42af70f36904ff1184e40b83d83fa864fcf0a90130b15fe632483a7ffddedf2d

Analysis

user interaction
yes
max time kernel
299s
max time network
291s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nightcord-Installer.exe
Size 50.9MB
Sample260602-trdtksas21
SHA256 42af70f36904ff1184e40b83d83fa864fcf0a90130b15fe632483a7ffddedf2d
MD5 fdb2492fd44e6ba7341e225a83fe4778
SHA1 766862d05e3c697daa2a0c5d76da414f4b3e01ff
SHA512 1d9960cb7c26b64b8d6a4862cca2f3506fb2c5f8467c72bcbbcb5aa57664f3ad4bfc265d4822f4ea08ea735bfff6b2388d777527e41e4e3db63c85157c968c1e
SSDEEP 1572864:IR+qvl5FfaFObJhhr4ppuSNnAzBTBQ0xMbb7:IHl5pakJhgRuJBQFf7
TLSH
T1B3C73362B127EDBFE1CDF2F479B102B637419794A0362943CB6E52897B23917032B1E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
72	3360	chrome.exe

Executes dropped EXE 5 IoCs

pid	Process
800	Nightcord.exe
1964	Nightcord.exe
4684	Nightcord.exe
2860	Nightcord.exe
4980	Nightcord.exe

Loads dropped DLL 11 IoCs

pid	Process
4988	Nightcord-Installer.exe
4988	Nightcord-Installer.exe
4988	Nightcord-Installer.exe
800	Nightcord.exe
1964	Nightcord.exe
4684	Nightcord.exe
1964	Nightcord.exe
1964	Nightcord.exe
1964	Nightcord.exe
2860	Nightcord.exe
4980	Nightcord.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
46	discord.com
52	discord.com
53	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DiscordSetup.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nightcord-Installer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248907976473200"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 5000310000000000ae5c531f10004c6f63616c003c0009000400efbeae5c1b1dc25c75822e0000005657020000000100000000000000000000000000000059e724014c006f00630061006c00000014000000	Nightcord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Nightcord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Nightcord.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 19002f433a5c000000000000000000000000000000000000000000	Nightcord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Nightcord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0 = 9800310000000000ae5c0220110050524f4752417e320000800009000400efbec5525961ae5c02202e0000001804000000000100000000000000000056000000000035d7f700500072006f006700720061006d002000460069006c0065007300200028007800380036002900000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003700000018000000	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "5"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = 00000000ffffffff	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Nightcord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Nightcord.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000	Nightcord.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Nightcord.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	Nightcord.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DiscordSetup.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4684	Nightcord.exe
4684	Nightcord.exe
2860	Nightcord.exe
2860	Nightcord.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4980	Nightcord.exe
4980	Nightcord.exe
4980	Nightcord.exe
4980	Nightcord.exe
3904	chrome.exe
3904	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
800	Nightcord.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4988	Nightcord-Installer.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
800	Nightcord.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 800	4988	Nightcord-Installer.exe	79
PID 800 wrote to memory of 1964	800	Nightcord.exe	80
PID 800 wrote to memory of 4684	800	Nightcord.exe	81
PID 800 wrote to memory of 2860	800	Nightcord.exe	83
PID 4112 wrote to memory of 5156	4112	chrome.exe	86
PID 4112 wrote to memory of 2068	4112	chrome.exe	87
PID 4112 wrote to memory of 2068	4112	chrome.exe	87
PID 4112 wrote to memory of 3360	4112	chrome.exe	88
PID 4112 wrote to memory of 5980	4112	chrome.exe	89
PID 4112 wrote to memory of 5980	4112	chrome.exe	89
PID 4112 wrote to memory of 2168	4112	chrome.exe	91
PID 4112 wrote to memory of 2168	4112	chrome.exe	91
PID 4112 wrote to memory of 2032	4112	chrome.exe	92
PID 4112 wrote to memory of 2032	4112	chrome.exe	92
PID 4112 wrote to memory of 3740	4112	chrome.exe	93
PID 4112 wrote to memory of 3740	4112	chrome.exe	93
PID 4112 wrote to memory of 5804	4112	chrome.exe	95
PID 4112 wrote to memory of 5804	4112	chrome.exe	95
PID 4112 wrote to memory of 5592	4112	chrome.exe	96
PID 4112 wrote to memory of 5300	4112	chrome.exe	98
PID 4112 wrote to memory of 5300	4112	chrome.exe	98
PID 4112 wrote to memory of 1016	4112	chrome.exe	99
PID 4112 wrote to memory of 1016	4112	chrome.exe	99
PID 4112 wrote to memory of 8	4112	chrome.exe	100
PID 4112 wrote to memory of 8	4112	chrome.exe	100
PID 4112 wrote to memory of 3056	4112	chrome.exe	101
PID 4112 wrote to memory of 3180	4112	chrome.exe	102
PID 4112 wrote to memory of 3756	4112	chrome.exe	103
PID 4112 wrote to memory of 3996	4112	chrome.exe	104
PID 800 wrote to memory of 4980	800	Nightcord.exe	105
PID 4112 wrote to memory of 3904	4112	chrome.exe	106
PID 4112 wrote to memory of 5292	4112	chrome.exe	108
PID 4112 wrote to memory of 5292	4112	chrome.exe	108

