fceb4408573065ed567348f5e8ac37c48b9d790171097c86361d28813f44baf7

Analysis

user interaction
yes
max time kernel
899s
max time network
887s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/06/2026, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Veo.txt
Size 28B
Sample260602-hmqrssfw21
SHA256 fceb4408573065ed567348f5e8ac37c48b9d790171097c86361d28813f44baf7
MD5 d51f097cfcfb67266b6f5498bc78f5d5
SHA1 a219ec7a6d855786ad9cb3cced9623e8fd1f1ce2
SHA512 06f1235d99389fab38c5097fb084e21ff925a4379a08bf3115e3aacdc0489934aabb0f0e395c8af1a9f3aecaede0787ef2c105c739a95846c4e8a718c1edd787
MD5 SHA1 SHA512

Score

8^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
99	4956	chrome.exe
99	4956	chrome.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	Obsidian.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	Obsidian.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	Obsidian.exe

Executes dropped EXE 8 IoCs

pid	Process
2668	Obsidian-1.12.7 (1).exe
5000	Obsidian.exe
1896	Obsidian.exe
572	Obsidian.exe
1724	Obsidian.exe
5240	Obsidian.exe
5200	Obsidian.exe
1288	Obsidian-1.12.7 (1).exe

Loads dropped DLL 27 IoCs

pid	Process
2668	Obsidian-1.12.7 (1).exe
2668	Obsidian-1.12.7 (1).exe
2668	Obsidian-1.12.7 (1).exe
2668	Obsidian-1.12.7 (1).exe
2668	Obsidian-1.12.7 (1).exe
2668	Obsidian-1.12.7 (1).exe
2668	Obsidian-1.12.7 (1).exe
2668	Obsidian-1.12.7 (1).exe
2668	Obsidian-1.12.7 (1).exe
2668	Obsidian-1.12.7 (1).exe
1896	Obsidian.exe
1896	Obsidian.exe
1896	Obsidian.exe
1896	Obsidian.exe
1896	Obsidian.exe
1896	Obsidian.exe
1896	Obsidian.exe
1724	Obsidian.exe
5240	Obsidian.exe
5240	Obsidian.exe
5200	Obsidian.exe
5200	Obsidian.exe
5200	Obsidian.exe
1288	Obsidian-1.12.7 (1).exe
1288	Obsidian-1.12.7 (1).exe
1288	Obsidian-1.12.7 (1).exe
1288	Obsidian-1.12.7 (1).exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
150	raw.githubusercontent.com
151	raw.githubusercontent.com
153	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3472	tasklist.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	Obsidian.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obsidian-1.12.7 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obsidian-1.12.7 (1).exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4956	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248567387144814"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\obsidian\shell\open	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000	Obsidian.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Obsidian.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\obsidian\URL Protocol	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\obsidian\shell	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1 = 5400310000000000c25cdb36100062656265726100003e0009000400efbec25cdb36c25cdb362e00000048860200000008000000000000000000000000000000ade91a00620065006200650072006100000016000000	Obsidian.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\obsidian\ = "URL:obsidian"	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Obsidian.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "4"	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 0100000000000000ffffffff	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "5"	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Obsidian.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\obsidian\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Obsidian\\Obsidian.exe\" \"%1\""	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Obsidian.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\obsidian\shell\open\command	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Obsidian.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Obsidian.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\NodeSlot = "6"	Obsidian.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Obsidian.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3828	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2668	Obsidian-1.12.7 (1).exe
2668	Obsidian-1.12.7 (1).exe
3472	tasklist.exe
3472	tasklist.exe
2652	chrome.exe
2652	chrome.exe
5200	Obsidian.exe
5200	Obsidian.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5000	Obsidian.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe
Token: SeShutdownPrivilege	2424	chrome.exe
Token: SeCreatePagefilePrivilege	2424	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
5000	Obsidian.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
2424	chrome.exe
5000	Obsidian.exe
5000	Obsidian.exe
5000	Obsidian.exe
5000	Obsidian.exe
5000	Obsidian.exe
5000	Obsidian.exe
5000	Obsidian.exe
5000	Obsidian.exe
5000	Obsidian.exe
5000	Obsidian.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5000	Obsidian.exe
5000	Obsidian.exe
5000	Obsidian.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3484	2424	chrome.exe	85
PID 2424 wrote to memory of 3648	2424	chrome.exe	87
PID 2424 wrote to memory of 4956	2424	chrome.exe	86
PID 2424 wrote to memory of 3648	2424	chrome.exe	87
PID 2424 wrote to memory of 4556	2424	chrome.exe	88
PID 2424 wrote to memory of 4556	2424	chrome.exe	88
PID 2424 wrote to memory of 3180	2424	chrome.exe	90
PID 2424 wrote to memory of 3180	2424	chrome.exe	90
PID 2424 wrote to memory of 2344	2424	chrome.exe	91
PID 2424 wrote to memory of 2344	2424	chrome.exe	91
PID 2424 wrote to memory of 2892	2424	chrome.exe	92
PID 2424 wrote to memory of 2892	2424	chrome.exe	92
PID 2424 wrote to memory of 4616	2424	chrome.exe	93
PID 2424 wrote to memory of 4616	2424	chrome.exe	93
PID 2424 wrote to memory of 1068	2424	chrome.exe	94
PID 2424 wrote to memory of 696	2424	chrome.exe	97
PID 2424 wrote to memory of 696	2424	chrome.exe	97
PID 2424 wrote to memory of 2084	2424	chrome.exe	98
PID 2424 wrote to memory of 2084	2424	chrome.exe	98
PID 2424 wrote to memory of 3172	2424	chrome.exe	99
PID 2424 wrote to memory of 3172	2424	chrome.exe	99
PID 2424 wrote to memory of 3616	2424	chrome.exe	100
PID 2424 wrote to memory of 3616	2424	chrome.exe	100
PID 2424 wrote to memory of 840	2424	chrome.exe	101
PID 2424 wrote to memory of 840	2424	chrome.exe	101
PID 2424 wrote to memory of 1560	2424	chrome.exe	103
PID 2424 wrote to memory of 2988	2424	chrome.exe	104
PID 2424 wrote to memory of 1036	2424	chrome.exe	105
PID 2424 wrote to memory of 3140	2424	chrome.exe	111
PID 2424 wrote to memory of 3740	2424	chrome.exe	118
PID 2424 wrote to memory of 3740	2424	chrome.exe	118
PID 2668 wrote to memory of 2200	2668	Obsidian-1.12.7 (1).exe	121
PID 2200 wrote to memory of 3472	2200	cmd.exe	123
PID 2200 wrote to memory of 3956	2200	cmd.exe	124
PID 2424 wrote to memory of 2652	2424	chrome.exe	126
PID 5000 wrote to memory of 1896	5000	Obsidian.exe	128
PID 5000 wrote to memory of 1896	5000	Obsidian.exe	128
PID 5000 wrote to memory of 572	5000	Obsidian.exe	129
PID 5000 wrote to memory of 1724	5000	Obsidian.exe	130
PID 5000 wrote to memory of 5240	5000	Obsidian.exe	133
PID 2424 wrote to memory of 5848	2424	chrome.exe	134
PID 2424 wrote to memory of 5848	2424	chrome.exe	134
PID 5000 wrote to memory of 5200	5000	Obsidian.exe	135
PID 2424 wrote to memory of 1288	2424	chrome.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Veo.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffba55fc728,0x7ffba55fc734,0x7ffba55fc740
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1636,i,14457414368762273931,1703401196452665464,524288 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,10144843216148373435,14449804219904524116,262144 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,6263600528242128205,6739221814534066388,524288 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,13279292546190502839,8934188063346797057,2097152 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,8104669039767694428,7797838601664268216,2097152 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4376,i,10466501955277042337,6496005155814753264,2097152 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,17919934253537151932,14884886769856533560,2097152 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,10443770608559611188,12171178515088989301,524288 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5728,i,5270436838696574182,3282021643235776993,2097152 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3404,i,15305806765948652334,5701577001551458017,2097152 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3496,i,15704119817649908846,7714983968300943685,2097152 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3396,i,7156951586047744413,17122615412377909084,2097152 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5988,i,488899988895823757,12008170368990981775,2097152 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,5948148687733735516,1588276037814234872,524288 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3264,i,14389032229391729886,9384450786634252537,524288 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=504 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3364,i,5706743909736483198,5362000419596238593,524288 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,7397691134984434808,14963331090192028693,524288 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4480,i,16621255841203665399,9792495395657443476,2097152 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5688,i,5633721743393743826,4130535415426095043,262144 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,14342034247123693269,14894488595032836852,524288 --field-trial-handle=2128,i,10432773695175202332,13485234975827072743,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  PID:5848
- C:\Users\Admin\Downloads\Obsidian-1.12.7 (1).exe
  "C:\Users\Admin\Downloads\Obsidian-1.12.7 (1).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4028

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4932

C:\Users\Admin\Downloads\Obsidian-1.12.7 (1).exe
"C:\Users\Admin\Downloads\Obsidian-1.12.7 (1).exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Obsidian.exe" /FO csv | "C:\Windows\system32\find.exe" "Obsidian.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Obsidian.exe" /FO csv
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3472
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "Obsidian.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3956

