e84aea85b9e34b68b607a9467e
SHA1 b4dbc6a149c3482b98f246b625917e68b21a7a21
SHA512 2c573f47ce99a2bb7396ca954aa066bd641f879c0aa6a78f700b17acdfad6c6e5fddcd50371fdd76571fc47683600e6a7f29559df59b21af831706d1a8369bcf
SSDEEP 12288:KbHuIeVEXjDNOWx4ooMWRE72YcXVgnvVW+2c+xUpmuHrwYuulnRG9:8HuIIcc9RvAdW+D+up5u
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
MD5 SHA1 SHA512

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb56BC.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\chat\Network Persistent State
Size 353B
SHA256 7edc4ef3ee8ee2071f7029d71a2bea48c0209789c2c0b68447c418d4578dc59b
MD5 09e6ad4246a6342619343a1102e1eee5
SHA1 0e8b95fd255c47faa508d37af9cd5a08f94de871
SHA512 98911883789a664bf9d49aa6124bdae34e78b7cc3fbf45bbf555106972608a0229a666ab1cadbf1bb49f475fdcdc1946e6ec1ff5e8ed469555d78fb8d1fc735e
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe591ac2.TMP

Path C:\Users\Admin\AppData\Roaming\chat\Network Persistent State~RFe591ac2.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\chat\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

128-deadcode.png

Path C:\Users\Admin\AppData\Roaming\chat\extensions\fmkadmapgofadopljbjfkapdkoienihi\icons\128-deadcode.png
Size 2KB
SHA256 e3e4ce549604652a6a573550f34b3994992d7d70bfd39bf69fc30cfd769b75f8
MD5 95c2da7d58ac4f57f4162d4b521d1c2a
SHA1 964c06f2b50bd34c77ff760c939ccafccb8298da
SHA512 765ddb52aed9c28e7ccf22768b432e7391a407cbbd0be75722ff59f438ed7208eb94b78cfa1a90701f2dede8f153169d2caa379355f2b3532e465878f336e2c5
MD5 SHA1 SHA512

Submit Download

128-restricted.png

Path C:\Users\Admin\AppData\Roaming\chat\extensions\fmkadmapgofadopljbjfkapdkoienihi\icons\128-restricted.png
Size 1KB
SHA256 cbde2b973624ad785f37523efecca9721813354f2a7e21ecd305560acc138c06
MD5 976735be5c5ef4986782407579e25c50
SHA1 1a72c6f1fea87fe8e79d14c72ad5da6ab6d9b761
SHA512 8288ebd7f1bcfccacd9092a30f09ac141620710400856300f1c1056e7012c3066fadc8128c6ca1d567a289af3967cd8c9b3d562421e00132fe9680e4172f56c0
MD5 SHA1 SHA512

Submit Download

16-deadcode.png

Path C:\Users\Admin\AppData\Roaming\chat\extensions\fmkadmapgofadopljbjfkapdkoienihi\icons\16-deadcode.png
Size 338B
SHA256 705902c00dc5cf4ac85d9eac512a17b2e0bb427dc98cb2cc8f19322a95600076
MD5 2bd352e9368664c7aba97f61df7c407f
SHA1 232e5ea71cfa6276254862afdff99835136a4f31
SHA512 7fa71202d4aa7eab73e4695c5c6a1a667ee2e8ed2eb2839bcc8da5404f0edf54d20e095df6af9bfb95a08f6044b3e2f51ee85bf2d28440aefa35d2af8362bf1a
MD5 SHA1 SHA512

Submit Download

16-restricted.png

Path C:\Users\Admin\AppData\Roaming\chat\extensions\fmkadmapgofadopljbjfkapdkoienihi\icons\16-restricted.png
Size 288B
SHA256 131e9ff247e8e9257351129b203709d8a8a25488f7159b498d661ba8510efd7e
MD5 7b2b93a5c23de8b45be5076bec86cc03
SHA1 7bf00b51cee062b2a6f0e7ba8e6fe892b2665e96
SHA512 93be1bebae3a2ccc5fcd8ad97b96529e6dd7f8eb1f68fa6a20a7c6c006222ade42915f5bc0199ad2b2258272e9001969a830d6a0536ce0b127176465c5b082ce
MD5 SHA1 SHA512