C:\Users\Admin\AppData\Local\Temp\Nightcord-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Nightcord-Installer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
  C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
    "C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe" --type=gpu-process --field-trial-handle=1604,11135726321767392403,8099071441316385439,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1608 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
    "C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,11135726321767392403,8099071441316385439,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
    "C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe" --type=renderer --field-trial-handle=1604,11135726321767392403,8099071441316385439,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe
    "C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\Nightcord.exe" --type=gpu-process --field-trial-handle=1604,11135726321767392403,8099071441316385439,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=820 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff94e52c728,0x7ff94e52c734,0x7ff94e52c740
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,15196357152798128189,11870108952594371076,262144 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,680557737758196291,8282271927648850151,524288 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2280 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,4815912813455849203,16454341122107301050,524288 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2488 /prefetch:13
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,11606465324291478781,6901261826872775871,2097152 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,10996511190058838058,13038068297198477827,2097152 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4348,i,1974013130589312824,17373413834195925035,2097152 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4356 /prefetch:9
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,9444756727720506343,1405310407454273053,2097152 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,7571944434015436570,15649101859362193969,524288 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5548,i,4212212225112105491,12892127792444436048,2097152 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5956,i,7954813485837472264,12508200104848822722,2097152 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,8462378695572335314,4924451536681923283,524288 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6000 /prefetch:12
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6320,i,12876417718942751765,12059036352079667861,524288 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6324,i,12018567643920532453,345241065902368460,524288 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,7596508350735416535,15048021303943295181,524288 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4384,i,3274994145467907057,17717511437095372561,524288 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4852 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5728,i,3955830600916640919,9517573504956398035,262144 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4756 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,14928426960612400750,11219085298515006795,524288 --field-trial-handle=1984,i,4088733419152427507,15773325625225756487,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2436 /prefetch:14
  2⤵
  PID:5292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 23f89ef3911d10cb99a5d86424d45e24b046a41548d07758cd1fa781dd441065
MD5 38693c8d50057b8e81d0a6f806e2fcc9
SHA1 36db4f4b4fdd6d9a9d9b0dd1e0943429dc3c94b5
SHA512 7ab3be382f0e9a56bd3931196d4749497278571c834031844f7eb251146807d36fcb6e1751832bd0fe40f7d35c5e371bb3dbfd16a50679aa8520931dc89dc688
TLSH
T148F0F9B6CA219C3708FD4B5970654A46EB80132B3781985B3A3D920C8FF467B865582C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b7d52abbd4a1c2bf8a11ca3f247c19362ba1e357c016a5b83424d3666f1d8e0b
MD5 13b6b23384f1f0f3cd29997dcb29adef
SHA1 d441edd8fe2bfffddefd578cb6278c0c2dd6414b
SHA512 5bd62a7684e50b5e91d92c42c83362196bc3113af08558b8944130bbcd1c869d861cf6fecfffa963766dd68f8660297f26e6fc8f1e716be52fa95d3644e87af6
TLSH
T1991184B221A31CC0C7E1DDB060F27902A4F9DC808A4A1B093FCAED7C92C77BA2651C06
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 d976a37a3cc4b68466a2e318d0ab3be67cccdcab8736d858e040718ba9076abf
MD5 b7c09d8f89b619cbef5684246dca3fdb
SHA1 8dfc4c49b59db97eda46ad21e71cdee354680a38
SHA512 667447f27021dd9c014beab2158bfb628764f47cb34dbf673f1aad7c8590270ad044b2633867488e7909f2abc576d78232f1198010cc31edb5eb17e4371754ad
SSDEEP 192:DfJsNz8YgypGMjuo/zSS5UPM/k/lIfIqIITITNUqruYPfIIrlrbMHHgqK:DfJsNz8YgypGMjuo/zSS5UPM/k/lIfIz
TLSH
T185129EF3C3D8C62DC91156F4AB156E1ECE2D0D2443293C2AC8D9AF4F93E2972E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 17d740c0e62f34a2aadb653a17d8e2fe3bedab3a7d3580d57c7168f5d191fbe6
MD5 79c29204e56dd25a1baba45772726406
SHA1 eb5765721494fbb56bc3463841e41744c5d730e3
SHA512 918c7af40a318992b12fabe54c44968237e6dec39f1df8462670b472e2809529e47446ba3c2f36d6d0947d6caaf8775d02b5a54b3a87d7a3fc6c1409d7b7274a
SSDEEP 192:DfJsNz8YgypGVtfjuo/zSS5UPM/k/lIfIqIITITNUqruYPfIIrlrbMHHg6rLXW:DfJsNz8YgypGVtfjuo/zSS5UPM/k/lIS
TLSH
T158228EF3C7D8C62DC91156F4AB156E1ECE2D092443293C2AC8D9AF4F93E2972E25065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7ee83b12741592bdb3d85c77e934bdc745119b1c30b4c5fa33066c01a94c09eb
MD5 a4b33dd3aa552144a2e887dee87b79ac
SHA1 1cff708eee9c37edb0b15d4cc5ee07c17c6341c7
SHA512 4732f543a22d7e25f4e458515c3f276de5f0b8b1a37ab333d21cee8efe01483a03f682e833fe9d49a8b255221a0d1c72ecf6d1d304788022d91a49240c00e641
SSDEEP 192:vROcBz4t4BLpKMv7lpupAPRp2Z9Wn9fHsb+WNLb677q7e5x2m/LkwzVyIsnAUgtK:vROmz4DYZgUXfRw00eX2418
TLSH
T12C52B52FFA64253B5CCBD26AF922B757D3F5012525941E80EAFC8B1C19D7ACC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bb36adf4d9b7510bd621a32055b246aa8a14969054d9d8e6c1fb7c078244f912
MD5 5d4a594e977c79436e3e7c9ccc510c42
SHA1 a3a6e0e84e31d244cf2913ccd7773d813b5c8223
SHA512 fccfd2a107e9972050c2657995ff5b390852a09ccc22783d13f80297b30f646e781012630576b15eda47a8ecfddaa9d7bcb3fe4c3488c9cd148d7c78e922ee61
SSDEEP 192:vROcBzst4BLpKMv7lpupAPRp2ZAn9fHsb+WNn677ChZ2hx2m/LkwzVyIsnAUgtaJ:vROmzsDYZgUX5RwkmZ2f2418
TLSH
T1BE42B52FFA64253B5CCBD26EF922B756D7F5012521942E80EAFC8B1C19D76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c9ac9088aa937f50294a66bda1d36c1ab01b7aae6744d18bd74c11574049c8ff
MD5 c75352637b15c03b9fd23f342c20b17e
SHA1 f176629c2db79c42c721072b965c45cb5ae30417
SHA512 a86b54d088360ea893cbf0710c855b270d42d541b912d4beab9a13ae59f9383a3207b65840694517013ea13b91a92b0b66e3fbcffe037475146f2f4c2c47b9b9
SSDEEP 192:vROcBz4t4BLpKOv7lpupYPRpiZ9Wn9fHsb+WNLb677q7eHx2m/Lkw1VyIsnAUgrK:vROmz4DqZgQXrRw00eR24De
TLSH
T18852C52FBA64293B9CCBD25AF811BB56D3F5103525941E84ABFC8B1C19E7ACC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ae80130ed693e2ee4aed70e4e463bcfc43096c42709f60110b038dfddca0e36b
MD5 9c53bac8acf9d17944dd7ebd055cad2a
SHA1 cfb6ba47d1bfc6db38b593a447af9ea922da304e
SHA512 baa8e61144b2858e423052711ad825509742587ebd64031ac6b413e085372fa01980397875128b861b25b13df9e744ea194daab61db194557372f13cbc6fc583
SSDEEP 192:vRncBz4t4BLpKqv7lpupYPRpiZ9Wn9fHsb+WNLb67Ddy+q7e0x2m/Lkw1VyIsnAq:vRnmz4DmZgQXrRw0M3ek24De
TLSH
T11952C52FFA64293B5CCBD25AF812BB16D3F5103525941E84ABFC8B1C19E76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 061d0fbc9460cc8d28958e2bccdee5653a04b7d81a610650508485e02482db6b
MD5 f950d13cf5a52580458b5dbe470968b3
SHA1 a8d78d9fa3857b9d10c2986d85b5b6d14232d21f
SHA512 62de64117da11e6fd7e5830a85080990b363556ef086f3e13bf8966ba59dd78bfa2d5282dc3b6169a11d80bcbc08cd7dd2263da68183a867604c4fe2d98dcd41
TLSH
T14EB0120080055101C09607B021D328887114DF24960B2B0143E16972CC351718016050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589815.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589815.TMP
Size 96B
SHA256 c71a1e544b99737c9e95b35741ad5e2c8a9f8963057be1a567b6e5ef8cfed1c5
MD5 68f25404cfb3c82b27fce92d516bb62d
SHA1 ec0cf1ece2910c37cfa80b102afaed339330714f
SHA512 28f031df1ac0ed0075bff244b8c8ae9e4d66039ff05af8f554723f8da6afb49853d64efeda2210dc710bd7154d319fd138d344c91ae54d0eaed682835ae9bb8c
TLSH
T1B6B00275C1036313D4521BB0A5B5F5D87664DF29C6031612D2E45AA6DC266738536164
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 7309fa14e37626782474f5586356478a510ffb4cbbdeab7887791e2e205f8520
MD5 d612938549e36c9a58dc7f62e57e9d05
SHA1 6917613aa88acacb182ffca2dd9d80598a06f707
SHA512 35dafd7386cf534a7c5185fb59b03cfbd379e972bb87b64195abab2baba2da0688e5839932eba492d2871bff6664e404bd11992a9cc86e51eab78cacdde47629
TLSH
T11DA0025091560021C3240A7068D361A073144D1425D5231585D59154BAA43904203104
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 c49fa30c2c593393ee6b3dc2c6ec7d7be9e461f0ed410b620214551e5f81ead0