C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe
"C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe
  "C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\obsidian" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1856,i,12121053868614426561,1576577827638892470,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker,SharedArrayBuffer --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --log-level=3 --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1896
- C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe
  "C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\obsidian" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --streaming-schemes=app --code-cache-schemes=app --field-trial-handle=1856,i,12121053868614426561,1576577827638892470,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker,SharedArrayBuffer --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --log-level=3 --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe
  "C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\obsidian" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --streaming-schemes=app --code-cache-schemes=app --app-path="C:\Users\Admin\AppData\Local\Programs\Obsidian\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1856,i,12121053868614426561,1576577827638892470,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker,SharedArrayBuffer --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --log-level=3 --mojo-platform-channel-handle=2640 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1724
- C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe
  "C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\obsidian" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --streaming-schemes=app --code-cache-schemes=app --app-path="C:\Users\Admin\AppData\Local\Programs\Obsidian\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1856,i,12121053868614426561,1576577827638892470,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker,SharedArrayBuffer --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --log-level=3 --mojo-platform-channel-handle=2104 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5240
- C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe
  "C:\Users\Admin\AppData\Local\Programs\Obsidian\Obsidian.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\obsidian" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1856,i,12121053868614426561,1576577827638892470,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker,SharedArrayBuffer --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708991934122588 --log-level=3 --mojo-platform-channel-handle=3916 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3a75f67d-ef94-4a42-be99-332cbbf27184.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3a75f67d-ef94-4a42-be99-332cbbf27184.tmp
Size 115KB
SHA256 04770aaea10d47799173c22a57774e0df86e013d02446fe1c54fbea7d8a07b7a
MD5 fd605d007b6b8ac49a3822ceb411ce8a
SHA1 1ed0bb4e20257af2e72ccbf197031f40e9c2bd89
SHA512 d3ee58b31e19fa4b6db14dbb126efec3fe0a9330b00f8c41e53b1865ddab6844472e2252cda1efb0c914de1819e0bf1ef96c22ebaaa1437a91c43a1b49193993
SSDEEP 3072:Ixvw3LffUnBKU/F8enCW3iyVEXGey0cB12:IxY3LfqBZqenbyyVEd1cB12
TLSH
T1E2B31221E5A6FF7B9275572AB50F93295CD148BF44E1E788443C2F19E0CA388EFA8D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e1f4cccabcc2bef1d52fc5ad3a5167f40a080e47fd98b2e3476864769b889992
MD5 78d1a70f16f9ef3836a8e74c21e12fc7
SHA1 81bf7a27e9385e037dd6bdc1ff0363c0fae78213
SHA512 25defff8a35627576841e62e9091c71ca59a5f53826b9c65f88c355ba7dddbb3a43c3dacf2895bf3585adfab5a3300fb6753f6849e4f9a6b6b5f818f6ccea627
TLSH
T188F078BAC821EC3708FD0B282095270AE750131B2B41991F3B3CA20C8FB173B854281C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6e2a25f89f50a048cb3e79032a32c12b6c4d6d5006470eb8747e44884bfdf987
MD5 7bf4c1f738234e2b03269c112047ae0b
SHA1 f5734f540136aa633a660d2e8773f5761a8101bf
SHA512 39d2b34a80db68f68e6b9d5100bf5b0d8071a50b4ee716a01a4587cbc46181bac7be5a36e63783ed67f9ea9997ab2545a478bd7ebd407601c99c3c219c164277
TLSH
T1F8116D1A6773CC77CB7C5CF0ABCA496E7A324A3C23562B443F148C57E293AB00421872
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9757a48958e26383293935acac0fbc8bf8d6778e624ee846c06bdf5989f69337
MD5 9badc333502b2a3d6ea03423e314d4dc
SHA1 1e888645adc91102de6f7afb5fa7049c26ad7d20
SHA512 a8f17c408f12530d1bdfa30f31a08fb91ef1a8be553e72cec54101767c93faad01a8f1e270547e390c2abef17980aa293e259b07ea6cc2176fa04dac2dd3f6da
SSDEEP 192:DFQMXqAX89GUJ495eimkvU9NWMIuIcImIItNPpaPEivKfPkcUemt8ejhgnK:DFQMXqAX89GUJ495eimkvU9NWMIuIcIl
TLSH
T16712A0F7C7D8C52D891156F4AB266F1ECE2A0928432C3C27C8D8AF5FA3E2471D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 0066244f2377c94e04a057ca4d0f452f7f7cbeb4150d739bef8f72a02aaa922a
MD5 bd17153d677fbdf2d96de1ec1a92bd45
SHA1 814ae0c965a3edfcb23487590b5c5d234d1a42e7
SHA512 4a8882a55e5c775f186266132bfe223ae1b0fc178c0f68814b9d71885371d5fd3cb396f881b53a8d8d1d6d90cc7a89cca8a2bb432a927d838561b8910dba374e
SSDEEP 192:DOhHKthHZY5JJu95eiiEvU9kWMI5ImtNPpaPiivqfPiZemt0ejhgSK:DOhHKthHZY5JJu95eiiEvU9kWMI5Imtx
TLSH
T17CF1BFF7C3E4C52D891156F4AB266F1ECE290928432C3C66C8D8AE1BD3E2472D25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 b37a0a7af713c80a4de88607883950afb59944ab8efc626a452791b385c91027
MD5 29bd28647a6584368e9f227dcb7ae348
SHA1 cd1f3c697128b2640221c621ceed35a2457ebbeb
SHA512 ecb8a18c7086875c07907076d60a560fd174a5f6b9cdd476c880321e6eff45b3dfa9e5ca82d9e9182444f93403ebe6e66a9c7d05476b4af7295deb67c8abce69
SSDEEP 192:DFQMXqTX89GUJ55eimkvU9NWMIuIcImIItNPpaPEivKfPkcUemt8JK:DFQMXqTX89GUJ55eimkvU9NWMIuIcImG
TLSH
T13812B1F7C7D8C52D895156F4AB266F1ECE2A0A28431C3C27C8D8AF5FA3E2471D21564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 517d6c79042046c369afa5976affe67bfebcadb1acaa76eef916f117c42f5351
MD5 970ca63917eee6a92d3219f17d1b55bf
SHA1 036b7c9626c82a06baee505689ba1d346925318d
SHA512 2100d59418a64b528f2b91bed03cdf86f7457ceb7831cb85c4d2a0914887e95b00d622126ae87bcc85fb11eca72aed4a73eaaeb2a383d7707728828707d3070d
SSDEEP 192:DOhKthHZY5JJuEa5eiiEvU9kWMI5ImtNPpaPiivqfPiZemt0ejhn+K:DOhKthHZY5JJuEa5eiiEvU9kWMI5Imts
TLSH
T191F1BFF7C3E4C52D891156F4AB26AF1ECE290928432C3C76C8D8AE1BD3E2472D25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 8abfe080b56d8061d93da8d9c6041bcb2b16e0e2bb2266d093dd9f60bfbaacf9
MD5 263ab75cd4c32c2b6c909e023ba49086
SHA1 eaa538bf3ced7e2291012f2251550810437c187f
SHA512 3d9a708a4bc245d3d779df44e00f4e0563689b7a222e0ec55d476507cf4b221d00400a6d72c55b884cb2a18ece75fc351483bb1646666755e50b4b37c597d9e8
TLSH
T1FC114897917D7817106A6DBF5D18BC0E1C7AA8BA11816CF8CEBAC17DE0555B32F12017
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 731f48f9221082e93e48b5297e2dbd9cfd01764484eba77309bb24c1dd14574d
MD5 2d6d57313c16484c5d291249fdca336a
SHA1 c0f3f0df5d1b42e425d0a999651c5da7a4204986
SHA512 1e1e8ca318e599dcfe938ef11d93ce0a89864b7232e8930eff00b224bb90ecefe0af1609f4c7f8ce5f6ff1831215791509610c1d7fd57371e5dc3377aef034ae
SSDEEP 192:jRrcBzQyrBgRXYIv7ThAPRp2cP+N99Hsb+WNnOI4Fd2/bev1RVyIsnAUgtaJ:jRrmzQMB7U38XEjw3S2+38
TLSH
T1D342D42EAA106A7B1CD6C22AFA617B17D3F5103165E42E94EBFCCB2C14E76CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 026591d5f84dc1de5da683a8e2afb8f20b64a463d30445d92c1b7b348c8db5e8
MD5 4e552a1b4e953e9ed93b2d884c91ba25
SHA1 018a3c1fa589ae131c55beca430aaa4707824490
SHA512 2b99e82863f1cfdb6966e50ec85cc2c6ffadede30284d504148c1e70371c36c50d2eee5fa355c463765355c4f0ab2a5fd1444791b09c9083b3b36e9c43ea3858
SSDEEP 192:jRrcBzAyrBgRXYov7ThBPRp1BcP+S99Hsb+WNncLOI4Fd2Zbev15VyIsnAUgraJ:jRrmzAMB703DX1yjwcbS2Afe
TLSH
T10352D52EAA102A7B5CD6C22AF9617B16D3F5103565E42E98EBFCCF2C15E76CC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4d4e9832d4c52a4e09071fd0f9924200a027154451f541a876d535d73450d4a0
MD5 2132957c4535f0f9a3f7ca3bc4fbd9e1
SHA1 258e404120a79ce213db2ef7aceb57e6dee8bb87
SHA512 c325cb25a7d80f02b657e45fcb53e37c4ffe39ebcb50a4afa71a25d38554c317c5b11841521fb9dc71776db531057b3a6d2be7bd5ef0e537baa6384f41eac50f
SSDEEP 192:jRrcBzAyrBgRXY+v7ThAPRp2cP+S99Hsb+WNncLOI4Fd21bev1RVyIsnAUgtaJ:jRrmzAMB7638XXjwcbS2s38
TLSH
T1B852D52EAA106A7B4CDAC22AFA617717D3F5103565E46E94EBFCCB2C14E76CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6e9fa69292c7c4076fe8f000bfc5fc08d31b793be260799290046e2bd84ffc19
MD5 8c39fcf9bddf728e11a41f11e296aade
SHA1 b4eba719fce9be2a221648ec09948b6c8e7cd4a9
SHA512 9bb654c7cc6b286da7f8ecb16cf15c55eaa981e423a846c230a2c4ad3dc3060d5a386f9e82c91766386f1cebde1cba9c6c665b70718aea9a7dc41d60888f7c96
SSDEEP 192:jRrcBzAyrBgRXYIv7ThAPRp2cP+S99Hsb+WNncLOI4Fd2/bev1RVyIsnAUgtaJ:jRrmzAMB7U38XXjwcbS2+38
TLSH
T19552E52EAA106A7B5CD6C22AFA617717D3F5103165E42E94EBFCCB2C14E76CC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2999ab359f8794f92b506932028943bb6b22555999d856ccfa5aae7ba060c0e2
MD5 3c3ca1bf1c8ad228ef3480f2e59e9ca8
SHA1 3558d73a9c4d1f43dc68cb8df1946f26e27ce751
SHA512 afdf19dd955e2467d8f61ab4515c70a9c8c7ad1589ce8382ac124eede175d222631e88741ebe7a8e192a6e03638eac375e3b97b517dab01d48bbde4e9b09a605
SSDEEP 192:jRrcBzAfrBgRXYov7ThBPRp1BcP+S99Hsb+WNncjfoh1OI4Fd2W7bev15VyIsnAq:jRrmzAjB703DX1yjwczUhS2WKfe
TLSH
T1CB52D62EAA106A7B5CD6C22AF9617B16D3F5103565E46E88EBFCCF1C15E76CC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 347d73ba7d38af83ac3d460ce8c2dd97cabdd4c55b65412cd8b887fb45b65b38
MD5 871109c95d991c94717364d65631baf0
SHA1 fc56f3d2f1b22d07cb19c827684bb9fb264712aa
SHA512 3ade27ac0b79ef313d66bfd054d6fd2751cb9827493acd598ed9e782f0d4fcd111331893c5c70bec25cf3d8785027f9de5a781447cdf6e3bd8e08cdce6002844
SSDEEP 384:IijUn7KxkXqKf/pUZNCgVLH2Hfgslk+n7pLuLcSjijXODUL+ErU3gRnHGmvcrBv0:IiUn7KxkXqKf/pUZNCgVLH2HfgsK+n7D
TLSH
T1A27219776C4C9E370F94C68CD8277B4FADB5025B65E9886843FA982903D5ADF010A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 51df3c93928ab28059d916be818bd392ca42a882aeca709ddde2284d9e10c693
MD5 6a69c0a4e8182f119ad334c0c4d1f492
SHA1 998f894e067fae9c7a2d7f6bf8dcddb0134effa3
SHA512 270e410c1cdbf72fef65415bb7ab959f6ae0784d4cdb54f8ef7a1439639ec1d089a4590df764ee195ac04eae62d615667e6b49681ec7a2cced656ca1d29a5c37
TLSH
T118B0128080419941C01206F4114214CC71AC9F21960B270193E469A788392508425091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584a91.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584a91.TMP
Size 96B
SHA256 1c34d6b613b52c4f1182abaaece5a16d739dc60beb31f19c85e5e06995db4733
MD5 f90a682f8b64f78c032deffe75622891
SHA1 5fe109b3f0137a7da30f1a9dbc108ef1989a82c7
SHA512 b746932505d55d99e2b0ee0d0ea77ee44eff3a72154e39111dab2f929604c79f62010cbab1e897ef40dfa091fd243d483c7e784816ac72fbf356e0d1f365ae25
TLSH
T118B02230C2032282C0030BB028A3C8C8B828CF30C203022382E00E2AEC322208220020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 14be9edc4386f42ad1cba0e572c4179a28c24c2d667163e544e6b4672e3d583c
MD5 8a9440411c9a8847c8c4f744bf0a28ea
SHA1 ca1e701148f18ec26de91331a8f3e4f705054660
SHA512 ee4c2023465702d8359e1bf2fd143f0f0a69f02562d09eee2dd39b798e30dffdba6b0bc65ac4ff487cb528f336d942b52dfbe9cc6a3b5fe5e981c158b3a25ca8
TLSH
T115A00261D5E4D012D08056F9A493014433664C601212468580964844BD531517D52480
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 48a6523081da7cf41e8093123ad9f72d51a636796ff7d056935c196803ed3a08
MD5 04a062d7766718c4b5c1788c454b4e23
SHA1 21d37cac595d89c2417d4eb2d0dfbc95ac868381
SHA512 509308fe4a34ced21250e7069811f718ec71f43767da90bacc3fdb74a7b6d7836ee289c6861494b5b0f8f92c095aacbe6a98791e5b810d1b9e7b7b1bb6539f4f
SSDEEP 3072:8xuFM2PVKoWcGBJEuatuw3LffUnBKU/F8enCW3iyVEXGey0cB1r:8x5noOJtaj3LfqBZqenbyyVEd1cB1r
TLSH
T1A13412B165ACBEE84374EF72E50B672A5FD04D7F0895A99804193F97768E358FE08C20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 05fe223fcc40c7b8e7e8ad40169152f05fabfce81da23665a953a12ff7289ffa
MD5 a847b205fc4a5fdae8b1eef6e1f53efe
SHA1 4a2012e435d04e0595d618ae75ad5cc5b4204381
SHA512 dec407302289e8995d4dace60f76dad7360e6a2ef700ed61140fe868d070fd7faf40613a781297ccffb452b6fcce3c140128aeae042bd032513fbb45d4f38a18
SSDEEP 3072:8xhFM2PVKoWcGBJEuatuw3LffUnBKU/F8enCW3iyVEXGey0cB1r:8xgnoOJtaj3LfqBZqenbyyVEd1cB1r
TLSH
T1023412B165ACBEE84374EF72E50B672A5FD04D7F0895A99804193F97768E358FE08C20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 c51f7968b9e82eda8518db41ca8903d61f92d6ab78f84bfbd2ed75d3bf96e451
MD5 febe941a15340237d0727c21a360c54e
SHA1 c4e3e6961b58e94a1d4084cb9766477b645e4685
SHA512 416a502822b2e23952e1884e7c1a56f146cb9c5a44492452ea1c1ecdd244def662426c6b9fe641a0e56268c05968c010d70e6e2721537744155dfaac3fbb447f
SSDEEP 3072:dxhFM2PVKoWcGBJEuatuw3LffUnBKU/F8enCW3iyVEXGey0cB1r:dxgnoOJtaj3LfqBZqenbyyVEd1cB1r
TLSH
T1483412B165ACBEE84374EF72E50B672A5FD04D7F0895A99804193F97768E358FE08C20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 cf804019e2fbe91231106e5d8f798bc8969e9fe75131cc772518a844d0d3f4f0
MD5 26b04ce639ef9aa5a2bcbd3f2b51f2db
SHA1 51e6973aede17aa0ee1ec28c9f667a42f614c829
SHA512 08df5fade5c55e8b00fbd33158f7fcff0e9ed49fa2a8fde11c15da739f85eac43c9b4dd54b97f753910225e45a0cb68a8b2a7f0366ca58ef5740269a73c18e78
SSDEEP 3072:dxNFM2PVKoWcGBJEuatuw3LffUnBKU/F8enCW3iyVEXGey0cB1r:dxsnoOJtaj3LfqBZqenbyyVEd1cB1r
TLSH
T1603412B165ADAEE94370AF62B10767295FE04D7F0C55A988041D3F97B68E398FF09820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 0bc650e0bbfe6c34eb9f24a4f3c6f22b269b38cbe8647e945578b665be61c871
MD5 8360f5bd8b36823da9d093bd1965b861
SHA1 08940a79eb514696d94c008623d01a746b4a7e15
SHA512 5bb37794f22a5a662dcf70f1c4bd9b92c14315e67d60370e6e1cea70473a6d725abbfb7eb0b259d8a7d95051a722d6462c5ed7c3f4a8b9ae4c4576de5b41554d
SSDEEP 3072:dxeFM2PVKoWcGBJEuatuw3LffUnBKU/F8enCW3iyVEXGey0cB1r:dxJnoOJtaj3LfqBZqenbyyVEd1cB1r
TLSH
T1CA3412B165ADAEE94370AF62B10767295FE04D7F0C55A988041D3F97B68E398FF09820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 0a00434b55fba3904fee6639566206e24663da9c85589c5ebf94efe62827a3fb
MD5 4475283a0ae063ef28cb7e4d48c639ce
SHA1 6dc7433ee50f8d785bae5b9ead1c07b43600059f
SHA512 361ed89d2a0cbe34e35715bff39aca50efed1a550550b36d41fe9945b4f87760d300f9a06fe8a987d9f3e2f538950b0c525c6658a10abe4833b1cd5dfba7b4c7
SSDEEP 3072:dxNFM2PVKoWcGBJEuatuw3LffUnBKU/F8enCW3iyVEXGey0cB1r:dxsnoOJtaj3LfqBZqenbyyVEd1cB1r
TLSH
T14D3412B165ADAEE94370AF72B10767295FE04D7F0C55A988041D3F97B68E398FF09820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsjC17A.tmp\modern-wizard.bmp
Size 150KB
SHA256 2079f7a3eba60e0d9ee827a7208aa052a71b384873b641de5e299aeb8e733109
MD5 52ff52eee3b944b862c11c268a02c196
SHA1 8d041966e6fba10aa5e10ce5dc1dc5175f11b2fe
SHA512 2861ae5a06f8413810947c08994f4c0da54a1acee8c4df72cd8b03a9503b26e5512809f8d70fd584239b04a651e7329a701bf7ddcee2dec2c2e14d05ae74f220
SSDEEP 48:EWQsvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvW:ER4N4S/992/zDmrkVIe1ULo2K
TLSH
T105E3BFF256769258E29113445BB4394CEABF7F8A1A209893DE72FE56DAFF134448C00F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\LICENSES.chromium.html
Size 14.4MB
SHA256 f9c475876b01bb4d654b8f630f11219cc96198efe91d7f2602a97f0f3c86c3cb
MD5 bfb383dedf6aaeab3061c79362a85ff6
SHA1 e536a576ae468795949e3a124b7038d0a9c96510
SHA512 963a3f806237ca758361cefd5b836e51743d7b4c350b75286d8387a20040f9ea05fef0d8b83ab6f35e312309d96f33ae3c1cbb1eea99b6b9c28c6d5e7c212476
SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDGKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwBeXEn8mb
TLSH
T170E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Obsidian.com