Submit Download

32-deadcode.png

Path C:\Users\Admin\AppData\Roaming\chat\extensions\fmkadmapgofadopljbjfkapdkoienihi\icons\32-deadcode.png
Size 561B
SHA256 53b429c91414bee3fe255328029eff513f172fffc41fd63d95aaadb697ce71a5
MD5 7d81fdce34f01d8229f67cbed8ca30de
SHA1 2d147ca07846a5c33271a3cd9fee58be0b041088
SHA512 4e64518b53c83c075bade7171989a7f796f7d4ac63ddab47ae938bb55ade22a1ea04c208a16c4ec87a6535a57100eb51b7f80b24887c2a96eb2f5758e2615d22
MD5 SHA1 SHA512

Submit Download

32-restricted.png

Path C:\Users\Admin\AppData\Roaming\chat\extensions\fmkadmapgofadopljbjfkapdkoienihi\icons\32-restricted.png
Size 490B
SHA256 1141df69cf1d1985c49f795b65acba57e4d2399e6ff50bb3e6bdc0b710f27804
MD5 a224d8a9e39b203054da833b0636ff06
SHA1 8acf99866b257c7b5b38c5708870cd17d3d7b13a
SHA512 7c4d5daa2fb4a7285dd747287ba56e3c484973cb9f01a49dc0926aab0d4ae0295586707ea312560782abed6409a62ef3367907fa77863276cfbed85449b16315
MD5 SHA1 SHA512

Submit Download

48-deadcode.png

Path C:\Users\Admin\AppData\Roaming\chat\extensions\fmkadmapgofadopljbjfkapdkoienihi\icons\48-deadcode.png
Size 826B
SHA256 546c0260ab5a03c3075e9278956019214bb6433de266c6f95b7021c0115070e2
MD5 5514edc867b037351d2d01cb8b204d3c
SHA1 55070782e7049bf2d6c45be7605d193630f22eb1
SHA512 f8ab9ad7e9ab9836580b6d99415250d01dd8be53a01a4e0658031d25d7c891f4e8ae4add8a86aae55522d118a771c2625d359aa504cf52244433955301d17079
MD5 SHA1 SHA512

Submit Download

48-restricted.png

Path C:\Users\Admin\AppData\Roaming\chat\extensions\fmkadmapgofadopljbjfkapdkoienihi\icons\48-restricted.png
Size 730B
SHA256 0ddff2151123e022e007e09576a6b030c38021d0fffc7546f0c9a1b8529813e2
MD5 f1198971a65f0c320a18931b5a6e9e03
SHA1 5783485687ae3ab6bcbb07f203dcb92211ada979
SHA512 bda8969740bb4320095f4d5b4bb185ec8f881307640eec1d917c20c0f65b7d43ade107334de6d01ee7334930909e55090cb7eea771ac2e199db6b811d72ee512
MD5 SHA1 SHA512

Submit Download

development.svg

Path C:\Users\Admin\AppData\Roaming\chat\extensions\fmkadmapgofadopljbjfkapdkoienihi\icons\development.svg
Size 3KB
SHA256 acc667332543cd491097b281fd35bd49bf435768d4cb2ab8f579740072756313
MD5 46bb24f5f8540049a459da5b12ee1478
SHA1 e8189f6545038616eca6ef33068093dbaeb66350
SHA512 89b74512db2792b409f1ceaa275fb1e8d7eefdb195bcab76c7b489228c822a6a68182d93c485956d16c02e310e4d3d3f6da7a561f93d0e0034627339d6848776
MD5 SHA1 SHA512

Submit Download

restricted.svg

Path C:\Users\Admin\AppData\Roaming\chat\extensions\fmkadmapgofadopljbjfkapdkoienihi\icons\restricted.svg
Size 1KB
SHA256 279310c2dfe871f3f6a875ef3d5cfb8922d37faeeb9c127ec312aeebe1c51cd3
MD5 3cd7ad037efd1fa2a7477031af2c2809
SHA1 ec5c179569f1add1f0ea8a69d622b36013ba72ac
SHA512 b2349b5a3decd559999f96c5b4886acb9d39ab46562d3dca1ffba049573c7d99980fd9c5272dfbc72059afd89a6d435bc81a2fd0adfb606ad9057c24b6b3f4c8
MD5 SHA1 SHA512

Submit Download