MD5 b3392ffb588162647613fa661f719f13
SHA1 0f514f4cea2f55591b8463cd8908d7a2857b01bd
SHA512 ccd6c0687880cb545006d4256bf85117aada403288beede6da003aa183b81691823d96f35e17f10e67e930a2a7a3bcd4d0c0873a7e56ff8cfa4832345468e4d3
SSDEEP 3072:w1a/GszfxUkBZnF6X79N59mE+v78H28k598BDFpmzNA9J+zfAsJDREge7oWg+95R:ka/lzfOkAX79cjyO2Pf+zfAk3Wbhf
TLSH
T141341311EFABCE6F8498D73050896BE77FDD4EF58179B121806872432BDCF58235A9A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 3b0ce3867e74ed131c9895b086212470b571a6f2540ef8369e173cee9c811900
MD5 dddc250f77cd32164ff645dbd3a7b25a
SHA1 301253b61cc98f7fcd83455c64f5be97c6106e5d
SHA512 40e95ee5ba27bb5112a4b9a001b3a00e49103a9b843835475283f0cfae191455749eda9ec6214134315d261911a0b6d65172bb71e653cac764c519e998dbd892
SSDEEP 3072:4DQa/GszfxUkBZnF6X79N59mE+v78H28k598BDFpmzNA9J+zfAsJDREge7oWg+9L:4Ma/lzfOkAX79cjyO2Pf+zfAk3Wbhf
TLSH
T124342331AFABCDAF8498967000887FE77EDD4EF68675B521805437432BDCF58235A9A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 97bf7048d8d48db87e347eef479b8b42be342d77d556c0806bf7cac234ba6101
MD5 49afbe6a0e68119dbb3283d286e9f985
SHA1 8227c21dd5898e7a3034731c5452eb5efec78317
SHA512 66b2ae42565daef446023b4ae3be2f0fc2d2ce6cebdbe5d54c8b2606d74d47800664895210c20f087ec41f4c29a86c2f57164b4e3428bf1d040590fdfc4d93b7
SSDEEP 1536:nlueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:UDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T1E0B30212CAAACE9BE4A45C79A4C413F3BEBE5F9523F1B9424166E4023DCE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 b5b3679934fa0e414a893720980d20fe87df3dd3b2cd22f532876ad09cdc918f
MD5 d66b0b003e5b8166255a0e4f1224d8a6
SHA1 7dcc0a53ca3acb87d3d1b370dced1ebe402bc803
SHA512 7193a89bd0beb3c40e8c158a8b12138d1ea17e2d29f650a88ab3d73f6d05355864ff2b80edaebf1fceefc17aedeaee4decad5b145bf9bd8ac1960fb0f4313a9e
SSDEEP 3072:l1a/GszfxUkBZnF6X79N59mE+v78H28k598BDFpmzNA9J+zfAsJDREge7oWg+95R:ja/lzfOkAX79cjyO2Pf+zfAk3Wbhf
TLSH
T1B3341311EFABCE6F8498D73050896BE77F9D4EF58175B121806872832BDCF58235A9A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 94a786f0f4739201068dc5c4b3371cdc1d1fb9942f7a71430012368fd0c9ee80
MD5 8da67f9a83a940d082b91cb308fc3844
SHA1 f1af297bc363b84045f7db44a1855ab49a878d9c
SHA512 a39b330347143df590122970219ebedcaf21c0897ee62905df03520f302c1d198a7109bcc44113b634218c8de651ec9e1aa173a3d36cf03db998196bcb30faec
SSDEEP 3072:sDQa/GszfxUkBZnF6X79N59mE+v78H28k598BDFpmzNA9J+zfAsJDREge7oWg+9L:sMa/lzfOkAX79cjyO2Pf+zfAk3Wbhf
TLSH
T170342331AFABCDAF8498967000887FE77EDD4EF68675B521805437432BDCF58235A9A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\chrome_100_percent.pak
Size 138KB
SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
MD5 03aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1 dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA512 c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9
SSDEEP 3072:igKzw9bpyZFM5fgm32Z8Gb0+VRLf0ld0GY3cQ3F2DExm/KLQ2I:nKzw9ozA4m3m8Gb0OV8ld0GecQ3mExhk
TLSH
T1F4D3D1D3B7F0ED7DCF6752B7B51A01B1FCB342391A92425A468AD8316A27348D8D8383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\3EX6DecNCV3eI7C2j9p5HJ9Ss8i\resources\app.asar
Size 1.1MB
SHA256 3d7238e82378728ef0ed95ccd60bec5a8de8e0a119bde38d9e6876986ee850e4
MD5 aae9eba7beb3890fe33e5fccede068d3
SHA1 c61ca37b8e52bba61ab0ccb7ff47615abf8b3799
SHA512 302231b4f52ad8aabf32fc33545c1ede651d90a4a2cc6c19ebbcb24c938d15a11fa06686e44226e7ca5061ec1c7047454fb172af798342fc9f8b72f077a3327b
SSDEEP 12288:7eom4/+j0xsrDIFpVpZ3uQqPjSFxfPfViQtdYCOx:7eomxyrltdjs
TLSH
T16E454CBB77B29635299617EA0BDF0184A2384116A911C858F81CF0CC37B5E2AF1F9DDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\LICENSES.chromium.html
Size 5.1MB
SHA256 fc2a256467fb4d4ff72be6c423e5961e98b418554deeec296aded0e757b9a585
MD5 6b84319ee8a0a0af690273d3d2dcbaf4
SHA1 857ca353e0582d100dcbc6cb6761bb4430d0cb90
SHA512 26f9842bfdb429ef132cc1a930da9187071a339927eda402e8d54b5eb9e03067612cdadc3a2dad3d0977f8e6af18c05eab6ac91720221c6a0104f96638f85a8a
SSDEEP 24576:yd97B+mnLiLsrDy2VrErjKCqzkU98wwg3QeXuh:0P+mLAqHBCuRoeS
TLSH
T1D046D66BBB49037316F282626B4AA4CAF31E903F375A1514345CD15C2B7BA2483FF69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\chrome_200_percent.pak
Size 202KB
SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
MD5 7d4f330a5443eadf32e041c63e7e70ad
SHA1 26ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA512 f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d
SSDEEP 6144:TDQYaF+9b7zA4m0k5GMRejnbdZnVE6Yopym74:gfs7T6edhVELo374
TLSH
T14914E1DBB3F49D3CCAB34673552A05F1ECF6123556B6424B42CBEC347A56B8988C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\d3dcompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\ffmpeg.dll
Size 2.6MB
SHA256 39293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
MD5 7c3c780de9ae5cc4abeccbd7cb6b367b
SHA1 bda27b3c0b1ec023e2a0a97099a84b10e04cb135
SHA512 80a79f827c3154461158ec6f466db0c2ecd9ce9ffd7728001644d4cf382721d09c0758f98f73d7fa548e4e220ffd2b8842303d67a43e79b9146e8b882853658c
SSDEEP 49152:8MnbcrH9v7eCZPxX+qzohT99hDoapghnshy43yBcxnyKbZtjB0HVEMGJSj/8NOv:dCZpX+q27saesDSjbv
TLSH
T17CC59C17F6A644EDD02DC57483AF9233F93078454724A6EF2A809A252F7BFD06A7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\icudtl.dat
Size 9.9MB
SHA256 6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
MD5 80a7528515595d8b0bf99a477a7eff0d
SHA1 fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA512 c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459
SSDEEP 196608:+UGwSv9AAQnt6liXUxR0rHa93WhlU6tcCLhl:+oKlQnAliXUxR0rHa93WhlU6t3Ln
TLSH
T1F7A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\libEGL.dll
Size 429KB
SHA256 23046e7fe2bbf76ee2c5596b6beac723ad465fdbaa44266486102cdb292148a1
MD5 b3017453d487a7d33445c1d2d9b9bc13
SHA1 7e643ccb8984a4a92dd439eeb4bdaaeb62bd8862
SHA512 fd583f4b95aa974d72628bcc548feb22bc86c5ab0fd1536995bd796e28422f56e6799d60e2c3bef9aed9a1080eaf12338a3b29b8c3d40ba5166030a219572baf
SSDEEP 6144:67Udu1o3YnElXvzYhRk9o+3Re3wpcOQy5n+t7dPs:wUdu1NElX7QR2osJ5+XP
TLSH
T1B2947D15F79048B9D076C078CA634642DE72B8DA0F64EADF139492692F7BBE45F39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\libGLESv2.dll
Size 7.6MB
SHA256 dd74029716da56a0e4b64bc5cea0c169e1c4b31143ff39213d3c544792e8f2b9
MD5 dd8d815769cbf46af41a41931e9b4572
SHA1 f242fcc4cfd5030f3f543c22f141185cd86e7142
SHA512 69a12f862157746ffc27b637941261a0c5c494175c3e674c7de4d0c4452a5b9358735944e8e0568b7279a7791cf178c9b1afd5ea4a781e93f28cd775a0a6096f
SSDEEP 98304:p5a6GJCIf2Knqdu5iIBIcbWwYSqARSHoDNSv:pKIwBqARSH
TLSH
T1FC866C07E2A040DDE00DC1B9875BB222EA31BC491B64B6DF269477112FB7FE06B7A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\am.pak
Size 150KB
SHA256 5f323c0bd185d5bd5f7ea737018f14fd6ea500ba5440bc74f5c09b635518eadc
MD5 5c617f3833923fca5717a549fa57adca
SHA1 0102ac3c8041fab6a1a65a3bcaf7e79c0b7fd719
SHA512 87034e798355875f3459567ed1f11e5455fc5adc9634eec33e9db2446451febf7f35f617709a9b09bf3bc52f195edea0cb47d474d2c11ca93a8b5383142d45e9
SSDEEP 3072:nJ1NSM/92t7Rh4rgEkDvuHq/VoZLokijEG/yZJjh6oVjUWRSuo90kef97ZVt1nnu:nzym+u9QfCx30jH8+x
TLSH
T1E8E3CE547DF9F7170F8E8A15A4221E8E9594AD4693802C38D35BE3FC2B2DF1B4CDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\ar.pak
Size 153KB
SHA256 e7f9a474399c0ca0daf28c6153f6ec7ae87423e66c8ffe0849407471d20b6237
MD5 8f9c8dd93b03202220b5e226c6956025
SHA1 8290dba9b8dcc89928821ead04f7cf599c0ba557
SHA512 3eb0b80cc7243ed646cfc7be31eb27f0aa15f2aa8a5d2c50c3e5efd8a81759637e3f986c5c294262ff3bc94a939bb3803268b4eda46b3cfe224f596bfb4ed00a
SSDEEP 3072:91mmOGHNSNRZaJTGxRh+7iMuxHSM2uZtE9yKBZ1F/R2bKSI1+/BI1Iir2L2p:zjOlNRQs+7i0g/BI1Zp
TLSH
T1CFE3EEE21B2984720A56DF0ED1E2366CD872BD23DB4BFC3134930A2156DB513E78E679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\bg.pak
Size 166KB
SHA256 bd3a3aacc3cee9864404755eee9542e0f21efbebd4a71e5333d15783d4ce18c9
MD5 00d012a55a50bba5de8b2fc2e0d163b2
SHA1 89163fa9905876167a0c7d3446bcb0bd30f88ef4
SHA512 3bd6c774729f3531d316917deb7d8fe977c5bf5a3e85846f061c4af5fb6c45f79d8a3557a47d4569ad52819b3ccab13d386a9f5c1801e25e969e194a956d40a2
SSDEEP 3072:P3504qAG1u0PSFq8HyyW4nSpbBqjnUmIKW3RZzrzCLy8Asgiamd3vNgT72eM+sUS:P35vqpTPaTo4njmZzrmLy8ADINW72eMz
TLSH
T19BF343A1579A68DF0501F45F98087E0A3CEA44FE3FE7879241642DBD39F10B487BA25E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\bn.pak
Size 216KB
SHA256 b4ed891e8b38452623348da12d325b52407446114cba664a8e25a26a7cfaf773
MD5 80c804a82c617e7e0fc1e7f0df63290c
SHA1 a81f3ac6e92785e4c96e7dbd01fca8bfd446071a
SHA512 919856917f185dcaa6204a0b990e49498ef59b72cf93f8b6da44785f4e889b70c0b05300ac15009260ddb36a8d4f06fee5d8c4796e60a43c2957ea436f7316bf
SSDEEP 768:fPjRXprzuB7CPIqPp2nKEZ3UzKoZ4CfrNuduY0Jri0CI58JRKgqZBiCYWY0PnxRB:fbbNp2KGCDjr58JMgqbxRRImv7hfUHm/
TLSH
T1D024DC209CAE51B2A8C5CDC9434C6370C1236E9B9B65F34DDC1BA21578ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\ca.pak
Size 105KB