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\Obsidian.com
Size 22KB
SHA256 0061796f2e869d91fc33ff94824a2e65dbf46d73fcebbae472fd13bf457dfa4c
MD5 1cbf21e6511d9004e6c1568537c455b0
SHA1 eaa7dd5ad68fb2cf40264b8847d9c5f1312c2e4b
SHA512 c235bee93f496463b3eb18aaeacb2f88fdfba26001e5df083cb6f0f8fc2264ae2b815996ecf33de7d0e4804f5f511047203908d1884f34dfe1639f6c37eeea7d
SSDEEP 384:wedpxBbXE9Lrj3nAnwDpWnAnwDpwXa/rl9qX2Ip4LTjdAA1m5wM6ZENsufjUWFgG:ldpxODK8pwK8pKKrLy2Ip4LTxf1ml6ZU
TLSH
T124A25CDB4A385017FE976E7186D4EA53BA7CE7E32960C5B7A4ABD1C009533C2F704229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\chrome_100_percent.pak
Size 112KB
SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
MD5 e7bbddff3081eeecf7f56e76ce1d48e4
SHA1 eb83b418ad0e8f502f12a339cabc2fef8ec06cb4
SHA512 2caaa851d095d1a641b959cf092a2ce02328298aafdfadafc773eb0a0054054ae54c41574328694f6a37928203509a0c7e38f3beff1f4fd2ded00b5ed5531d85
SSDEEP 3072:z84PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:zRYWFUbGz8LI1TnjQBQCrC
TLSH
T13AB3D0D7B7B0AD7DDA474BB783560170FCB30B2D0682120A5A99E479653AF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\chrome_200_percent.pak
Size 182KB
SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
MD5 1e1744b9410d29e7d1ed28c4f67d6317
SHA1 4f3fcf3db1f8a1eeefd5a4c2f3f2d2b34c094a82
SHA512 10fbcc89ae3251f4c163beea1dd3a53bca239486e1ed7a997e9b04d3a6193266cd96db4a1f8b753942429305ae9ee28b1e9d3fee7e2ddfee847a4db40c8cea93
SSDEEP 3072:dl4J8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:tGQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T13804F1D373B8AD3DDA570B73926610E0FD7A20291EB3110A5A9F98397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 5809a3aafabc10d58bbe86f0050b61e33e7c093674dff827e1db0236c1caa7a7
MD5 874acefea5601a707d56047ee3dfe843
SHA1 2afadf5d2800154822718a6d761d8b5d072b98fb
SHA512 5ee93165374ec2ea6562cfc22f5e21b3c250a0fb197f1c46f578614a5d79201d31d5d9a9b1a38eb38160487bf2f21cb381b0cf815dcfb91251ff3e1c1cab5a9b
SSDEEP 49152:gSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxq5:ruktcrfNlTyj5byqS6
TLSH
T10E268D5767E840E9C5BBD138C687931BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\dxcompiler.dll
Size 24.9MB
SHA256 70f7f28e3d3324f23a0dc52dcca8e60c33dce5b73959fd6ea3a18593b45865f6
MD5 7f590de4dcd69bd7705027de2992a9c5
SHA1 199804588dc0ace68072183e060f2c427ddbc8bc
SHA512 feee80058dddf5b9496d84db433b2b581a063e27b6fde8664eaf711a66d7ff263aa595262f5e56f6b48a22ac4450178c5c9135557a4da21ba6673e1c9b43e925
SSDEEP 196608:8+kiCf+BWW8fUA4BejnQI180uNJSf4iIJwEMWRsKtvUY:8+kNf+BWWyUA4Qjnw6+RsKtvD
TLSH
T19D4729122246D49CF059C878C3678626CA6C34E73FA779EBC0B461252B7BEBC5B39135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 970110d905a9e5f7f6b23f3b2564104ad37b6770cc3220e8a7ba3e957e6450c4
MD5 89e30dd117d489c04cdbdefd9b2013a4
SHA1 88c48d7ee5fd2ce62ea2d659b0b12c098dd7d10b
SHA512 dee881e8d3ddf1d613724ed6785225d9adda8800a24ff18200294a5be36fbefd89cdbd9b71a64acbdde25faec38235a4ebe837b41990e597ca9e8ac7bf37636e
SSDEEP 24576:bY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kad:UiTMYxy0Sy66Zh7Sh/cyvS5T
TLSH
T1E9657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 89361695084cc50d17a35dc8ad4d7f04616f004c172490fdb7716b228c33a15e
MD5 b780af9057f16c47cff5d416a14c0abf
SHA1 5638d3b76e6ca4562096e60cd53c2e0cbb73e09f
SHA512 2ee101ff9205891ad9d54c03794ebd64806eb0b53f4665b3416c8886ed98d4aa148c68e47e5a33ce848585f4af2b4160396d2527d6a3745e791887ce04be604e
SSDEEP 49152:aESTAZFzTxMIP29EeLfptJrj0vVJA8ANdZGNxcO6IhgiS9Nol7WtaRRqSorwIaGi:aDaTSEYht8OnZGNxcO6IhgiS9Nol7WtI
TLSH
T16AE5AE03F6D650D9D029D57197AB9313F631380A4F2056EF2A804A253FA7FD86E3E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\libEGL.dll
Size 507KB
SHA256 d404b25ead5034acd0b589e2d2aeb0443686f3dc4093d77b14da03c3c1c5c659
MD5 48cd57bec36b7fcc1908884d55339f2a
SHA1 96d359af6219236d48edc33006ff9ed005df2081
SHA512 87c65ac7a731bcb8a3971917f5ef82e7ee48f19ffa48aa7b27c658fde5da9ab2fedc13c48561d5db87279422db6e0aeac7fe28775b3d5dc7d71ce372e915bc2e
SSDEEP 6144:ytqwvC8uRreZw/ebZyu5sIAeoZPw1ODZ6R3/8cWqR/H2p5HoSAhg:UqwvC8SrZmNEIsPwa6R3/8cWqt0HoSv
TLSH
T1A6B49E05F3E945A9E06AD4348B538603DA7278570B65FAEF03E092792F37BE45B39324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\libGLESv2.dll
Size 8.0MB
SHA256 242f74df6fcd27649469a33c28f0198a3e03f8dd94b4477aa5ff37f8f0205b64
MD5 16e71f0fd0b1111747511e44e4e51364
SHA1 f3833780ff857448e1f5ebeeb6d775077311cd41
SHA512 c03b466fda63ad125ef2a7f32d572f61f65bb3a7fa199ff39ccbd4dc7c4f0aa23e906fe95d33a6092823ec5eaaf781426bf7052f42d987719c51a392ba6291fd
SSDEEP 49152:Ch+XpQjxg3kJjrCtf/EbJ2npdfPHn7VHe1yTveomnSfb+5LDrpRXJDysxrY0U5Ap:OLQXVv/f+vplJLdPCuAYT7tc3Vi84
TLSH
T162867C03F69581D8C05DE2B8975B9227FA31B8490734B6CF2AA413152F6BFE0A77E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\af.pak
Size 568KB
SHA256 ca253121434ef430661c30672e1097e6d238e42821585b700776b56977c05d97
MD5 fc774f629eef0d028ef6c0d759b86176
SHA1 8a57809eb22b2d77a2b18ad1c12a17698c512e69
SHA512 ea2c29892c7313063512d4223884e5301ddd265c7299a93384ad1a7d98c950db52665063671242ddb6f2785dbb48d26439b423b12d41055484791414fea07b64
SSDEEP 12288:18abGwqRXxgtRGt+vW5RwONM8KuY3GB1sz4H2Jyn9N+saAQGmQo0v4JIAga26F+C:KaPqRXutRGt+vWDwONM8KuY32sz4H2J5
TLSH
T1F2C41B0BE781173D09B07696FA0845B7FB9CA26CC770B2BADDA982310966DFC11BD1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\am.pak
Size 921KB
SHA256 1f126a64a58ece296209d24c36ae416e3187996765027b1198ee01dead17394c
MD5 e523ed0f5b61632b6bcecdba23754417
SHA1 e146bf586f4b0d05732ada8ef1db69d750ef5d24
SHA512 444e540b31e713e0c3c354cb8b6d7e1b6a2953fe7290210ba26f05241c31b6d0f49ed818ddc438754403e7ce0fb06af4e9be6c46e101da6cf96bef6082d58d4a
SSDEEP 24576:tC4KpTe1jEQhTCMpyGvxVdDSjyc8TzeIXGf5530iABV6zZUPhW:NS5l
TLSH
T1F215AB547EF9F7570F8E8A19A4320E4E9594AE4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\ar.pak
Size 1016KB
SHA256 cf46d1687d01d8ba58512ea7082aedbaa14ff0e748eae295fbcdae464b271b77
MD5 9236822ebebe58d5931cb3abfa59d05e
SHA1 a28c445ee0f9ba804f448d37ca7da3720d664f28
SHA512 368fca3153f7130b3fa76e373a1574a0db440a027697651c8ae075804c78d9d50a6d98c0b7d4edd13094d1da6c332a00ab943893b3006b507e491a489b457e65
SSDEEP 12288:8yq5GPb4BBjLVHTLG2awjy8u+7v4UDodMqkMZS158qNjpPEKLLlYy:8yvm5zE6
TLSH
T107258BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\bg.pak
Size 1.0MB
SHA256 f2a46c4ee04330ef49f6acc62c26ed7ec57dfe124aa386e08c5b582832c4000e
MD5 934193d485de19986de7e0277c139cd3
SHA1 387b3699cfbfa62fbdeeb4f6d9b127df0eb7e719
SHA512 d3516bb252832db4573d38ae9d6ab63db4a5988f49f92fbcdf191a12d9be078600dda750330fe66286a89dcf614864191f60a97999e66e317eedb0fea75bb8e9
SSDEEP 24576:qDcOWNy/LYJzQkECtUrVb6tbGdx373ZTm1z3GjK4UfVDsMX74u2VZsxI5e468KtL:XOWNy/LYO6UrVb6tbGdx373ZTmZ3G7Ul
TLSH
T1283524A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\bn.pak
Size 1.3MB
SHA256 b4ada9665be5c9d9fe4254bff291978dfb50c2b22a7149faf9b9c3f470f0d32f
MD5 22f36ee63dd0e66da673a95e85352e1c
SHA1 65ea5cfaadabe5ed611a20f77d816b1f51aeea1d
SHA512 98b7661cf382ab9feedd09c074b8fa458e061633b250e0dff3ae5417fa7ee43f950f3952aecad8dc6d4dc8ece3d7f4428f4440acf03b525850476517ddd53efb
SSDEEP 3072:xlE7CdT2+xplSGuIpdJ5259J9gJfifHRbkWvLypUBbqVQL55BkwuHX:xeCdT2+xpsLIp3UkWvLypUBbb5UwM
TLSH
T1E755EF209C6E81B6A8C5CDC9434C6370C523AE9B9B61F74DDC17A14938ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\ca.pak
Size 640KB
SHA256 252c097b90fc3ba9096c519a6ab2e91b441f11cce65c7c47777542959dbf6c34
MD5 10db08caf10e1b1bf0570cf1b765278c
SHA1 914c5c8e9eb7cc7e718c16036025199c6dafd0bb
SHA512 e62302f4240f5eb5c56ec3f6ffa7846a562c02628812e70880f86818a061ab5b29197fa677c72f78bad9e0118f8de1e3ff13c223ccc6e54a2356dddb50caf343
SSDEEP 12288:YTW25sL27hjGlCiGh3UQU8K5PsFYN3Mw2juwHzejm0t3l7b7T5+vHcwTLT/fnWyN:YT5sio4L622l8MN2M0K5MYwUy
TLSH
T163D408239FC93B7704D2330EFB46C217A48CA9847B16D254F4AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\cs.pak
Size 663KB
SHA256 5e9385505f9507d4a57f7a5960ceb35b5fba92c662b53bda4e4dc0d63245059a
MD5 b5daa2520a4bf24cb6b5298aa518f444
SHA1 6255446419fc78dc365267f254e7cbb5f5033b40
SHA512 000a7b9512ac05d027c43c80d397efc0b082305fcb52c499b587bd0584c54ae3794a4c74fefef9c7280f1cfaec4d21696178a5ba52815f992c9b5fe3df5e6899
SSDEEP 6144:CWEvFuhf4xp+EHbF2Pw00z35AtYJlA7Af5Bzp/GZ8OwwJSBW48Qz:9iohwrbF2HO35AtWD5Bzp/GZ8OLJSV
TLSH
T1BCE4391EEEA36435584002487FBE4128BD6E83140B6EB9AB7C8F9D91257577E8FF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\da.pak
Size 598KB
SHA256 054849037db8f9672ab80606dd7163f25b18710ee7f777e7eeaa68d24447aee6
MD5 f5e55fe7f2cde2968c0d2d0cac10dc36
SHA1 4c93a1eeced587dc5b01d7d8e3a063a5a2a7b4db