SHA256 9a4e286a58bb9a58e9e30d982783663c9bce40730cb6dad4c37980038040919e
MD5 79ec325651589f138c7840c61316d8f5
SHA1 37503edcae710e2d61f390064fa2d9893d4b9c8d
SHA512 f00a9354871c77947d2b99e83b54babcb46b5a45c24702c1b5f750156abcb2a00d12c6b4c2e15634d4d560de0afa5b9c368d31f08cf447f2209f51c0b8ef6384
SSDEEP 3072:Em2DPcgrI54tBL8l/oq7O5awat8PU02he8X/FS0bzRhqRRhnAkpxlCEtT3nRA39u:EvPcgkoqO5a78PUzhe8X/80nEznAkpxl
TLSH
T1F7B30C23CFC93B7604D2110DB741C76BE58CAA887602D295F9AF071623C89DCDA77A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\cs.pak
Size 107KB
SHA256 c00829fc57c7e1e5419fe3202f114d394a590b8b32b1e55af42772c93755945d
MD5 0325d16a747cca73a3a2b0c94fac123d
SHA1 e5989627742ecee5f8996001002e97627bfbe10d
SHA512 b824297df25c097251432fa72ae1258092e692ff3e4c527599897d7d3e71007cbd80e300de54b87146889f71d537c7d297c1b3cac04b6e08d7ce29132ec9e5dc
SSDEEP 1536:6G+wdXqt5qYSP7ymjLEwoVD33zSYoYlBw/dhRRkP+8QUQdbiE:JvXPjyfaYl6/P2+8QUQdbd
TLSH
T1CFB33C1EDBE771258940020877EE52396E2E86881B2F94E77C8F95853276BBDCDF0D09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\da.pak
Size 98KB
SHA256 6da77a20fd6fbb228b2de5f197225342da18cbc58d26ebf542cf20d23e00f033
MD5 29f37a66ad8035d0657a1c7176330c40
SHA1 ebf26afa557b44ff5248207425083c750a397f49
SHA512 4c360f13c499a9b4b8e2b6f29efecedcc571130b90cb93a3c21486642704711db0a182b63b3be307b39c382de73787269822af76af9032e4f9c4a5596eae8e50
SSDEEP 1536:mjAsKH2oFmMFyHlqByQxTdofWfZg5Q4+xEGqZ4w8pOmPEFh/j4O:mM9WohFyFnQBf2+xgL1/r
TLSH
T115A33B87CC8D332F89E94729F7119EBBEB5D503DD540214F79C8813A1ADB9A087BE582
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\de.pak
Size 105KB
SHA256 e964d841b9588b7412f1ff86f004e6b052f993bf2153e4dc4bee6c5536be1744
MD5 5f9f5187b2c3a4bbe6077a329ef5c2c1
SHA1 68ab6991f89f5c41c055b07fd97ea6d394d87f12
SHA512 560a90d24c5fba776ae526033163ce61662978599c4b171f0bdbc80c72206a9443ed1aab58819ae71345ecafa795527c0673c12b73ba7ac381b7def7bbbee118
SSDEEP 1536:hHbausrKfikXgkNahUnNqRPIYvfrxWRQNCLubXpkHxQ1NlkGfChxCPQl9v83Opra:pinhUnN1dLq+H8Nr40PyqyrsS0
TLSH
T161B32B03A8FB268E4782A3143301CEBB3B1DE36ED346225A945ED137635B67746BC467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\el.pak
Size 184KB
SHA256 b624633365c19e6e3cbe200b39889711994809796dbee7988883165d0cc1d6c2
MD5 f4083cf1c56edb2d8701fc1809c9d8ec
SHA1 909337883e1f898c98de9b35f7889d257e5455b2
SHA512 27726b5cf51760d6938c17e3b1346f0f9c36940a94fbb9428d9ba8809598e07d7c5429fcfc3ec56ea795d65555b4d19676cdc299d0f8937c503d92cb87b80ee4
SSDEEP 3072:lA6xGMCiJFTYkDuTX9yGwSREF3IVMRm5ppFFSqu/EFMeELO+niKh52hfZPXYlXSG:lAACiJFMkDuTyF3IiRm5ppFLzFMeF+n/
TLSH
T12A04DDEFB4583EAD8045950785D8F07C67C62D6CE709CBD8622DCB60BDF90619A22E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\en-GB.pak
Size 87KB
SHA256 4a5e6439c6731a5273970c8c053b4a89018c57f1d9be81d85f24978233675442
MD5 b8b8de138e6cd2ad1eee182f2befc905
SHA1 acb5fbb8d3026d2cf0d5afcc0b2407f7dc7f7cee
SHA512 c5575f68aee1284a82a47e4d412df6175550bde1d8ffd3845d295f88687ece4a7c04f0ab9fcab78182fcabb6876ccb9a1f6ee815b0abc0eb96fe59f5ff849e4b
SSDEEP 1536:c1BQQyiGUaBWTHjrDXApScz4RrgasTX65iBxgwSOiJedMJrV0h5BvVfm3ggl+qRR:c/QJDU9HjHBVsdBxgXM523ggl+qH
TLSH
T15A933C5BE3C51226069242627B07E3ABBF15A07C931212967CACC12C37B7F958277BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\en-US.pak
Size 88KB
SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
MD5 af5c77e1d94dc4f772cb641bd310bc87
SHA1 0ceeb456e2601e22d873250bcc713bab573f2247
SHA512 8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c
SSDEEP 1536:lnI8PwZKfs9B0fYSED0TI4RVQ2trM8M5Xx5dBxgZSO0JedMVrBHhBeVfD3ggl+CA:LEKE2YStRdMLBxgsvBq3ggl+CGwG
TLSH
T16C934D2BE3C41225069243627B02E3BBBB25A0AD935211557C6CC12C37B7FA58277BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\es-419.pak
Size 103KB
SHA256 2e1cf9d3e3eebe607da44873cfe37b9a84615962e3450313c3947920d4de4fda
MD5 84a1995559e8fc00c3e46ba63eff51a6
SHA1 24b57babee3291419fc29aab9c9a2fc0fe9c3d8a
SHA512 1b8453367bbeb12f237f850eb0ef67d4b6caa973f2e6accdae6ff5b7b3991d5be2c5d76f787d2c7ca5a10d2d0a92b47fd55141c9d900c850f80cd916abf5425a
SSDEEP 1536:Y1zfcN6nwhQppC6SGDYjRbqZrtlaUuzHjqXGiMdePcHYD9KeO0KWFsMH5BthDViT:ahnwhQu6Psl6pMFmI2Be
TLSH
T177A32A22DEC81F5200D2924CB383D76BE5C4A549B408C2DBE9AB536563DCE8CC877ED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\es.pak
Size 105KB
SHA256 b927984d25359f3d7a20d71aa4b16d2ec4c574461177825b5221865f416d1e71
MD5 4acad14261fa458cbc61451f4255c891
SHA1 bfbf2429190b85f692bc97d12822cedd53a70742
SHA512 24a71134f5c8f3e03b29491e11d0d0d2b9988c2528593c753893986c6db6ff2bd88e2e5389b086e0785e24141894441efe3db976111e2ad5ee5afbf7374fec1d
SSDEEP 1536:CPOLX5pxZkWBvJdYx/TFKYM3vtdThgFW9XlhgoThoK/rh2L1w3Oy:C2vkwcx4v5F1tYC3z
TLSH
T1ECB32A229AC81F2240D39248B743C76BE5C49589B40CC1DBE9AF976652DCE8CCD77EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\et.pak
Size 94KB
SHA256 9cdefc472c67247e67da040b984e800cc8b903a1b39c742e6962ff5c423f391e
MD5 3f2f42e0e8ffe5c26295f5e15480edca
SHA1 e183e93fe99145ce0471687e930926018b1fcc19
SHA512 bb61da1665100b59433d03d05fcd074d36e07ea3c29f2f7c5305e2b560e2a2a8fc508d38b45798d98cd3c1987165667cd723726397e3d1e4be006c17efe11c3b
SSDEEP 1536:BnHIHEpX0aM3DS4xyGXcen6dg9NzuLECchVjpsPQHXG:BnHiEiaMe4x06NyLiV2PQHW
TLSH
T13E933A42A17A7B0B186041E98736EE3BDD8FE68DB10009D27857970932FEF9C6C71E65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\fa.pak
Size 147KB
SHA256 7e8f7f42300178f001ea5f74c63db25d813b7c25989114dc7673c76fd92a72c9
MD5 0fbe88d360abc020ef6d511ff5cb70a5
SHA1 8abc47bc30bb0128b84ca4335dc09a67b051edf4
SHA512 1eb2f414521b4ead4eccc26305cf89eddf2a9e26bc5e8d100946a8b442694e48df6fdcde858197b23cdd47c83ed7c316d280a642017e7516c5db73c3322fba26
SSDEEP 3072:QXP4Rawpa8C96NS9/W2ESEmGzR2XQmN4o6TwNv7fizfb8YIO8jdr8TwatK/E3oLF:QXP4Rawpa8C96NS9/W2ESEmGV2XQmN4s
TLSH
T118E3E2856A6C5AB15796CA0341E33438C773AE12E349FE40FCB1076609A5B139F5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\fi.pak
Size 97KB
SHA256 4e538a14f1dbc872a85fdb4be1e19145553ecfa3b07ee7c810b690c52b889684
MD5 0c5f18712c639646e37fed054781b147
SHA1 faecb7cb6838783e15bc52c8dc019736a334d59b
SHA512 ef9f1158c35045bbef92fe70d9006cd7dcc3c834f5a4beba5b269ad6c16f9790e316b7e2617100567919ad647a1353cfa8b80d5ede23cec9e5f7ae9b4e49c154
SSDEEP 3072:6EsQoWFTTTqWU9S0JEji18vlhROdA0EjjNM1TO9mRX:6EFf7iE218vUd4shX
TLSH
T1CEA32D929256C21237C4C14E6EB0D03EB7D8A28DDD5885D5F983C6D807F69C82D72E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\fil.pak
Size 107KB
SHA256 cb536b478feffd3b55ec53676cce84cefc9e000c1205273bafcdaf6ee6edd381
MD5 249ac7111d6310c67b42e973f6aa7646
SHA1 db19f2fa4eeeec09906ed31bf6295e7831bf9e2c
SHA512 e96d000925be9fae898602f5d62ae3e642e91aa2957d723ffdfe9cac9bd277ba2155be31620fbc326d5cc43d47a0e08314fe27688a6eaf786491d6b39a52a00a
SSDEEP 1536:3NqmgtbTGldYzVgQNjLeyspz4NvuNpEWnGkuljgOAM64CzPEchYkZzk17PaXmAMD:sbTEd07PjgOAaCzh7VSKmAW
TLSH
T1A9B3C411A3402708DBC296E51250A92F6BE530BC3F4128AE9FBF66973BB7CD4D670587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\fr.pak
Size 113KB
SHA256 f3bfcd6a297a7634c24f2fbd3de96f02588b0603d4a7618bb7588f6c091beb2e
MD5 a9552c30b27aca538388ba34c2374d75
SHA1 39173220e9da4c3d591bdb1d0dbba77dc8fba6de
SHA512 f6d01a2b0c03741092858b7616de8b52662b73a00e49b2d7b5e1a05195eddae507c432557b2bf8697ec0b8e3b620fa3f38ba577a7edd909556d73498fcffb9da
SSDEEP 3072:40CdiDv3ixbJPRQUClLZky86mQKyIwKByroFDuFcZYjlguPyNn/Uv:4/sPixdPR3ClLZky86myIwKgrwDuFAHE
TLSH
T1BBB3D84BD9D4218619C242B2BB02D767DE34824CF215D344E8DF42E527A6CDCD3AF6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\gu.pak
Size 207KB
SHA256 1d4d407233a4c78d5a9a242b43b21aa89fb68a0632bc52b0a515d69491632e85
MD5 cf428ecec583b73172fa789ba3f9aa6b
SHA1 9a7456009b5a53c4f6470a370319395da394e462
SHA512 2f86f9679e04b8188d7ce44bf0a7bf4b998d9771e9a8a83b4be4dba5e5d21ebf6a00091792896d9a8d4ed38eaecd43d8d2cad920237af1ea702dadc0341be9c9
SSDEEP 3072:vLx83is0a1A626ZO8n308LcKHdO3C362oY5maBeQOo5qP2G/KO4ue5GS2TsfWsjE:vL18qxv
TLSH
T14E243AD0D3B9F03119DAAF7E815E512086695213D67E230051CEEE898811DDF3EFEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\he.pak
Size 129KB
SHA256 4a9862ee8e139ae74e6336e0207d484e1a1ae0f689b5f1cc06b6fea66d2090d9
MD5 a275c3557e819c6e9fb029643e38fa17
SHA1 8c005cb081417ff2be0d7d8fb6356519a96f5703
SHA512 72936ffb29ad5b7fab17357286eee7fa9a6b933423fc8618b19fdd841b37d9cc613a35e04614cb74f69f49a4e8bf7a8b48bb55a10e160d8363dbdf697bc314c6
SSDEEP 3072:IH8reuJQWaOKXLpiglHN58nX3XTnw2FCC9V:DeuJWhXLpiglHN58nHXTnw2FCC9V
TLSH
T1FED3DDC4A6E45225513569C38FA4FA396FF3CAB53CA23512CB18526CAC774F0BD630B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\hi.pak
Size 213KB
SHA256 06424570167c9bdd7e13b115a632d6ab58de7a4fa14f8d094627bd12d85e9318
MD5 eb017ac26477d54c707d3e965ec352c5
SHA1 112001c7a38d9b95d3d0e422e10c585079356018
SHA512 8dfb1f8b18ae62841a40de244ce725b9ad865b4de7d250c0d5799f6896d274276e73672e3de455d0312a397d20598c768462895e4a768511b7ca530717611837
SSDEEP 3072:+8UrfNIncwfKSIv73cdEVhkAovrCFO/S/+fm2BfvTH+f+aJBKfzzruE3b8RLljlB:/Urfm+59R
TLSH
T1DD243C0CE7BEF3B65DEC3C8A32490D3BD5AC3674A3E5525348D5B3DB9854CB4046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\hr.pak
Size 102KB
SHA256 cc48d7deaf73103e22e3e5900503396e2a2c9e5bf1450a4df8ce94179b1e47a2
MD5 551026fcbd640c1b911ed5b4cb7ada68
SHA1 3aac7631c7f23e15a1abc4fa1cee98acb695aadb
SHA512 7bed851acc8a137c481968902006917c6eabdf1476c4cd74dea7bfa731bd45eff6b742c4b4ef48ba9c9eb4b2ba86c09c14878c05ff797bf56da075da9e53bfc9
SSDEEP 3072:MMN0LeqtKRxAGCyle77l/XpUa+tbakWlMMoLu87R53Kkx9i:Mfyr5nKp
TLSH
T1C5A32A3CF6F267090C96D209DFA6836A79FD049DE515C6FA788F571E0163F0C2AB8606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\hu.pak
Size 110KB
SHA256 61ae4e65474cb4ecf5edb2ec9bb9ea2b7a47bbf769f81c8fee1282c13b209783
MD5 e51afbba3250e655bc01e424a29e3162
SHA1 d7aaf2f2f9629ba9f7cf8a513c2905a13d0b6a8f
SHA512 57fc72149761cdf1de5c021bf7e63d79d91ef2e54dea57b9bd9f659dbb2c2f76dc43904c53518c00fe4ca80b92b6fc57489e275fd0006b2295f31dd45c0618ec
SSDEEP 3072:srCzB7nRkbJiKw7UiGKAWEc2dA3RdpEtL1543ICJ:srCV2bOUiGlc1RdpEPu3ICJ
TLSH
T170B34B7793B65049B8680357A965BB291A1F580FEB2F21F63987C87830B178D4C53C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\id.pak
Size 94KB
SHA256 e07be6b1a095f235a4babb2ad5e8018c8c1b2f7cd6feab170124d25898e764c6
MD5 0b9e5f5651aed9d1299f3246597ac182
SHA1 62aa835853c07e66d027d129265429adc6779491
SHA512 9d4c238f9506f41a43d531a762f7b8426db83ae093433e075237ec5211451ea6f888ceb14b8a055b67e5c6be43c0087d1c35de558cbc6d828da96043b98338f2
SSDEEP 1536:M+zgmloUhrsGEKhU95/SWpEmNUwRKUEJ4eI8B4X1CPXsAzb2ZghlrRajcCdAbJ:M+HlukU95KWy4eIn8XsAzaZGlccCdO
TLSH
T10D93E9525EC9310C0E4842D8A2D5E62F7DCC233FAB05676E9F74CF7026B66791B22B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\it.pak
Size 103KB
SHA256 4e2089d3fd90977f9a3a88b2af7fa9ff3b9864969d2f4582431626ae1f37c158
MD5 fa6eceaaa453fb66bd631aa9babe0026
SHA1 790bfefc29597d09f313c08e7b23ff298d60fa23
SHA512 88eb70a25a6b76e5b3272d4bae0721f23610ddd1284f54cb991eef3ad78eca13f47c6a8d79d5fb73f8fe171d5abea770b6902d0a1541884cbd5677f3dd4920f5
SSDEEP 3072:Ub5255TLQ2Vxyi9yN4tA7kxA78dgDufZfW01c:UFw5TLQ2Vwi9yN4tA7kxA78qkZOac
TLSH
T193A33B76E6D211151E86532DA221F196FBADF8CDFA017118A58B430C23CFD84E5BCB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\ja.pak
Size 124KB
SHA256 275307a3a9708c0698565f10941c57d42e1d2f55709a025d37e588699b5a985e
MD5 932a8b529d16e79c1471fb8c92109eeb
SHA1 4cec50af799472bea97fc1b1a127c31d9d08b176
SHA512 f2ddb70f819ef08b51c73748f2898ebc987d1d46dfa8e8ea00d2309ac51e37973310bb4f2a3503bb7ad5ef68150b01f3fe5492470d1e30fab374159ef44f8f4b
SSDEEP 1536:T0gtNfSwl76rsWg4AkDiQ492E46Tesg+ahB+nLi0doNHVQ:Ig3fjl76IWA+4TiiAB+Li2oNHVQ
TLSH
T170C35F7CE3C965369C6082A22C4E76E97546AC5FEC623236543DC070BDB0BCEE915AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\kn.pak
Size 237KB
SHA256 1a3fa5261b58113ae1a5cf140abd93e812b4a866a19a4c54929fffee5f42b18b
MD5 9224beb43327caf18c4fde76482ae12a
SHA1 ebaa89421838c093e36d74cec8bb3521772f29cf
SHA512 2c3ae5fd43607f34562b935bf6fb5dc62d083073f430959c4d883c188f744f49ac38d3a3bfa8c3e61113a2e4813d06fcb499ffe3cbfd07979b405b0cd6eb2432
SSDEEP 3072:VwI+rxPrIbgMkipVLe4wrZELNm7SIY/u5ZDu6oSPE7JQO5/d/OACAGAfKI:OI+B0bg4m7S3+ZDu6oSs7JQOV5GAfF
TLSH
T12334CE189DBA7D301BD6106B24EC643EDFF16BD29CA907D2F49DD7803C62C6A90829DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\ko.pak
Size 104KB
SHA256 0a46cce08401a72e44178349a61cdbae5fd78ca4f071bff2bf5f2e8c877a25f8
MD5 d6c5199671535c5b644d730c9d8c9063
SHA1 7bc876a53b0da752fc93a088af1ecd043dea6ad0
SHA512 71f8c2a676c7e672476d578ec36d8e9b16f823fe257f7da7c22b84dcdebfb7c18480fb52a386f14b9d60d2aac6c322aaede7d61f3032842d3bf713edda8cf857
SSDEEP 3072:L6jlXiuY72PcT5t4CuAJq/4KiWgDqbYSwnT:WjllY7e6teKQezSwT
TLSH
T1BBA3E9F278DB23C80652D946ABE4FA2E83C1E97BE7430294FD44CE54DD245C7484A9BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\lt.pak
Size 111KB
SHA256 225e5784a7a616f83d81e6f3fdc5510e975e9fbde741b673deece5ded1604a9d
MD5 29aeeb61df906c770e43ed477160f5bc
SHA1 d3224dff1967ddd1618d1573d91c3149ded8ae3e
SHA512 09f601216ef230c20e58391c566caf388b0ed5421cacbc06fd50bef242acac599e09f92fe63aa055dd314e0ebe9985b76016d82d32b426e51b1f63c7b888ac9a
SSDEEP 1536:RmrvD38onfyORY5gaJzU5R8FYlKUxnaJGN5c0z5PEAy6K5rmz3MWbhg5m1NqF6Sb:Y738oKGyQfKenaIcApbXdtrqF6S05nI
TLSH
T1A6B34C0196C3AEEB6A0053C982A0CF79DF7D60046636A991FC6EC357C4BBF451974F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\lv.pak
Size 111KB
SHA256 d58b6308b64a1cda4ee0b2b395672728ce7abb73c44961fc911386569caee60e
MD5 ce3cb88e12f86eb6f6ad23a4d34f49e5
SHA1 31ed4ddbfe6befa49c6c28089edb1b1617d896bd
SHA512 5db77b4e3fe2a2c76fc15134b7db1c4acdcd08cd296aa1657a08b55871353fc7f911222ff16078379a8596d401a66272a431fa9feff8bda5bedac9d7479d02f4
SSDEEP 1536:0rv+yaMchZGB5nDJSM+hzyez0YNUc8YjJ8I4WSuAhaIphcmE425BaYK/faVdX1:0rvdapZGTmUc8Yd8ScVfaVdF
TLSH
T144B34CA1DAC29F954E505DCA7327D233E9CCE304EE01E116ED6D8B3A621F524127AED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\ml.pak
Size 250KB
SHA256 e51d9a02ad11cb9825368da9a17af7294b7e6bf11079e2072e4bec028ecaf20f
MD5 aa549352ce43c7f3aadcf24db4b28039
SHA1 52f9de28a67e438a4b055b0988f2c4dc480a61fa
SHA512 d220ac779b5aa363e4837430fb66fc3833fe0331fba3c634ad920f8dba8dbb1f32fde0eb6da26cabd9c089326a46252df22ade62299d6bc37c9b0f3694e8ab51
SSDEEP 1536:ipt3yrxsIaPEL+YBkW4m/rvFdq2C1TmHh03m:mtGpaPk/XJdPETS03m
TLSH
T1BA44BD4BA035CD3B0FD102257B4E2FABDD5B8FA140AF668B5869F2628C59F7D0C99431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\mr.pak
Size 204KB
SHA256 4293afacf1c4dce2423c368a45fec4b33aac7232e7b7c1919aa8a5a20fb026a1
MD5 896759a28d38e5d8f415570dd6f4d85e
SHA1 23f55cde464192839434a1e727ceb285b8b1f82b
SHA512 4392943394e2ebc257ed230f993d6f0280ad4106e2623bd9a498c8cbb8dcaf05a49fb998f855fbba637030f43e68d15dc429d71604ef285f211a9c86480c4e60
SSDEEP 3072:LM82qbqMB6D/W502ZleTc7eegSZhBFvWSLQEDE5dEBZt+TYjDR6KAu:Jwtu
TLSH
T12A24D24CF7BAF3694DECB99E36540D3BD8FD31B1C3E9825608E1B3A74884CB405596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\ms.pak
Size 97KB
SHA256 83248a2aaefb87fc19454afa34bf5df99b95b98f823b534de0bae552c8260d93
MD5 407dd10484a99b21ffdae6016132bf26
SHA1 d1d7a5524fdf026a49391522c42d059406bd0442
SHA512 908b71411e34ec56e77c5837a856898f929dddc81d95a7e2b6d47f4f4e1d72b499d627a8cec7233e4f39292f592b6a90354e6325aafacc145c994abea1ff6f64
SSDEEP 1536:Hcy5Z74bI/tcHEry1GQ/ApwYXBSBYOYSjfhos036Kw+8uDe:8yT4bIKEGqwYXBSdJo76Kp8uDe
TLSH
T1F4A3D8029EDA3218055843C9D2D9AA2F3CDC3337B705AB575DA48FB017AE7A53722F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\nb.pak
Size 96KB
SHA256 21f3efe54a2a0ed9e2f618b2a50f89b44957bc7c779e7f88c1f10b310cea8bd5
MD5 1bdfc009f54c1e5bc8eeeb5017f9de53
SHA1 7427d3f37771886af1c0af1d20468960c524377d
SHA512 eee4aed543d30c7a74a64350cf67b454ec4ad56dc6a51f88dec648b80a33146f5bd3ffadab16a1f0b8e1ffe427f56f58a86da748ed1b118ea7fa72610d84c07a
SSDEEP 1536:gom2lbcn3CeEFoivwBiXEHZqFdIm8VUvCAchEHAxF:gc4nymDHZqFdIwC7F
TLSH
T1DDA32B83D9867729E69447A8F129D52F9F7C842DDA8405CBB48CC23A1ED3EF4527E1C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\nl.pak
Size 99KB
SHA256 e94551ca94505f068ecd0619af676b7b3a869f6068af87f0f537cace8055ba4b
MD5 fa16e91633aa0f20e49b7e19bb57aacb
SHA1 595d392d20df35ed71f4461cd5c85b77a68612f1
SHA512 d3fa50f247cb216e07d4905bfec4ab39d15bbc9b60cf0e3dc733bdcd2a0cbb1f8513589c40111335797248119e59ab2d2d46c2cf18c496796fd4b7233a829a30
SSDEEP 3072:u6KTrYE5am7spkFjegH7IINejowGTielwo6ytW9:kNjeKqRmUyc9
TLSH
T142A30B03B8CD252E19C0A349BB018BBFBB1ED22CC258E9BCA4DDD1751553FA944BD987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\pl.pak
Size 108KB
SHA256 c57c2e534da554e42388815cd3e848630ed46e1e61e640a6f3d4fd7cbdfb2aed
MD5 da0bfc4ef754490879e8dd567961064a
SHA1 f331c571422c5bb85f90fe915756ad9787103c24
SHA512 1ccde932c1354fc0880afb7eb1fe9a8b93297cfbb21e0dbdb78a07b116b951672a2d1dd25e0dc94fa1384ac7bb22a007b468a391457851bf8c88efb9708a7f37
SSDEEP 1536:t8ZTz/RoRMa8odxIQW6AeJJzg349OM4oNsNYyhIi+3ZyL5kA:t8Nz/eIQDg3Y4rYIIi+3Ze
TLSH
T17DB36E0E82E19A4E4EB045D6F2D75F7E9CCC888CF205815BA45F8037617B15E8D7EACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\pt-BR.pak
Size 102KB
SHA256 ed9adacad575344216ee986e9c04908a5093aa7a0ebfbf2549df4c668a35f356
MD5 31e00c1fdfb9f86d7f5b5b285689cff8
SHA1 c5131466499d78c7282f29b3b12f8934a139991f
SHA512 b36b87330b29f99ca32d781175f1fd485fa034eafa2458f4191b70bdbfb2866fd56edb0e97ce7232b0dc3135b939eb7ac1161b1002d9322dbc7ee016b8069f09
SSDEEP 1536:TTEl8e6Vb//PtDjipJtpm/QzrKj0Y0X4xhBc6x0xGUY3yDeMTwO5e:fEl8eyb/XR9/QrKJL5XMTlk
TLSH
T16AA34C195DC9171604229310B70BEB57AB88164AFE05C6CBDDEF8F06A3D9E80CC77E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\pt-PT.pak
Size 103KB
SHA256 da64b5178bb41be0684cb3ef1204becb457520fe4960c3252f5ccd6a9ee9e29a
MD5 f33190e2616875ed2349115e128a54fb
SHA1 27e44fb2cdfecc19f5c91ff2f2e69956cd59be57
SHA512 3020da0fdcf7984557ef7af1c9f0e7cbd1bf364a8841e6671cec4b517ac89e9c4bed680a2a2e76b18db5e2d10c7f1a41c5758306e3f20eb248796b2be6e02fcb