SHA512 3042ee29efef6d8c580758c623173c6fca5bb6a65779f928d6c1e635bccdd0f0c0528d1a2cda4409a1be1c25d6f0006cef3bd6982fafa0400c784890681494e0
SSDEEP 6144:sATJBS1qVIQRMNiVzVIv5MwHJBE/evTawlAnsJwOgobiq2SaE5dtfwcYsghHLd4E:sAIiAHVTe9q5dt4nsR8
TLSH
T1E8D45A4BDC9C732FC9A90725F3118DA7EB6D543CC684264F65D8943A09CBCA097BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\de.pak
Size 640KB
SHA256 404975e6b3af1f4e40be3905da1850c3e87e29bd03d0866185ff85c06861ba68
MD5 a63e224a1e24b61f3acf3bbdd212f563
SHA1 17e6e42e88509e1aca6ec87a0d5e936633bbb5be
SHA512 7db291bb6df49ad037916d31244636ce588f851b7e2d6e9b5c05bbf9199377a45f852ec979fcbe40b5810c0d8f2b1fcde924d7f8d1ff4bd33a3778dbbdf07a53
SSDEEP 12288:ZyDS5JG/3K7Up+guafzEmLO35aSUMUdChT:Z0S5c/3K7Up+gua7R650ChT
TLSH
T1AAD41803ADDF625ED68673617305CDB77B19E36BC342322788EDD12B614B5B283AD422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\el.pak
Size 1.1MB
SHA256 dc27d24e9afd24124abca6dca1a362462851267902fe6493ff3165a1c5aab69f
MD5 bd76528a8fc532885ecb7530f543e975
SHA1 a95e9ed8e3b7fd6a768f37465cd66b09404aa156
SHA512 b9d4a98768a56509ebb4a55f1c2a05300e32be939647a0b3acbb45083930d91967c68c5a0276d5f57400a6b8a410c8d0289ee403d127e7985db502675729a398
SSDEEP 24576:rqss46HWFbrlK5Yp9Ck2txZu8OJXDsSHCmu2Od7IO2USUBx3PyjkHvFz4VoyNJmJ:rqP/HWFbrlK5Yp9Ck2txZu8OJXDsSHCT
TLSH
T12845CFEFB4582DED8046950785D8F07C2BC66D6CE749CBD86229CB60BDF80719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\en-GB.pak
Size 518KB
SHA256 ee6fc979d1fff0c1a4d6bca929691733665c5df7e7a43cc54f1165ea14cffa67
MD5 c66a0ee9892bdb1f511a614d432b5b68
SHA1 0bade47c568201dfca6982d46d44a64e44de288e
SHA512 c83f45164b07932bfb17204ba3016ef4bc2c68817f7456d9a25f807d0ffeb4c1eeb1d3114bac5dd3907332765b20ae0790fe90d54399b6e0e4733adc40e708c7
SSDEEP 6144:mCJMs1KdSc4rcuF4yVEMP9pQRIBfaYHHDjko5b0DG1BcERQu:1J1IR4/EMLQRI7F5wDw
TLSH
T199B43C1FF785126A059352A2BB0AA562FF22D07CB35112663CBD801C33B6766C3777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\en-US.pak
Size 524KB
SHA256 bfa782c9efae2c9cd2c0214dae1bbb3c259d4d4c38d920b06677b9c4cf4f813d
MD5 bfbb69222dcc50ca860b6a80a3da4f4c
SHA1 51200c9bd18b0999ba38033662c5e319485e7420
SHA512 940a2855b5de5f1545abbfed5dad0cfe81e74e847a60f65b4a8df54860649502062ff8941c0fbb248c203fbe6b883ecae8b21e91215b07c1231129a914008a28
SSDEEP 6144:njtGVh0jMRG0PTMP9QQo94faYQ6TFB+5P2jdnngP8/s1wf:jEVhmOTMCQo9+C5Ojawf
TLSH
T160B44C1FF744122A05A352627F0995A2FF32D06CA35112663CBD812C3376B6AD3B77E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\es-419.pak
Size 631KB
SHA256 2b728123b590c5570a46ec2da7d4e620cb81559629f933ee5d71386fa142e02b
MD5 b0a63cb56453f3ec942195e1065e129a
SHA1 5016eab186612f33a7241f842cbcbe80ca709cce
SHA512 ea61a557d626f91c12e22dde790804dcdf6d407ea623369fcb4bd376d72152b71648263f02d2600fd77b2655d34382be95f32ede24057bafdb891ccec45a537c
SSDEEP 6144:rsK6lxhznjoJYLFLnQ2FYjnmo5vV305ieSr5AAoRGCl:m1BmpVu5ieUAfl
TLSH
T1F1D4F822BAC81F5310E3A388B743D757E4989545B408C29BE8EB876522CCF8CD977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\es.pak
Size 628KB
SHA256 4801312dd5d7e3d62db05b8fe326d982f3887c65ac9faa7621009853c0d3b0b1
MD5 60abb63b7d0a231c361bb03111499b89
SHA1 e6ec3f843f199b706fbe7c1d3a342c667bfc6e7f
SHA512 b61b34f108e264bb24fdaa5c638cfb5afc428a1f28edde8a1839b6af84c2d6889b460a0e73a9ec3d3dd0d3c4e1041aab8fac7413e64863a0bddb6339542207b6
SSDEEP 6144:b1YkJ88v4zeV/1uGbU5gtEa+5QhGcm3X8ji5JOvAJLlvJ58J36PZOW/:Ze8v6GbUy9hGjX8ji5AoJJvf8ho
TLSH
T14AD40822AACC1F6310E39349B743D753E8D89545B508D29BE8EB876621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\et.pak
Size 573KB
SHA256 488a91b53d17ca8b52e25f143197875aef7dd50e1bd51bad749f559c17f52aec
MD5 afe1f76bc67ea3886fd0d6ada960dc06
SHA1 363cb7d2713e4f286c3655df753108b8bc1dc5d0
SHA512 b5d178f2e27e751a173b2556199eaf7a3855dc537ddb76dc105e697faaec69cedac955202838b4288f562f154e55abf12a181a1bc1dc7a61a4d5d74d1200e97f
SSDEEP 6144:yc6YcUBG7nXh+f9jaH+KPe6yH07nFdGpNQvmdxIPOTQysogWUiofoflLXhS51Tqi:ybYGDR+MvPe0nFdGpUoPfljhS5Zqcr
TLSH
T1DCC44C42A27D771B182412F9E737E927DC9FE7D8B4000D9668974A1970EEF8C38B2B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\fa.pak
Size 946KB
SHA256 cfd05fb194e5c43c2c65e7803eca72fde4f5629e849cf2dbb8f6f62156485aba
MD5 71ac9af8d1deebd0f4ac15a2f2b81e12
SHA1 8c61c12860d220b0fdf2d0162ff95c53afac73a6
SHA512 cb9f4071da718edc0ae735ac087ae2329384ad34f11dcabe2af40ca19f8a7b83cc95160e3aa3ae88bd9a4f0dffe19eceb46e2a68903381d350a761ffafd02beb
SSDEEP 24576:BOoBOF5I8u313uyqoz+sb2vRmXnloTUoXtCfGk62Yh78ai/78MX4UOVU8Rkc02un:MdS5im
TLSH
T19625C1957AAC9AB15747CA0341E33834C773EF12D349FE40ACA1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\fi.pak
Size 584KB
SHA256 c04f5e2b7f30e8e350feefd6cc45f266dbeacf11837cc774c977bf76e9b403a7
MD5 4c9edf90a899707ff2ac97c81b5e61b1
SHA1 967ed2339e4a14147ed60d0875f16ea3d3cd480d
SHA512 fe80a1f6df3458e43bebe1f62203bf3f738055f4a13412c6ab0bc16da83b876b05c8aa89baa365a1ca7155296cfb3dbed4f143b89e4dacb98aaf50edbea1ab2b
SSDEEP 12288:ulx/dp19Tca5WaW5wJw+UURI8pvWamvaG:8x/25wJzId
TLSH
T1EBD45C915219C22237C4D29E7DB0903EF5E5E3DCCC284D9AE843C7D849EA9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\fil.pak
Size 662KB
SHA256 48884f90e800b0b0803ddaa0bbebbea1292bf8e1bb5ee8f035a79371bef7ac2b
MD5 4fcaec162908f63d6da009e18ad83539
SHA1 953d1748d721717dd7ad7f535764a73bc6a4d616
SHA512 0ca395473ef66ad1142c5f6088ce90a534f7eb45fc9e9e5acc32eab5f371571679b2bd6538f09c5223a82558371cd247182f4b64624cc507b09f2815daae1c19
SSDEEP 6144:4IC7/okacr/Er9FFfNy4DQ+ZyIWltRFhsAcJ56SGvla9boV8A1cOO:Hi/aO/ELn5yvO
TLSH
T10BE4C61577402748DBC352E55360A82F6AE560B83F827C6E0FBF269B7BA7CD5D270182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\fr.pak
Size 682KB
SHA256 e311ebdf49828d313760453a01ad1335bac955b4b8b291accf038714c91ebc03
MD5 73896c5acfb23715348065cfeaaa95ca
SHA1 a5faac8ea692e1dbe6dc667fea32a1a6ad8f845e
SHA512 4de8e3bd5bc4fadf655536b5285e4f5f570236d3c60d1e52259bd1d7568415f9c57816a97633d439eb36e22ffcdfd46913465dc827ea74ea3ae1e2b3b0ec7855
SSDEEP 12288:Abw5DvTZLAqb5dZb2Z7R6QuaSVYLyH81ezQI9kiZuYnY88jw2wTxJDzLmdxSm40m:3o6VmZf55M
TLSH
T1D2E4E66FBAC431CB19C60277FB16D663DD348248F215E340D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 11e4ab3cfa421ea0d4d0971b038a6e7a254094fa6dfe9b8f65fd1572f36bcabb
MD5 d76f8c03323625db4edfee35784da1be
SHA1 af7cdb843bd30ca234d81cd9c593c87709aec30c
SHA512 3af2d086b5abb988b2c67037870c1d2a9cf68ace232d99cda47b93d2639adafed3bc39300ac5635d7028004c2d3a327179be90568e27a1a1a6c7869f5d76359d
SSDEEP 3072:/sKn1zW++jFtt1Ib9tPjAwREJKVMjNiT7llj63rAulfcSi5NnWsWi+/GQoy7vBzu:/sCNWxCbjs7z5qCVCi1ssLw
TLSH
T1BD5518D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\he.pak
Size 829KB
SHA256 30409b7264418b9b9852b2419669bb8da6f489b58d4eeb1007b39d5cc978621d
MD5 2fe5716790acc2234910947f2501f387
SHA1 062c54e342088acd61a8cdafc6a2264235c54c94
SHA512 57ffdc66c062819d8a5e2edc82d04e626b1ca00e5528f796e46e170c29f69ec89a771d157799ed732fce31f97bc2f6001b559471cfa84f8ad0d1f932fa4bbe6a
SSDEEP 12288:wGrhOF2GrTmoBrAfDuBAlGWq+/1J3GIGAACXlXeQCaj35RXbN60jsXk5mOmmrrB9:l5j62
TLSH
T1BB0599C4B2E452255131AAC39FA5FA286FF3CAB53CA27512CB14526CAC774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\hi.pak
Size 1.4MB
SHA256 59ae1278d1b58da7c0a11e5a23bf69ea31c674aebbc24fcd537a84769efe9d69
MD5 116a4f944f08e6005b792d89d3f0bf96
SHA1 b507dc68a7f86abe2db57dedf3b04a8ca7534acb
SHA512 f3547fbc2e28a34f7ed849f05280fc1ad13c0e81cae85e06a89068bf8b1c1b10901fc067b3c066d89640f40e82236878e365d039d531d5ab4cad3b8535626d41
SSDEEP 3072:eUe+UDOnh+DI6ESjQrcewaV/B90ZV1d3uGlqvN3dgNJEdtDVeDn1s4f4/BtROy4N:8+jh+QSjQt/+U5pAndKtu
TLSH
T11165050CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\hr.pak
Size 639KB
SHA256 36d9939cd9d89baae124fc930cc050e386df2b8fd0eda0fb48882a2929b94a76
MD5 8ca2b00eb3f0a1aba023d6bd80b0df03
SHA1 925a49d5c63dfe2a5a4f235bb31007f060751ab3
SHA512 df5406e2cbbed3f612554c2a13c71211c0d8883f69b96f0116b5044ec8d8ea8b39bce572f158d2eed52fefee9ea8dda684987019f78830d2b2deaafcb379cdd1
SSDEEP 6144:krVaCiySH1RnvXOKDOYE/5wQCOR7PrzpJ:kxZu1RnvXfM5+O9pJ
TLSH
T119D42A7DBEF3570A0897B34AEFAA434479BD08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\hu.pak
Size 684KB
SHA256 501569c5e74285231b41d067e0ea28972ef0ab7b269886485cf1b42cd78cbd1d
MD5 b898f99d79360f2bf2ce506c324c25a1
SHA1 8805034141ac3b138688d00bb8ffaec7a5033f68
SHA512 bf55f3b15964e346e9b6be757de03fa0c610d568428d443a55135c8a823e71ae3c7bb99ef40e429950e601ce96ad8fa2b68d7fb482c785a10c5dd8e52b76ae23
SSDEEP 6144:MddbPxudyTpVHiLlw5kgWA4ZtOu8U5UTt8gZ494rYhCi/UtmuFNer2EnjD+54RIf:MdVPELAjU5UJ8LRa5Tys
TLSH