SSDEEP 1536:tcJdPoUL5qsr/y2VfgE5fcBw4d6hrxz2qKHWhLtOAZ12kR9C:+ksrbr0Bw9VtOAz2kzC
TLSH
T141A33A1C8ECA1325052243407B05EB57BBC86659B909CAC7DADF4B0272DEFC4C5BAF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\ro.pak
Size 106KB
SHA256 99730524e53ca07481f8cdbbdace228aed42abc19d2277d26c42f47653f3cf07
MD5 4c4112b99fda13b8fa5373d379f476fb
SHA1 2422afa9ea5b204fe84cc241cf6eda2c8b319fa2
SHA512 c663a678d0eeb66697f430e785c32fdb021a40c6456807f3842fa0e2c9ae3450fd59c3ee15e9a0975b8d100fc7c7118a06afd595404a29d777780106c8e1ad4f
SSDEEP 1536:pvGWGGi3mp16a3y5/zOSoPMyVwPgJe2DLpsPlJtWIhx5h6/uxFDv32B+A:purMpsIFJe2iPzx5h6/uxFr38/
TLSH
T1C9B33A13A1C45A572D814271772272FBED8E204EF601D1CEB5DEC97811C99DB8A39ECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\ru.pak
Size 166KB
SHA256 ec6654ffd877ec62d8afcf90469ecef5790e17c7306654cfe4b905de449b06d8
MD5 5d77bc0c2aa843ec5be6a3614c062359
SHA1 0b22c3376169a5bbb4697d586e4a0d3094739dd5
SHA512 a2cf1ff9f7020ba1998a7091b802dd1aeb59bf2b800a41ff221152e2d017435372bfcd52ec454db543e856288e2dc381dc46a7926d4bb4b917b8749657fee0ab
SSDEEP 3072:KWFppsemP4lV+TQUXEmOAdOiOFIQgIvZfbRrK5VH934RzDqa7BLuW1LV2Lle9X+p:KWFpp9mQLPQVOAdOwQgIv1RcVH9IRzhM
TLSH
T1EDF38761669A64DE1201F01BDC08BE0E7CEB44FE7FAB935619643D7E35F2024C63E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\sk.pak
Size 109KB
SHA256 d7baa6b1c0355e1ce9088c6eb508235c7a640ba70cc7ad84c9ac607026400495
MD5 ba56090d9658733694473c7861d04040
SHA1 dde05b47d06fa81abadc1b8f74e5993d0ea61ca1
SHA512 ed49f76f2ef4975e105fe13850258a51e44d0ffa7167a52b398276898237636aa50f62209757dcd756e3faef5581e314e261baa3a1e46b183a3b93af68605c59
SSDEEP 1536:ufxhFgi4HHK9eDpYaQWQtTe7hukM+zBHCYaiggGP352wmQPE:hBSaQWI2ukM+zBHCYauGPp2wLPE
TLSH
T1F0B36F2FDBE6584ECE940108EBD6A234FF7D05D98A4DA091A80F724724B3ADDCD78D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\sl.pak
Size 104KB
SHA256 48e9004441f8afb200601ec2843a03892076deb1706e1d3a7bbdbfcdd137ab57
MD5 b1e33bbb0abbe113a024694bf4608c5b
SHA1 a157c8578685f5084fd805c9d0734bc7646d77d9
SHA512 94854eb7021ab112b710332a410af53e59a42c4a501eb02098a41004613e5b2f7727a192c74e2a1c17bfc584a85477e75bd1eea0187e79db1de83c8253bec322
SSDEEP 1536:RU1M1nublajdqz6HYogW4xVivgnUhXaA99DqJdIqTCORahNNi/fzU1BwwRqt:RUpZWqzon6x8DgIqTCO6Li/fzMwoqt
TLSH
T1E1A33D35E69B1E0E0CABE28DFEB253657FDC045DE241E1A1FC4F23685021B5427BCA96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\sr.pak
Size 158KB
SHA256 68a04bae37629675c49d9aaeb68a1da974aac427b61151a18f3210499702202d
MD5 c56d29bcf5fb38ea25ab1a855690f9a9
SHA1 f3161f2890971ef929473c58654dac0718983957
SHA512 551a72041772737139190894f5dee50963f5597a2271bd2e94af390cae34967cc435bf5504601c061cf6c2ccccd19e7bb708538a6789f185412fc715e85d54be
SSDEEP 3072:u6umjOFT3hFmGK7vVsY+f1GX20Dl370BQn0yh9K3Y+Nst3r1GLTL6itWYJ/k/Zp:HT+TP0B7XDp370+n59URV/k/Zp
TLSH
T15CF389719B9E64DB0A01F41BD8087E0A3DAF41FE3FAB935215642D7D38E10B446B935E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\sv.pak
Size 96KB
SHA256 c63e812fee929492974c9b5dfa14a7587258e6fabed355a105015b296246b068
MD5 2befbabeabbbae5e7c57934acc5cd41f
SHA1 d48e9fd4d73627f4dcc57ec31924d97f6fd6b8d1
SHA512 8e06850701c6bc2a4a5ed8b9d59f68b68d631be7b037e2df2a738b5a44d36a37b1419e739341a00ee7681249a434ca69ba53bbc58ff0f204322f7dfde2d43405
SSDEEP 1536:49G15Swi3ANlCXU8qwJ4Ey9HdSfvlALur/WLdP/ldO12D2CMqeLKBqQOPXE9b3cY:JTvi3AKT8OCbU+Vn3
TLSH
T1FAA30842C660F525FBB1470DA605116F0BDDE59CF2D180C9B8CD893EAF97AA805FE24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\sw.pak
Size 97KB
SHA256 8b07bfafa5c97be2da9b6146535b7848d88a44d43a45ab06dfae286d93fd64ce
MD5 2490296567a1cd3c7b0852e1ed7d115d
SHA1 04b527742cea9487344ae08c463d6fd4ba16b1ce
SHA512 b930c14847012e12bb19bf217c79516c569fc163204d9c2b21a36f6f5061a50c3ec057882970517fc3bc4beebcf3d1b1402ccd521404cba827309940a5496b3f
SSDEEP 3072:AUaDx9XlYKed5nDi5jXmQtVPGoHLeH+jKHw9E:AU8MnDiZmIVaH+jKHw9E
TLSH
T1DFA3E8A2D8B1D1140622919903D8FF7717DCED5C2D2758932A4ABF4F228FA8C1677E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\ta.pak
Size 245KB
SHA256 22eb9d73331e92c898b27546a9e775fa8df0fdada391734a9291b2a016662652
MD5 8c8b63dfb6dbf75603d3e2e4fe981f9d
SHA1 3e7c9a1a01526367b016df20822a41e430328e94
SHA512 978af09738b4e00ba58f91b82db6cd455ffb3cb4951c25abaf79b8159c6fcd9212348373ef5a5a421f9ff5b4604a3f5b54aea3257dcf566807b6a84824ca54bc
SSDEEP 1536:ow9AvDLcYemZ9w7towiy+bvnTDE2k4ca6QVW0LlGJfB1okotPttRmL+EG5aIAuwA:39I/cXmHw2tRBp
TLSH
T1B2342FCE913EEE890E93288F0319536952987155C46BE3A27CB65F1198ECC5DCF342BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\te.pak
Size 228KB
SHA256 2dd8a542ee0778ee39639380208c584d9eec8932d1307bd5563e1eab320fe0d8
MD5 c370f82ff93880c0f32e63ceca8f1050
SHA1 a1190895ea7e699621f930c9b4b672b786fe1d9a
SHA512 be8febb9ce42731f6f3dbe0775d2bae10267f0790ce7bb8b437c4dd5e736fc28772812231b0a4a39b28dafc63d54d27fbbfd94375dbceb317fc43debbd566844
SSDEEP 6144:O9cJA6UspbDcUSanSBXvQBgIiCQvWSsxU/dUVo9wLwxEE:ocJA6UspbDcUSanSBXvQBgIiCQvWSsxU
TLSH
T12034B2023A7AD311DAE70273352CF5AC49681B4261D6732C1EAFA357FB87D6E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\th.pak
Size 195KB
SHA256 cffd61f7954ca10038529d14fda6a4e34c8ea1a9f202ead0b0c2db93143ef485
MD5 f265ec50e0eb62893fbc187c1c962dd9
SHA1 5a60ff7287e5d4e35f000d229a4cbb37db76acc0
SHA512 696140d16655b6d1c17d59b3e280f3f387adb8ad58c4a0d369925bd01cf03a3fd934c3b8e02e9e868bb64f81e7cfbfa532e732d1cd705c52c7b0f588765ecbea
SSDEEP 6144:aMMGozCJFkcSCkIOBrQrUXFIw3reJZK8Q9w1p7ETsGpY0bhdxPtA0kC5/0:aMMnzsFkcSCkIOBrQrUXFIw3reJZK8Qm
TLSH
T132145E733247D9D479481A5B262A7789662DAE693F73F8E040C9215A73F071AC432EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\tr.pak
Size 101KB
SHA256 b1b66bfec0aff21c64ec8ba3f19008501f196f80e7e41b2e8ae73114357df458
MD5 d8373d7bc1bdee4cfb48d85694a78ff9
SHA1 323408e39b2c953728420e5f21b1d1eb25de6c2b
SHA512 6960d7c0481985e0f151d66d047a02e7c31cdd670afd71a0a3949b9b0ab9e083a5ca55faa48e38c8793ebbf1218a4503043867d1999b163a923e5afce8058888
SSDEEP 3072:uTJeZiainAmSngesR/Rv2NEiOwi1PNpskBa5Y8GKhEtJj3:bZMAe8NEhwiBNps2r
TLSH
T148A31880B4EB281C8F78274FD7E1466EF98F165AF232A446E626D726379534702F760C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\uk.pak
Size 167KB
SHA256 fa035595c375522d09f9de5a545f5339fcd3ddb224fb19f1828a7958b7dff3e8
MD5 e87cbe2cffa7d3a95a8f837231d6f44f
SHA1 40f7d1602b47c7a7ad445fe04377e3145f8caff7
SHA512 4a8b970b50da8b92b824c92c6075c8b4440826da5a581c91ad6e5b78bc65e3b80be0080e4fbb20ad91e3ee30f8a3a05ca6925e93c76c8d2474cdb9a8825acc74
SSDEEP 3072:fxJB3IjwWDCj+KU/TI7Yf7/QLNiXMMQOCqbCEb4UdL+v:5JB3IjwSrILNiXMoCqbbW
TLSH
T1F6F3AAA19B9D58DF0205F05BE8487A4D7DAB40FE7FA7431625A53DBE39F2024863C31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\vi.pak
Size 119KB
SHA256 044c48581c2395a8eb0f85b5905e1b4cce1fc1fef2196710cef06e197afdfa99
MD5 dbf8363fe244c7d45d44e987d7194566
SHA1 c3bf0058f956fbd6fa0ad89218a22c7668964b30
SHA512 0953c455581f045a17e2ae35712487f36603b942f754805011047e4dcf531062d1dc1c8755f022177f7e21b7ab52fa71db5eac7c524424e1e5a2563429318e34
SSDEEP 3072:2KqJQj44KMPnMpPiz+sEqOa2WYmc/14Ca1bNeqhzi5OZpW8uTtdLpFeSZTzeNQ:86Zac1bNjzioZWN1
TLSH
T130C3970117E1302680BC553DC6CD941E6FCAE45FF3808FE16FE825787A621A56F35AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\zh-CN.pak
Size 88KB
SHA256 690dafdeb5be360e8b3a84c711d0d48b3cfc74c871b89a8f03f8058738ca9834
MD5 d9fb680d115846809114de2b35ab4ce3
SHA1 d1f68e0181233c98ffbe91b09910b9d87c1e35eb
SHA512 5968bba15bebf047df19b519da87bde959ccf1e564012043ea390b3c1e572bbaed79b8be6bfb884f4f9da8f1c25f3e6709d6620c582910deaf723906fdb04525
SSDEEP 1536:fS4xPz13JLazuzqWI3EnkHhE9vcolEclL:K4Zz13euz3+B8pl9L
TLSH
T1D4935D9D41E9FDEC058184581726D23E7980720FF213DAE6BD91889D1B72E960E6BE0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\locales\zh-TW.pak
Size 88KB
SHA256 8187e67cde3292c6f18ea0a40f8f8d3f2cd604e62feec9ec40c71b5d2bcdec9d
MD5 d0141fd3e851cdb790549c069a76abcd
SHA1 3da3787a8ea94aa066c5e5d17e42481330e0caff
SHA512 947e19e8fad3a761e5e1d0380547a8f9bc06f28cf8103d80865eb9ced9e3ed3d601bd92710ef1cb9fa68d56eb62ae95c1aad78145d455bcb6dda1b8c280f4162
SSDEEP 1536:Nx0gkZ46QB0MYZ2wcxAhdmDMQ+23mVcb7/8sfjkMQP1Rh5u/UxLiow5No4V3XiP9:PXkZkaMs2TAhdmSYkg35N/9XiPm45ycd
TLSH
T1D49349A948F6DFAE0510D64873C9823F3C49749EED33B7B6BC4D48A81F76A414E6580B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\resources.pak
Size 4.9MB
SHA256 a30b8269e588c6cc2cea5fd4685da3012fd10451edb59a283005116f8e033182
MD5 91f8a4b158df6967163ccbbe765e095a
SHA1 95db67f0a2352fd898f4a4cfdfc860f6a9c58c87
SHA512 6450d75d53f24d11e1c1e7e3cacfc57ee9dd09c00ca0dc2ff30f580b59a6b17e7ad7d96682195bd7d806b49068653538c77ca4200491560cecff128a0b012d92
SSDEEP 98304:L300L4ikWDclBYMiqOs7y33cJIVh1uiUdrwrAUFJ7rK5zkIFvd4XTI:z0Q4ivKYMDJOh8iqkrAUXrK5D
TLSH
T1F0360112E4783EBBC2CE213B74BE315366A118C341697E7E77CE518C4F99D0611BAB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.icns

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\resources\assets\icon.icns
Size 46KB
SHA256 a4dc3ce7a64207d10d15c4c537599f47b4ec1f16b53dbf3a92466d050ed4fcc5
MD5 8f80ca9ee10705d617566a041ccfe010
SHA1 531c952d46864e1a295c765e236d31147c5b7dbf
SHA512 ad1184a361b1645c6ec9be311bedf46f1518060e558da758e01fb56d7668b4b611bb1b320f8664c53958d6192c5f3d16c2f7643c2e99246fc6e1fe41bec72ad3
SSDEEP 768:DEE/FGBpID9deCikSY4CbB5k1yBte6eLjjuX5V6S/00wnkKhVLXCe6sP:YE/FGBpID9dvhd4C95Ey2HX0N/3mLXGy
TLSH
T1952302310C9D3DE51886013678E33327DD7847218366D8BCB29541F93ABE1A68C8BDCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\resources\assets\icon.ico
Size 49KB
SHA256 c079322ded8d8ebb655b2b93be10b18b2a7a5080dde945da6acf517caf3acf3d
MD5 d0324f3206be58e644b84524df1e5c0c
SHA1 10ced9e31a93e8edbd039f802d3e73eceb142b1d
SHA512 bc3e85cb853f19d26a3b4650aa842f8219db3d04ebf99ac7272ffeb40cfad8b82917bb1ed35c86570065c57fa501cfaba8a1b1d3fac93c40c2777a581d8172a0
SSDEEP 1536:vIBDu4tcgVKcGoqmBmZS3wg3Vp12l4F0rQRXq6MbIc:vIhBfRBKS3wgI4Fd86M9
TLSH
T1D63301BB48D7A98C51C0DE886C19D4D8F385647C66CA7C62D16607C2F5F8EEA80E93CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.png