T18FE44BB79376905ABC6C179778643F15592E481BAF2B32FB2883846D24A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\id.pak
Size 565KB
SHA256 09d4dd7cbe4eb1b7730a80a3a3cd0606139f4b9647b0a04b49314638680b0a31
MD5 7bbdc528c668aa0994417aac9301a718
SHA1 71a6c00c115c5c6ea01d8f6258f141e5a35c70c9
SHA512 52e742e249f12fa3185c961e91c39a290b8ffcfd4260d9b502b90608ebdbbfeb834a43b150a415af76e84a0527c7473da122c6e857ab12b4e0c87319f64d9c6d
SSDEEP 6144:4pNXRs8aNQQ83ZA9tK4AfjzTFjlFtXmBmiFp/Q25R61lKOBCTmWiTv8oyHu:w/vaNI3ZWj8TFjlFlmAi75R61T4u
TLSH
T1F4C4E8632ECD310C094842D5F2DDAA1E7CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\it.pak
Size 619KB
SHA256 901a28a4cd0b1d545f0c2e4aa54914029adc03801859761db30c81947de63f92
MD5 5643e0b3864700801fc4a1c59a1244d5
SHA1 2c7529e034bf04589ed52a4bafc5123d7f424910
SHA512 bc60b4df1f943df74a93046eae531ad8a2eb7c0186a8df9c5e9b4a09b3a3466f8b3e8f0246fcf53bf819e3744599519182bd9a3e52d87e683fa260b007002766
SSDEEP 6144:ct7Hl4tBXWx8miX97+2N9rYS/qBRRs61wtl/RT9TbOKkg3gCYrqdqpzSj9f3wBYE:0sGMXZZ/K8YM1CWkb5PkSlxVr
TLSH
T1F6D41B3AA5D6212519976359E611B085FB6EFCDCFA41721CC99B031C22CFE80F2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\ja.pak
Size 754KB
SHA256 8250b4783dcc389fa96fdf79e8188e439ffe5fc01325f32ab8c322c4d27f20a4
MD5 830a7cba279a3deb42af3e23775cbc4b
SHA1 7102caba0d73d48af569d6c9877fa3955fb778b6
SHA512 e0277e4dc6a1f603a0ffb40e7e01dace0f49604eef6aa6d4fe554592f7366af490b84c6d7b823ab61fea55d335437f69ba04502537a3d90fc704a741b6633b2d
SSDEEP 6144:mnhlmdGBTZTDm1CQRdMfdV+Z8Q2E0uRUNbN5ziIy5GzV3:qraGBBDTyO+Z8Q2E0sUj5zVy5U
TLSH
T18EF44F7CE3C969369D6152A22C0E36E17506AC5FFCA23A3A443DC074BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\kn.pak
Size 1.5MB
SHA256 847c5e6abcddf120b4dbc34e28dcd1c2e93f94ab1d6f016d0c1504a58cfd5b93
MD5 4183e32193ba8bd36bc421490dfd0959
SHA1 c3c1ea138dbe32969f10f3d25556f381ec1e3688
SHA512 06b0fb8ac6c844b3efa6a26c0af5e295d0074ec78902bb7c1767191440176a60367e4deb7ff527284c12b5de22fe84e943967e37a6baafdee798d7dc2b642017
SSDEEP 12288:BiHflzAE1TS7ZhbUqZMS1M7P5JVHM+4EryjEi:BsKQ5nMl
TLSH
T19A75CD18ADBA7D301BD5106B24EC643ECFF16BE29CA907C2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\ko.pak
Size 640KB
SHA256 b8ecd18ce8601686ef64129c77f5307d0c60656d27eede7a23b4f3947647b302
MD5 577ffa9acdca15ad31b1bcb16814d4cc
SHA1 799416720afe209f47355542cbd6ca607a965df8
SHA512 01837e4a84bb4eef059bda5ffab9bc4bb7d3b349bdb3a11d7d01471f1d9afec817a26925255078c62dbe05b51a8aff4a652a93740a1ea8833d3471b7f3f535e3
SSDEEP 12288:47/T8gEgukiPM1WNiPszcbifYj4ZGRy0IeYs1ubLwLCMrI01xWSJGRG1zLhwEtFr:6/g6Im3R5o3uHuI
TLSH
T129D4C5F23CDB63C91193CD82AEF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\lt.pak
Size 694KB
SHA256 6d648211ff3a6801e049c9a3931afaf3007857b2872e55ae11e19849180d19da
MD5 bf8e3fb7d28a72a7064e593c065e2535
SHA1 127eaad62f1298643dc2b2558f24d18a24eb7355
SHA512 930027bacb01d41124167b326df40d61e7119d81046eb289ae5577cf5bc492762bcb80932dcb56e4a8103d63fbde11873b1477af627f159e709c9fcfa84771ba
SSDEEP 12288:zzffIIZg4oMwQSY0PrVKrY4bi5P7MIAAJP6StA:zzffIBM0Bbqi5oItJ4
TLSH
T182E42B0069E3AEFB9A4467C981A4CA78DEFD50009767BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\lv.pak
Size 692KB
SHA256 0c0663909339a1f4edf09355a67eea0fcfe821c78d4891604eee31695ce20b37
MD5 247ff0976e6756e17f3260b19ec59ff8
SHA1 a42f0145d6c7422bab290a7552155aa8b420e515
SHA512 3ec584b9b637a5554a5ee1e182851dd254f28d1767b582b1bcf81b0c4096a0ff74487f3153bebce2126e1de05c813cb0d1b2dac251d6fbf3a71abc486a6fcf8b
SSDEEP 6144:5mjmTu+M7F28kCybaFGkrNStVFxH9KGz8mQWQd5VbONT5rmNnaERchTyGisHcAz2:1R4CCywMd9zpQHINT5UchTyscSx5S
TLSH
T16DE42B959EC68FA94D904DCA733AD132A8CCD740FE07E112DD7D8B3A650F52822B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\ml.pak
Size 1.5MB
SHA256 2bc35d18af85b3c7004a6e1e02591f5db4430a2f334f5c4be3c0a0e04837d9ae
MD5 d2faced6115180461f01ec5b37780721
SHA1 04af518a359396406efe27062de502d72a0efee2
SHA512 cdfe605367e5a2ef4026d1a1805f932397b161c28e37673be06431494bcecf4757aa4677d9ea38659e40a0a4dabf482ac4598eaa430ce8ec59cf26e6525567a4
SSDEEP 24576:7zVM/oZAuuxyYl+9y9XBkx/em7KfyBR+zXcj+v2uiLl3751aaiAD3e:7zJ5g
TLSH
T1F5759D5BA036CD3B0FD102167B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\mr.pak
Size 1.3MB
SHA256 5dee369e9366bfcc4fc95aec6c58b915933efd72c718d56802e35e8af5a880a0
MD5 83769844b688def4c5a1f4ad810cdf03
SHA1 8280d04751f52d62397fa9eb0fd73811cb331344
SHA512 15b1bce67685c1a3e250f89c70a6e47c16cf1d78cc089c86bbc342aa047ec248db71a0ca0cdf00d1147341289b778ae280d0d29932f673bbc65d79736f28079a
SSDEEP 3072:zDvYSVM2ENIGC6dN5t1iIh8roTsElUrX3iWUVse0NF05HwF/yGRR3R5EodxEdY+7:zTfM36iWUPuH0P2Qt4P45tmbAy2
TLSH
T1A855C24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\ms.pak
Size 595KB
SHA256 5af99080b311e15a19f9988779a1cdd939a7fb9b98bf093fca324eeb58b39602
MD5 ec5e67d9e72519f3a1c7611ef1919a9a
SHA1 eadf0806da3c5020ded53cd0a0a2a16551aa0de5
SHA512 3c5101b115e548134ae8c1b915305b0cbf81b955a63859def2271796353d7a6f3441c01956fa3f6eca855c40febba666b6c11322a9dd6399918bede5fdafcf3f
SSDEEP 6144:l5PzpO9dhf94qE1XJHxze6L/rg42Huqwo9O78AVzZY5b4tVlqL3VDhh:ncjqz1Rx66Q/HuqwoWfY5GlqF
TLSH
T130D4B6469EDE3118085843D9D2DEA91B7CDD3332B705AF2B4DB08FB0126E7A53316B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\nb.pak
Size 572KB
SHA256 11e798ef612a1d22b90450c547998bf0b23ccc4ca5265f27f1924c8b09f22937
MD5 08d67d2d33fbac45ccd9d09f86f16d9a
SHA1 1537998d712de4d4936a00df571d979f56523ff7
SHA512 df267cbcaeba56aefd906005c11fe62ef1d697c2e0213bdce1fc24805cd20e384ea213da0c1255e156fdcab3ea59f4d2b200868a6d02e8ddf9f4c1ed878b95bf
SSDEEP 12288:Qzjx5QXbO2jOp7fI4R36v3qG5wmNBdls7FDu:uxmOes6v3qG5XNB7uA
TLSH
T121C40883EE46B72EF2A443A4F519855B9B7D942CCE98199B54CCC63E0CC7AF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\nl.pak
Size 594KB
SHA256 bf2a7d52d8c061b5f5543e7c4e20b4eac96e65e02a967752af873c3ec30034b2
MD5 628efc38e167f553e6ea4e46fe77c112
SHA1 44734e1804e10bf0a18675432904ce2689293064
SHA512 200ea89e0c466216af6be2d029c057c15b3afd5e48287fc978d551b14116f41712289fff86234e5dc5f7e33260723a5b4ed0a9d48672d0d496bb5f8d8935cd9d
SSDEEP 12288:KqKspUlbJWQusNUSX/gmfex95bt8ysigqHgGfDTF:KqGlbJWQusNUsfex95biysVqHgG7R
TLSH
T155D4F907AC4E653E59C0A349FA098FBBBF2ED22CC26CE67D94DDD5340443F6842AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\pl.pak
Size 663KB
SHA256 7a464e196878d304c7358e7ea457e5d2a17e3065ab02f29b8402803c401d747f
MD5 879a5773cc682f1d557eef24cf02c8d4
SHA1 eda4190bd8831926b8736d5f7d86d1c84228e52a
SHA512 1a2c9d120136eda736fcbc30a03aeee3ff5f23c794bbff63b384299deccb65a378cc6d2f126c625ae29fe968db842a2b39692f112f472baedbac7ba83e11c939
SSDEEP 12288:FvPTW96Z+wKppFwfQfuzSJabZLbEYPPcCUdTe3m4U0hMrma1Qh8j5Ra7FolEqtT:F3Ti6ZopPYfhM91Qhk5bB
TLSH
T192E45C0E5AE58A4E8CB008E6F2E70B7CACDDC808F109D35FE45F4526615B19ECABE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\pt-BR.pak
Size 621KB
SHA256 6cb59658b372d605c4dac61711b56abf5555ed69e7b9ab0916f9185af48e66ec
MD5 51094db887fd87bbc9162d5521e22973
SHA1 36e3c2e2516493c35dbe11ba18548eeb7e2dec99
SHA512 c5c15fdf857144105f2d544f70a454aa9322e4e451c377e184b543d99f20ff5daeadde54694ab1e77385893f9f728cec0402891bd98da86571d73893fa24e98e
SSDEEP 6144:0D/LLEOBh0NBXBLJZPlQcy2Q58ENAhzgesRUJmMs:0DjLEOBmY58EAXsRemv
TLSH
T194D42C2A6ECA136604225350774EDB47E5881745FE0ACA87DCFF4F06A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\pt-PT.pak
Size 625KB
SHA256 b727b377a6ccf25952189c59ef175c213dd1e29e896b6b5fdfacd024c711ac93
MD5 ccd1baf51f76cf4041c5946a3280c5d4
SHA1 98d8c6adab3d8bff3a4339898a8bbf68047d8c8d
SHA512 b6233a3eb262cb16b4cd61302dda8a74b129af80596528289f47e3efabce50fd4e06b8ee6e39dfb3426851f191ee62d79bef2ed97757fb2da02f0284b079e7f9
SSDEEP 6144:kKrHqVBc1X+oYpStieJVJJxhbGDLfbDGfDUh5snsusGMSRTd:klDe+oYbxh5sns6MSRJ
TLSH
T1D1D429286EDA136605135341770ADB03FAC86655F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\ro.pak
Size 648KB
SHA256 205ea8cc0b368426f06c533b636a2845e66e3f7932aa6a680645e79de15edff3
MD5 06edd53ab148c98097b5970386e2f9ef
SHA1 c1cc65de8cc69e82666f7fecbe510de7a9f8cda6
SHA512 9bc9a8b34bd6be4bbbe959757c23708aa109ca476727686c5cf4de295c596bd96ea4f226b2b93d04fe0f67b9011f14ecbd3648e967fa003b9b1b26e548575aa5
SSDEEP 12288:sVjgzMdy7hjolyvnBf4d2/j5sAZ5Bc2/ff:KgOs5X5y4
TLSH
T1B7E44D23A1C82A972D5152B2B73624D3E88D105DF641E28DA4DEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\ru.pak
Size 1.0MB
SHA256 54f1bc4ffc72547a655d4737d2c7260a71794dda56fbffd13e6e8cc313c5520c
MD5 b000132c3da11a23d9502e879e35244c
SHA1 19d441ddab87bd2ae421b31196ecd2c9c1c158ab
SHA512 b3d43c43701c569060d3f5a942102d07fe7f2c76e7856eb4769f5fccd56aae9907c69e1cedb391cd66fe437ac92105a4e5f3d4d949982a5adb6c8bf72708f57d
SSDEEP 12288:V5ThpwfQeRo4YwispqzJ9sF+oa+UWXv6HzW/oqSv9s2WTBENtgA8Nb6dwYHyO3j7:ffcBW5eohP
TLSH
T1B5358760669E64EE1101F01BDD08BE0D3CEB45FE3FAAA31619642D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\sk.pak
Size 675KB
SHA256 eb91fe27fd087433da4d21dc1c387a816bed0de3e6a140b4597caa90f4921fda
MD5 b4438d51809fe2f1ce9b6dae65644de8
SHA1 43c5adb90d117414c9b21fb122e268c67513ac4e
SHA512 b0c49d7cb43680358ce5692079d27bac6b3e6a21ccd23182252a17775652e9c9b4fee9e2833b28798749f4e9e97b8130e5791f737fdd66cd909b9712adecc462
SSDEEP 12288:oGoBq77+NUAyi5i2Tj5Bnyf9YQ6+8pTjsxt9ia:oY+NKix5cYM/twa
TLSH
T1FEE44D3FDFE7181E8E8D0148EFEA7110FD7E8650864EB4A6944E324714E26EDCAB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\sl.pak
Size 646KB
SHA256 52426fb8fc82d1ed28797ccb62b7fe14f123cddf011f5d5875b076cdb0c33695
MD5 ac0a75c5b39b5d01894e81fd0705b1b5
SHA1 0bb293f904c9450e26f88b47462fabdf75f03d3d
SHA512 4c002d8206040e0d76f4b7c26cdfc75e7a86cae6187d4361f8b20cf071994415bc1e8f613794b3233d631faf9cc9705549b846322430ac3e0be02380eacf404d
SSDEEP 12288:voOLftUNcWtpeWpcB2BLBPHL5lbH80WOq9Myi/fzeDJql/ad:wkftUNleWHPHL5lbH8ji/fzeDj
TLSH
T1E3E41B357AA75E0F0C9AB28FFEB606007FDC044CD252A6A2FC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\sr.pak
Size 993KB
SHA256 92dc15bac0e96ede33a7055994f3558605b3147b890ee0414314274216dbaf80
MD5 b1c9028a635ac87124f958cdf762f9e5
SHA1 342a883649a11645c90ba87713619de0ece94002
SHA512 0d5f64e224bd84873bf6d1fe004ec1c79680bb29e6eefcde0aee7460e2417a8555b9b3816ca190039165ee6cf98b1171983ae99ffb08203f95b5fe956c483cc6
SSDEEP 12288:aBNEoTHMyfD0+z3nIAhuSOd8CC0ili4MCkHvj5YEZ/XCnxKnZ37GbuEU/k/D:y+oTs5ucb5JC4o
TLSH
T1CA2556B19B9E64DB0901F41BD808BE493DAF41FE3FAB975211601DBD34E10B847B929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\sv.pak
Size 577KB
SHA256 51f5cfc915aef54ffa11077d00021c99aac1c86f04076ba70f43608b11486199
MD5 fbc8be5878cf2eb9caa03249a2703960
SHA1 397a3975e8bfe33d4a569d1ec193ca1788f49b83
SHA512 80884b7f345add46c2d3949700cee62be1beb70e19c37cc6e1f37dff16b899dc483205ca487677f3cb7766eb736ecb1fc3d21480f2e66900e8df11268c03d3cf
SSDEEP 6144:iRdRvgh0hKL6Av+iIkQywo+nmHg2NxbINlujnLAVRFcz5RtGm0+SM49mFMuISOG9:UdRvgAO6W+DTj2E/5Mi/38N
TLSH
T123C42D438A10F526FBB2530DB609015F0AEDE15CE7E2958EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\sw.pak
Size 610KB
SHA256 e3bf553f18a0008dc5ac86e001a0ffb190f885260a7bf06feaf34822f0dde36a
MD5 5d8f54655b52c495469c81505bc70cf7
SHA1 1137cfcc672d04e4d042af5e9035807ad1ee4de1
SHA512 77b01a29418ba010d1da495692ca4a388e6ef3da808c337c4696deb49af364ece62b97cfc9ca89cc5375951611f6f0e19375cb9858f15eb152da639afc07b6a7
SSDEEP 12288:x1XijzUy72yxGC2qMrZ5CmedqNGjRdpvC574FqHKLC6y5IZSLQB4GFpP2NUiQlZi:xdinNUGFDi4p5WcQ
TLSH
T165D4D6629871E0191233518603DDFF732BDCED5C292B2D935A46BF0F218F98C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\ta.pak
Size 1.5MB
SHA256 d3849b163ddca28155194a3b68583e115943d087a4d0bdb90ea815eff618cb73
MD5 f940b7b57fa0f5bc1c10c646318970bd
SHA1 d2c84040cbe3b317a2f237d05db14a31fd1be347
SHA512 fd1f8762582e0dd34b0791b38f5220eee384a8c11acd97b37194563ba8e1dd96e844d13c2e963fafb7f999f3ab6698303baead64e789780097a88856987c38eb
SSDEEP 6144:XUBBTJI5LocB5aAkuWdGP5f55q3tR9Ptm1vYpiMyO:wTq5Ll4FdGR55qBtm1vYpiMyO
TLSH
T1CD750CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\te.pak
Size 1.4MB
SHA256 4038e8dda796e26e5101da4af24a2a9c212637fec1e7633458b821d38023751b
MD5 09af4a60f243cb0211a69c142ef858a6
SHA1 3a6e821cb8ce2362a093d983ff51b41f01cbec81
SHA512 408bcd2cf86965f1fe6d71d2bcfc2231fff02259b5ff755903232503600466e32f04370d43dce55cea6c2b732ff92f9a5b9089099322f67efa475dc81c82a3cf
SSDEEP 12288:EGJlztoiUy7McKNxywG6USF602ygIC8ymoRRT5bbiu52C6WuB6SI3p1FG1Y5/C/K:EG7aRt/5SRcO9
TLSH
T1E66592023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\th.pak
Size 1.2MB
SHA256 e4e627969668d8672cc5212b9b3a1f3c42fe0c5d90d15ee893ff0bce8cf7c2c3
MD5 2f2e7773c921c55378207f4262daf575
SHA1 e919488f38f46afeba97d0759c00c66bacc728a1
SHA512 347bf1308e9ec5fe18f9e0e1f30c0c56f1b629db99be3ec4ddd8d03c4b9f6e09b6938cb93ad385fe194441e4540c190e367eaa7785917a068e9bf4fb7524b176
SSDEEP 12288:SY6dz/wyzx9N9LyZYAozYLz8AsShukJUseTPsO5eXffpbDFDS6Sd2N+Qj4o1qsl7:54Iyzxg15Csj
TLSH
T190453BB37247DDD479441B5B262A7789672DAE693F73F8E00089215A73F071A8432EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\tr.pak
Size 621KB
SHA256 eafa2065b5dc4a3c95e5f0207fc31dc54f63aee65a8fe79925ac62a15161ee68
MD5 c7c5739fde8a8e6a74fc67fe10cc92cf
SHA1 9be5a3f6aead9c0a7d5fe6d688eece2d1db53a1b
SHA512 2bb59e05dc1499e326533b3521c5345b50c404efa512043ce4f908909242ccb8cdfaa5e12218ef9769bb3199b7a01ea7d4b364cb6608072f74415b5d82bfff88
SSDEEP 12288:yR597aXhXBQTw5Hz6sgwpIfZFR9G4pKkf5Mo4c:yJ7xcgKkf5F4c
TLSH
T167D4EA8178EF682C8BB9278FD6E90666F89F0766B331F4469B168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 4b65c4e32609f29eebe8fefa25b0fa861c05cfb51131d5ba64e1878666a0bd24
MD5 1b697e603f9828c5ad13e36afa829341
SHA1 f4653e5619ac52b79da8b6576ed4febff8f92ef5
SHA512 434e17983b7502743c2210bddf1679541c8bba9c0f5b715d8b77cc919cc8d46395449054a0b407e024e30fb661acc00d1f8aa6f90bd141e1c87328204d8ccaed
SSDEEP 12288:phbqFH3ijmrV7GjIwkkzVWxjvC6sSr+fQn1u6ChdiBEIKT3/5iNvcA6Qwe860Yuo:p4ZSyrkim5K8E
TLSH
T1DF35A9A19A9D54EF0105F05BE94C7A0D7DA701FE7FA7871625A43DBF28F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\ur.pak
Size 933KB
SHA256 c0d81e0446bae6d62b496f5268222ad53fe5e6f7325c19bdb7685974967beb3b
MD5 38e2b44e1d59e3275cafac4225896dab
SHA1 18c75e680d79c648434ddd19dd22a55fd49530ad
SHA512 a5a4dcf0c24538bfec537cdccb993032bb5947e3c7c37793f7a6204df77513bb8ec6bade6e832a6248c1e670c513a8dbed2a9e2f30fcc7d60f034500dfd94dd2
SSDEEP 12288:9uidSKoWw8Pl1eqtdQarI7yRbTpt5gnpEhjGMOd+DyQYrsKYjwadcJKwUduqco/r:9QI/5xGtu
TLSH
T1BA15F0D2E6B896B34A21D92780D33C34CB735F13D34AF285E56246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\vi.pak
Size 737KB
SHA256 3db088338da5890b390d6bdc047bd038ef2b2f3d982c74f546784895dd0d9b18
MD5 7772d478e416ee84286e591f5ff60c18
SHA1 1294bda5e37a7e02ee16a0ebe5937af99a5ecb50
SHA512 be88f4200d81916d18880160087a0c360c213fd4cd1356a691d00a525399422782e14fa39207d9c3ad75ed3e6979c6cea87342483b7ae329ca675a860b3a06ac
SSDEEP 12288:TQq+cyZ8oE1sVpBhbgN0+QYVN5OFWdjaMg3p5a8iVy7oIN1ZIj6l2eziuR2mfzqK:TQq+cyZVU0DFG2r5a8JFC+l2YiuhfzqK
TLSH
T111F4851216E1302680AC553EC6CE540D6FCAE42FF7C18FE56FF4297476221A46F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\zh-CN.pak
Size 529KB
SHA256 e0eb2457c1edb82ab19f484e45d3e029ad0c5b5cc07d68a82faf6bab55f52e52
MD5 0049a699318d1fcba473a12387e12154
SHA1 8f6395bd3c089aef2f69827e66eef04a37f241c1
SHA512 8af8059f8ade9df619068945ac9836a58b700fbbad2cece134cea82a5a250f93c2abd1ebe54390dc01bb1f0de93266661a86da984c325259b766e20f52966dd2
SSDEEP 6144:FJzyWdo7DRSkO1zik9nV7u8UkEZWbn5tXNIXp3IYj2EBxnWuY7lA:FZyWdoX4ziinc8UkEZWL5RNsYYhBUu
TLSH
T1F0B47DE910F9BDEC004650E03729613DBC41760BF66BAF366ED248DD1AA2FAD0757A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\locales\zh-TW.pak
Size 523KB
SHA256 a5847062b32872a9a9b77361aa1a1e7f8734f6547adaa62f312a78baf20ef5c4
MD5 41adb340e5e3f4ce714359af89247e64
SHA1 65279e638f06fb1f8270955ca2d38d1065cf6100
SHA512 ceb4473347ce8e9c0bdf78c450e93f70c89e36abfdc9b4d613e1c1e73ade52d65c2ec226350e49a32fc1d4752752fd09e54fd0a1fd2294fe1a76b074ab0512fc
SSDEEP 6144:6HMV/vahIDnbeaVJVhKM92GuEL7t405YYUoH8DnXmYX2LX5mdT4:9VXaweCh9jL7t405XUoH3BLh
TLSH
T15AB46CB618FBDBEF0901E884B7CD523BBC9B342CDD777632FC4518D42E6AA641A61085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\resources.pak
Size 6.0MB
SHA256 40af4117b0bd35da141aa599255b879013bfda5968401feccb5c43cb372cdae6
MD5 bc041e16180d671ae720a4a799e106ce
SHA1 b286bbcc059a31c8f44cca7443f88d60a4790737
SHA512 da141f2e6c2ac36dc924f1c72616db08927fd6277c7d7b12ca97dcf43a1f6ce906d269d6b6d9cf9cd957c432f5374f9be126111e006d88644f5c98ca33309fb5
SSDEEP 196608:ccLBR5ltjL+WkrYtJ/eGDi/F7MeZFFfD5CcowhJT:cOT5n1krI/7i/BZfD5N1b
TLSH
T19D5633B3F760243FC088477942D087755B3C594A2A41A0174AECF265CE6A24F6BC6BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\resources\app.asar
Size 454KB
SHA256 fcfed6233474be16330ffccb734401df1a5e132581e1ff673b1df16656735c1b
MD5 6fb65b1a7ddaf85e6d1adf19936ee0d3
SHA1 25825e4bb938bceffa34500a49e8f0f2bd9a038d
SHA512 091154d6d987599732f929a56fe88cb427b8c8d6574ffa3bb94c8382352fa41c48a6fbb865234e912f6f8b4461677535337c008ac35a1bb3f23d803ba6167515
SSDEEP 12288:ddP5WsGEkRBa8iOV65+04Ho8mhRMf3j/LtapJiKXwlzb/QNJnThjRD75kZUXbBcR:iDHo8mhR+/QNBDFpFXr7N11DZmJw1E
TLSH
T16EA40B0436E6F2511AA3E2625D2B5211DE1580372F3CDB90F1DDB7247F844AEB23A79B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

binding.node

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\resources\app.asar.unpacked\node_modules\btime\binding.node
Size 147KB
SHA256 475d3754f19f7075daad17a1eb1b55862d7e7866a6ba794a5763dd15fcb4be52
MD5 bfe75b93a160203b56ac60781e9ed503
SHA1 ef35a7a4bb46a747f17c6332db69e0d8762b2fde
SHA512 f06b0b8be4776921497155f96fd13e6faf5a6d5ddad434d1d1362f5dc531fd01b6dd1f26e3021d7a288871e36696e96fba0a67254a6a70c9a0b629b8f6c19f56
SSDEEP 3072:5BqdeRvWQVpkMEfi2UbUxcSSVjSSWmnCwS41kg:5BqdKvWQVpLndbUxRSemnCwSS
TLSH
T11CE36D5BB2A840B7E1A7C574C4934A02E772B8624B609FDF07E486491F237D1ED3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\resources\app.asar.unpacked\node_modules\btime\index.js
Size 1KB
SHA256 7ade5c334d6eb8a2e5ef8b6d52c5396641903af30c3c2ceda5e4934e3b88f35c
MD5 add2916dc6f63a4097ac09890ea4da3b
SHA1 e95f396302f31acae84640d5a1d25b4798fc3ac9
SHA512 e4e5956ca6e84b489cce280d074eac11365d23f650572c28c4deca02aa5aa587dcd8b7cea4faf97de05e93f741bec2ed2c901c3d219717099fa1b70b5591485e
TLSH
T1A531FD00ACF64122C0F73B36251DAD0876A0D074456DCED2926C97266FC5BBC8DED8B8
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\resources\app.asar.unpacked\node_modules\btime\package.json
Size 407B
SHA256 0db31b9e4d259fe4975a30ae751b08a5a52423cbed7c64cb992e0e66063a4320
MD5 e0fe39b2de46d23fab8e1a3cb7697a8c
SHA1 93b6dd282bff60948e8d8bb0c4ef0210ae138998
SHA512 2aeb05d2b4c2e9fbd5a4e5ca399a1581919ba368b9286a0a28564a32a96da44ea89e38d5b96759d457b20222b00be7e0995940594dc1be028f67f2a4be8e11cc
TLSH
T1B1E02220EA208EB324C969D21D5D498652120C3B400A7C2833EB601C8F5D66B24FE2BC
MD5 SHA1 SHA512 TLSH

Submit Download

binding.node

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\resources\app.asar.unpacked\node_modules\get-fonts\binding.node
Size 153KB
SHA256 4e3cb12f751b572d781a1f4b68eb27dea6156b1b0e1deedf71490f12ff7cb212
MD5 de6fdb7bc9f314598ad68d9b2bdecedf
SHA1 8169fb8747f50a8c0f11255dd206032a13e31cf7
SHA512 590786c06d262aff47ab966ad78e45e99822cf95a4f3faf961c3621bd0cb1bb46a1e212f669fcceb4767a33ba2ea936f764adb7050fb550578c1d033e1d90f78
SSDEEP 3072:KSexdeaJ7ApBEvaEQpLuiPzLXO7O22hCAmJz5:KSebeaJEHvrSiIOnAAmj
TLSH
T171F37C5BB3A50077E1A7D575C8D38A01F776B8520B609BDF03A482691F233D1EE3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontsMac.mm

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\resources\app.asar.unpacked\node_modules\get-fonts\fontsMac.mm
Size 761B
SHA256 0a1a83b87b2bc325695d6c611e35b476588c9ce14566081dba296095cbea4c20
MD5 665245767a199ac7174c8573d41b1dbc
SHA1 f2e67402b036e23881e2a4723ef5fbc187a93b38
SHA512 ee7bfe0531e2b792cac09e82279aae3823ccb9006747a56ee6872e605718fd8c70a618d9c13661c373e06aae644ec6c55b36e4f8b25da9dcee0396abc7c21e23
TLSH
T16E016AB1A41D533318FFA2EBD697851F8C5471810B404471B0271FDAFCE12E54773805
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\resources\app.asar.unpacked\node_modules\get-fonts\index.js
Size 115B
SHA256 b44255cd3525bf6596a184d6d4db62c54be16826ac35c9384ead5f6a815a1b47
MD5 f149607405e03a05131c0f9c7461681e
SHA1 8eebb98c2cb58de585ec5fcdfd24b012ba6a6481
SHA512 042099077d2d561e82ddb9136f5e00ed20a5f5331f69a7f17447ac9f70820a6a21bf2589cd30bfa1fc6e76c03a9014ece924dc28b607363ec9a9a859ada2ca3f
TLSH
T11FB0123536F472DE69D045E4D3AC9002A4E2C471450BE4B21D6CE5D400D898E22F08FD
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\resources\app.asar.unpacked\node_modules\get-fonts\package.json
Size 339B
SHA256 be584f0765f4c2e00a3f86413f7c2be1c10668de047d579d7b7ed8e9aea1a7e3
MD5 04d81e5f1bfa7c2b70d6f05ee0031bcf
SHA1 f29ba5b273f87acdd8a74304e2e77795511265d1
SHA512 a6f618ea15c8b521df4e8d5b5e5a87081ee29891a7e00d338205d09daf13d42292ee2947f50d1cb34abc7d553caae9d375a2dcaed604ab81ea65678e73e45d9e
TLSH
T1C2E07D24E5208D7324C5AED20C6A851A12512C3B400CBC2C37DB901CCBAF27B15FF339
MD5 SHA1 SHA512 TLSH

Submit Download

obsidian.asar

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\resources\obsidian.asar
Size 22.9MB
SHA256 2b2483b2e1246772e0d25367ec055cbc5047ea2f0091b667c35656678f86d712
MD5 914de0dca5b6471ded847317ce6d7a9f
SHA1 12da7dd4ecd689915462833a55f94d4050e4503b
SHA512 f1644c75d1238317f1e4fad994ad614cc16a83a035a0807da1b5fe9cebadaeab7883939e589d241c0e8dcb2e56ac5472532ee7b8dbd699a4cc87730ca445056c
SSDEEP 196608:ja98QY0Epk4mhcDzKsyL6z1N7baLxhxAvhwvtDD1:/QrsyLA2xhxAvhYtDh
TLSH
T19E37AE84B3D97239428361E554BF3205B33E5C2AB008C0E8FA6CD5E93EB9A55917BF74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\snapshot_blob.bin
Size 394KB
SHA256 eb484904e06c217beaafd2cd6847eb909225a5f0a4bf814cb1ec22653e6bd2e3
MD5 2475efe9ad373a9ffd0da6ff9853a9c9
SHA1 c63fdceef60f3409013df2af2802e681c71d982e
SHA512 9a5fc21e93df7df65ed051eed9c522b42dc5e11b58f5b370b7d699d4be1de8709e8a066e5ec6bfcafa2ebe069981bc5c3a1fb41b5874cce6c80c216600de98df
SSDEEP 3072:XU6QtROt+xeRvISYOoxs+Yi9qSkvpqE+IE3qfJjtN:X7t+OcTCvpDjz
TLSH
T13584A909B349CF36CE083A756CE887896526B18D6D96F31B7519772F38B35740E32A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\v8_context_snapshot.bin
Size 758KB
SHA256 1fa1cdd08423809344fe15fac2d9d1ec604cc3ea5af4b944d89a51b1e98c8665
MD5 00f69a4fa2169454a5601261a9c7245f
SHA1 b6d3d33b615fe050b7b2d009695a2a6e4e7c12a6
SHA512 abe8e379e1842d00c71a7c9cae3bd4d3a1d6ab4679f8c6d850dfee3f91affa23cbb4e0b35c035bf2832adb5f0cf5a8fe4fb21a7a377babf190fd6f11ce67e4c8
SSDEEP 6144:tU0ckYOkGt+OcqCvpWoNyuZaVaBgJjdOSkvh8mQu/INZV/peyWBOI:y1RNvMoNyerT8mQuANZhcOI
TLSH
T10EF48565F74ECF2ACA4537B86DE547463835B04A6F8BD21BB518233E38B65B00E3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\vk_swiftshader.dll
Size 5.4MB
SHA256 f50bfc899c3332246314f43c004d6c0bd57eb1bf87ddc67a356b19d915ed9ac7
MD5 8d7714292e881933bc76db231d3c5496
SHA1 46b7a71188cb92f14c088a792248a178210de9d9
SHA512 771920f2e13b2f3239a7b9b20117ca3c349afd62ba3c0967450d6fddee555396568c6a6311fdfcd7a0ed7b582e791a24a40b71f793512958b8b8b49e281dd385
SSDEEP 49152:VVlVRGSYZZaeYaOIHsu8n1o/n8fZ/sZSR0qCWUT8HeLig4SYLMRfXSlx1CB/wU/S:PlDYZZaeYwqqblXQ+9vWb
TLSH
T185462703F28681E9F06DD679875AA623F631F8844B2276DF16A01F192E77FE06739710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\7z-out\vulkan-1.dll
Size 937KB
SHA256 90c2e8ccdc5193275cbf99f4c43f4c419156407040a32f7d913d3429c059650b
MD5 06dff22d42fd1099b4e71f0756febb22
SHA1 79ca6054bc9153eab5fa1ad82f666881f241667a
SHA512 957e1174f05fb3bab12408dc116c6339fbd6b07965b9e4f23c4a567f545b10efc609351ed86a264aa6740b4b751683abd25392ed6afcecd5871d50a0bda009ba
SSDEEP 24576:1GVzDeAVM7N/L0H6tDVj3sF6Z5WGc4DYsHQDy6g3P0zAk79oOHAF:1GlDeAq7N/L0H6FVLsF6Z5WGc4DYsHQ6
TLSH
T167156D23965485A9D57AD034D9D28707C9B174822326B9CF02A81708BF6FFF47B3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB2.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\obsidian\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bf8b982103ca440b49ecccb3458e115afa3001154d7e4ddc28bdeacb231f7397
MD5 b5536a976c9cd7cfc5ceb377e4bd6338
SHA1 c192019d8619b08cdf549fb13fa423de1a049757
SHA512 d91fc0597fefd838a4a6e61af3c72ed93829c8319f12e71d1ec8c53ef110a57a073ff4568a60b749ff6b96dd0e4a4ae81c441bb86d65ea8ec687267c7c52f21d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\obsidian\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 691541213c7f4353a959eb0f512dccafbb72f6d04310d4d241f3b3ae4d753005
MD5 e33509341b2294429536b7d52f0f9da8
SHA1 b808871931c0f55211a93eaf4133c492237e0999
SHA512 241ec7cf99237825307292b093a61064abc92b8359daf0d6a8c8ec0cb086194df084e5892671eaddbff6e9d10503d96e29329591daf1a39de94bbe403b98551c
TLSH
T109F015527B842F0FCF494D7908C993C0F53CA43903228A666F974CB2AA577B90894C01
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\obsidian\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 e40e2792ecd0b3b75f94f5b60cdbe7c2996259e28b2398ce74b75b5e401f0d7a
MD5 73e6f46edb91bfc437114fdb71129607
SHA1 ee0b4f7a5cbfc2ac76ffe02b6b306b784267b476
SHA512 c87e27e5035747e3c4a874042dec8f4a32f36c98ac8d3012b2150868e6e275cdcd6d9ea0189d5ef3adca9bd569809164883a28cf4adacebda06dd0e04abad7c7
TLSH
T1DDC09226C7A42D1FD70C8DF80C8EC0047230E9B103034F0C62954462B96B3A44C60C00
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\obsidian\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\obsidian\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\obsidian\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\obsidian\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\obsidian\Network\Network Persistent State
Size 279B
SHA256 6935e3976ccb891581d6c1f3310441da484fea323304d02f3385a9b9c3c43683
MD5 a87e2ae31b2ced4cf37eb3f4a8214173
SHA1 37609da96c2f21aad66ee6e949f54fde3eeeb367
SHA512 dbb00318bba4f935cc5307bc3d2480326b59891d3f0e03f69aa49ee1ba65a4702f022e5d58e5d963f04a45e345fe85e5b9a0e1e80d080edc018fb2fae0f23de2
TLSH
T120D0C2E657301CBE0352D3E05E146D67CAF90015135C9C6A81A46A1C83A247A540094A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ad8cd.TMP

Path C:\Users\Admin\AppData\Roaming\obsidian\Network\Network Persistent State~RFe5ad8cd.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\obsidian\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

graph.json

Path C:\bebera\deb\.obsidian\graph.json
Size 493B
SHA256 89b1b8c279c3229a13509a0fad866ef90a7a70a6536f78d542e9c0960aec3d77
MD5 41ffa915f9d880d061cd7db53a247fe1
SHA1 fbdf2a9ccf4ea589a9593696d09065f4976f8eee
SHA512 61650142ac07c8742d9ecebcaa50f87770801d532e1580fcee451ca6a9a0bd261bc4c05f511cbcd517aff95025f51993a35039662d2f7f3162d308b48398d3d1
TLSH
T1FDF0E226D93801B315F13235889F93078A2ADD0902A77A6CA01B9A08142EF3B32F28D6
MD5 SHA1 SHA512 TLSH

Submit Download

graph.json

Path C:\bebera\deb\.obsidian\graph.json
Size 494B
SHA256 969396aec27e51d0dfe2d0f03f137c00bc49c376cb9cf8c0ad776bff4b1b9d2c
MD5 da0efe3df3594d4c3a95e40c4565aa18
SHA1 a93bba9a59cf4c87a0b0e2242289276c8b47417f
SHA512 d0918f33b2c189e07a2953b447c6f094a7981b5aa0aad8681b0779c92001f622da30dbaf329c2a749b5484f7bb94f60481a7079fd1c7c2206e47547128e9b5cd
TLSH
T167F0E226D93801B315F13235889F93078A2ADD0902A77E6CA01B9A08142EF3B32F28D6
MD5 SHA1 SHA512 TLSH

Submit Download

workspace.json

Path C:\bebera\deb\.obsidian\workspace.json
Size 5KB
SHA256 34ec5adc941fb319c1d7212332ffb58a7166d142de91a7cc5448b95f2c0142ac
MD5 cc6b35e07f1df7dc11c2ea45a15d29b4
SHA1 2b1c668c903bf2727c8083062f9b6556c49fbdfc
SHA512 b1a95b2ba651c3dc2fce7886bd105aa302865902348ef3c9485b1b757128fe0bab654408b73f940258c7233c2a9d9b89377d9b1688dd57521b7d100b844c8355
SSDEEP 96:qsLQpzjfqptLO4ejrqbPFyLLqjziiM3jC6i15ejgqbUkLJ9GNjOiIx1jGiaWdxn0:iqkqbPlsuqbDUkpUzsx50ZSAkqbBkD+n
TLSH
T1F2B12A18E0748CA706D5603598DD4252E42082074E493D19BF9D41AC9FACDBE29FEFFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Untitled.canvas

Path C:\bebera\deb\Untitled.canvas
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Untitled.canvas

Path C:\bebera\deb\Untitled.canvas
Size 328B
SHA256 5c43117b27916c1a44bb6fea90a4bb34324e5ce908d82a14c0b59d6fc8fb0657
MD5 28db41eb12257833d697ef5bb3f2ed6c
SHA1 b344528aea7bd377cf979ef85e82634d318a5313
SHA512 3e3fd919be1568f3238d6f16f46469b4f9685d061e3dc25cfb4a73a896d133edd25de34dbc101a3c81b52fd027ef997c0a568309aed3265b4952177471b3df87
TLSH
T1CDE08C159F957CF8E241613B08CE4A3B6C9CE00A83CECC09D2C95970DA444A8A637EBF
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.md

Path C:\bebera\deb\Welcome.md
Size 203B
SHA256 ecd0dfb6b21143ff52cfe36f93636df57e5b21773c101491b86f10ce17556ca8
MD5 5dce4937496ad2d20178a7578f1a1368
SHA1 9512b4cacf244bfc121a1f090f9925b644dad1fd
SHA512 be473bff1bb7945755bc86a87585a55fccc55bba5e4343cd04e5d9f82bfe40a635b2001f2e70f05e53a755f23dfa68e4e9da79873100ec43dd814f407b642ef3
TLSH
T146D0227B23488BA3C07C198A2E169890EAAA02143A2007382819B22C0727FBCA822548
MD5 SHA1 SHA512 TLSH

Submit Download

create a link.md

Path C:\bebera\deb\create a link.md
Size 4B
SHA256 cf1cbb66a638b4860a516671fb74850e6ccf787fe6c4c8d29e9c04efe880bd05
MD5 c676ed1d3bec334e54b7133560eb6275
SHA1 1376774b81b43f6e0e269cb3187301b22cff8b7e
SHA512 25ff19deec2e2d2e4c72561a8613f93a74e93f0adc776817de50a29dcdb6713214b588d47464f1b6c91409e65d1cd8615b49f660dd2dcf68bda9bf68a8091dcc
MD5 SHA1 SHA512

Submit Download

zazacha.md

Path C:\bebera\deb\zazacha.md
Size 26B
SHA256 f23fc2a899cbcf8d80c70dab88350e2e0d0f8b1c9553e0bd11859989c8d7c35b
MD5 c67149adb6fd6bc538f28c89f92a4c46
SHA1 15b31bbf2e5c866cdae88cd3429e62009ff0521c
SHA512 0ec39af2e09a076b6a5e8839a0c1f4f2532465fea796e20196d3f43afb1e95cbb20a76f2f6aa582b4096f9e1caa4d768f77ec17df052908db62f90b9c1ee11cb
MD5 SHA1 SHA512

Submit Download

zazacha.md

Path C:\bebera\deb\zazacha.md
Size 47B
SHA256 121268385f2b5d717d7332c9d12ef873f991bfa4d34e355df3a9d703e1bf0520
MD5 508ea8cf8cb168a35d148e4dbff504cc
SHA1 bbee4554d4f2553e911627ad0811655bab5f1e20
SHA512 520fd3b63cbdab5eeded6e742f36a9dcdd059fff45ebe589d702a5ea3b2f86583d7cd4a95fe48edbeca6a10f617163d3a2aab4bd4908d73e8d47fa02bb0a6e23
MD5 SHA1 SHA512

Submit Download

zazacha.md

Path C:\bebera\deb\zazacha.md
Size 1KB
SHA256 24dc7a9b6cd8e3850318cc4207d9f71f87854d76d971499de2fbf3e5ca5c4082
MD5 8de6905fe755f409038feb515c32faaf
SHA1 abc9a2567fb48dcdc6c719dca9d0a82f915fda04
SHA512 17998503ba8030ede3bd117dc8db7f21acaf7dc9b8f2d711d1f58bf61bdb1240a8fd4aa6894410dc044d128f4a586659adde899d3edf2ae7369206a9158e7937
MD5 SHA1 SHA512

Submit Download

zazacha.md

Path C:\bebera\deb\zazacha.md
Size 1KB
SHA256 c3dcf5f53b5b626f769a546b5fbbfa3a2e9ceaab1a547d0c6cda265e6b41ce60
MD5 4f9bc510ca968e487a6c79827d6023a8
SHA1 adc886955490a9255d6a513ae834a3d657e87fcd
SHA512 dc95365f39f04f82a924355c36dc77a628acf02322bf7d2877f98e400b2c99b8c7e597eb6258d2a6b25d6b87a04ba0510433ffbdb1cacfdad09669e151946630
TLSH
T1DC21034ECF082CA64D8A4C3C0812AC92F2E002E4CEBCC02C0882EF2B7B98EC00408C07
MD5 SHA1 SHA512 TLSH

Submit Download

zazacha.md

Path C:\bebera\deb\zazacha.md
Size 1KB
SHA256 27512f5b458c463812026b3f0cf4565780df03f7e22f0b23fc9b1928425ed83d
MD5 47a4c586de928a6e3352c718ce328c51
SHA1 644107519dbfa68edba5dd0b9e3f0fd2a0d79cf2
SHA512 48030f2ae82b5ba8d3abaf8a7d98cfcfeffd8fdc6c3741c67992dd66ea2ec8d3bc863edbd7a86f267d7ba09acfe978c455a21661b14a2a34a88cb614d2573f28
TLSH
T15221034E8F087CA64D8A4C780852AC92F2E002E4CEFCC02C0882AF2B7B99ED01408D17
MD5 SHA1 SHA512 TLSH

Submit Download

zazacha.md

Path C:\bebera\deb\zazacha.md
Size 1KB
SHA256 66e1861672715a791e5da7a98dd13d1c66a9cdac31c69ea9780ba47d6975350c
MD5 f87f59afdb7b8cbdd963518e595d33fa
SHA1 f078f5227b4d6fd50bde825206632ff7d4958421
SHA512 e30006f7ba8c595f1d409484c949da8c1f65984c17f26a4fab223b23ae01a276c394c4d1969d1bf3eae81cca26aeb8bdcca0662a186c629d710eaf8edcd83633
TLSH
T18421034E9F186CA64D8A4D380852AC92F2E102E4CEFCC06C0886AF2B7B99ED01408C17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1896-1073-0x0000013A00570000-0x0000013A00572000-memory.dmp

Download

memory/1896-1308-0x0000013A00450000-0x0000013A00454000-memory.dmp

Download

memory/1896-1071-0x0000013A00560000-0x0000013A00567000-memory.dmp

Download

memory/1896-1070-0x0000013A00110000-0x0000013A00114000-memory.dmp

Download

memory/1896-1069-0x0000013A79980000-0x0000013A79981000-memory.dmp

Download

memory/1896-1068-0x0000013A79970000-0x0000013A79971000-memory.dmp

Download

memory/1896-1315-0x0000013A00450000-0x0000013A00451000-memory.dmp

Download

memory/1896-1316-0x0000013A02180000-0x0000013A02182000-memory.dmp

Download

memory/1896-1314-0x0000013A020E0000-0x0000013A020E2000-memory.dmp

Download

memory/1896-1312-0x0000013A02160000-0x0000013A02174000-memory.dmp

Download

memory/1896-1311-0x0000013A020E0000-0x0000013A020EA000-memory.dmp

Download

memory/1896-1081-0x0000013A00490000-0x0000013A00492000-memory.dmp

Download

memory/1896-1080-0x0000013A00010000-0x0000013A00011000-memory.dmp

Download

memory/1896-1079-0x0000013A00460000-0x0000013A00462000-memory.dmp

Download

memory/1896-1077-0x0000013A00470000-0x0000013A00484000-memory.dmp

Download

memory/1896-1076-0x0000013A00460000-0x0000013A0046A000-memory.dmp

Download

memory/1896-1074-0x0000013A00000000-0x0000013A00004000-memory.dmp

Download

memory/1896-1303-0x0000013A00130000-0x0000013A00137000-memory.dmp

Download

memory/1896-1302-0x0000013A00240000-0x0000013A00244000-memory.dmp

Download

memory/1896-1305-0x0000013A00450000-0x0000013A0045A000-memory.dmp

Download

memory/1896-1306-0x0000013A02140000-0x0000013A02154000-memory.dmp

Download

memory/1896-1309-0x0000013A00240000-0x0000013A00247000-memory.dmp

Download

memory/5200-1204-0x0000020DB8C90000-0x0000020DB8C91000-memory.dmp

Download

memory/5200-1194-0x0000020DB8C90000-0x0000020DB8C91000-memory.dmp

Download

memory/5200-1193-0x0000020DB8C90000-0x0000020DB8C91000-memory.dmp

Download

memory/5200-1192-0x0000020DB8C90000-0x0000020DB8C91000-memory.dmp

Download

memory/5200-1198-0x0000020DB8C90000-0x0000020DB8C91000-memory.dmp

Download

memory/5200-1199-0x0000020DB8C90000-0x0000020DB8C91000-memory.dmp

Download

memory/5200-1200-0x0000020DB8C90000-0x0000020DB8C91000-memory.dmp

Download

memory/5200-1201-0x0000020DB8C90000-0x0000020DB8C91000-memory.dmp

Download

memory/5200-1202-0x0000020DB8C90000-0x0000020DB8C91000-memory.dmp

Download

memory/5200-1203-0x0000020DB8C90000-0x0000020DB8C91000-memory.dmp

Download