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\resources\assets\images\background.png
Size 297B
SHA256 1d370406c3b0c6bfe109feb76229fd4a0fe1d4171ae2a77655a0fd3264558d2f
MD5 32338b60ff8368fd431b32109eae89d2
SHA1 7a3a844f2e6371c8f3a08a142e2e792a6e77105a
SHA512 be71b3dcc24cea203d59e08d8a4082dcf253eb02a971e67034f8cc0930f6af72830b1e35430cc861c08341082156585adcedcbfc788a83ec35fbd78107e20f2f
TLSH
T19EE08C929FC22817BD774A2A58361360B96542B6C4F4DA1853F68B3318920E927F8297
MD5 SHA1 SHA512 TLSH

Submit Download

canary.png

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\resources\assets\images\canary.png
Size 2KB
SHA256 dfd3446ba31a55a11b45e0196b4eb2800e0271749c99102660d0df59f2ad9b85
MD5 a2636a83d1e5d412d1459b3134f0a3e0
SHA1 ad04552d42a12e0aad79995bba521d163f1c6af3
SHA512 c51cf43252083bd2c5a31510f8a1e34bc08b3c142484d40f04d4979bfd334c9c34456f4908ae881e90de355551bccefecf88de187383dc0a0d8e9d146917bb80
TLSH
T1FD413AC650765F80C64EA633AB2D4720EAF01A8376E0049F9814FB7DDAC7FC9AB46084
MD5 SHA1 SHA512 TLSH

Submit Download

splash.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\resources\assets\images\splash.bmp
Size 564KB
SHA256 c14a86e456f5b9783ed3e2118c9e97de6306fbd2b40cf9cd0dfb821b945c3569
MD5 ab867e66abaad50036f8dca8bcf3b63b
SHA1 ca0bd657610ce7b5b86514adde57e2b0f18a83b8
SHA512 24b122fd7f8a48e03b387308e91ec1ccc6025a44f3e65404a12679ed50ce7633ce9f6c5b86efbc175cbed716478bd015e42711bd0148742f1ddeca5e3dbb1863
SSDEEP 384:V6sr5D9wQM3Qxu6QejY8RGEHsDf8CdvCdXJWaTlnZIWYvylfQTexJ3:VHNaQM0uhSRGFD0CRe5Wa5OWwBMV
TLSH
T1A5C43BC05B3CCC4E95180DE4AE9E2116611C3CA89FA8F3582DF87F4D9A3F9D94A3A5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stable.png

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\resources\assets\images\stable.png
Size 1KB
SHA256 b5b0f8076b0ac106fcc8f172b5e81516b69387f4119ca54715bd00739861fa27
MD5 d17d46244937c3705cccfe590b5a3d0b
SHA1 318949d0fd6d1638c7e0bb170e59b8d2f3662e34
SHA512 930eee25bddfe72835f5ebf6d5bec2e05e2e3a8740a588264efb8b7bb1dd7b46d3ff402206124b5a9878ce317bc64cb53d7fe0611e2a20902e9fc129760dd861
TLSH
T19A31D6D2227CD3C8C017A6B10BB04656E3B3199D41F69963BC68E20D1D1639433D8C4F
MD5 SHA1 SHA512 TLSH

Submit Download

license.txt

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\resources\assets\license.txt
Size 2KB
SHA256 2fb8be2f3179643a2b3f34dc48cad358abf273168d2f2d617034af24b129a4f0
MD5 eada62d1bedceb5443eab7908d263909
SHA1 e9e17466a02eaf585e553954b10de32af19a8123
SHA512 7b54aa1c0ead230cdbfa7c31c464a9d20164df9e70eee18f97403af2acc537e0805907c6cd8c923e42a2fd797c94b219cb06bb24dc4dcd272b25b950fc825106
TLSH
T19A51867CB3A54372159A02A466AAD0C5E31E1374B3AF57D06929C0393323DB142FB9CD
MD5 SHA1 SHA512 TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\snapshot_blob.bin
Size 47KB
SHA256 e03a33c2feb3cd9fd04fb1aa086febd0a6fdf5c680f48b6c5c80ef75767863d9
MD5 cc9eb6d1baf4870ee6425bd055849d44
SHA1 667e22f52eeb7a4962d6fcd220c5a0bc50570651
SHA512 49402c4624f67e93b2176c8ffc79f9911dc6cedb7c9704cdee5af380d69d697dc4be85aaa7d41db7be6e116603b6d5f8f177c09fb077a5ca5f85baf8fa6481a3
SSDEEP 768:uvYp69HfvGeQDvexhigYXcHl6zdOulbCmWGw1olf3e6y5GUx0y1p5iv192D+vqku:YYkVfvGeEE7YXcHl6okzw1o56iIiN9N4
TLSH
T10B23F15B7700D09B6F42832C7EABA60C0C135AE88DFBE73216E44905D3D6A2FF65900E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\swiftshader\libEGL.dll
Size 448KB
SHA256 b1054e0dc2ab31a7cf3cd7f3dae07b1ec31acd42c157be13ce47ea870840f0cc
MD5 038a73114d439bfc94be4732b2794998
SHA1 4b7a9d52da1bd808af979cf5cfb146404494317a
SHA512 8788e43de424e1d7a163d0b7f4d719c36bf8fdee9808d405aeb05993c446d4f2a595741cb4d98f5e9611cd16d09de9445bf72176a799f4189168bb8509b115ff
SSDEEP 6144:/H0B/LCOJ7lTp0k7zKd0POc37Tta9pdEp2si0xnLB4Vz:/MCOJ7lFx7zxt6dEY0VLSV
TLSH
T105A47C16B7A044BDD066C034CA538A53DE71B8960F25EADF1394926D2F7BBE46F39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\swiftshader\libGLESv2.dll
Size 3.1MB
SHA256 2e10d308d0207835b07df3bb38bee88300aa57fcb214051e8654d29587257744
MD5 38ec86347b3e467c5868e35ab48f89f2
SHA1 4db17d065cc330b277a70f9fb8dff0c4b426f314
SHA512 2b2405ed51ea1d232f2d60072e4f57e70f36f1a8f9d0a935772bfb9a3be50c1d6136cee496fde9fb3dda1f0d2f1c643cb9f162e0b68828ff854645eb1e8216f4
SSDEEP 49152:EAtfKpPXV/5DdijA29+0QdjwSx+qovRYFDguXfol+4iduejy3bEW2ehvxLTL10dO:nwNynDyguydMVW5v1
TLSH
T18FE55B43E55980D9F06DC6BC874AAA2EE632BC81177272DF52A06B121E37BF0173DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\v8_context_snapshot.bin
Size 161KB
SHA256 09686ad5bf03d95de7c251d204e60a8e3824bd6420bedddee80b2c6e5609fb26
MD5 e47426f88649c7f8e27b8a1516cc0137
SHA1 5452aadfddbc55d6c5c18b801087e39529859b12
SHA512 f9647a35ff273ca622b3db4aefb9aaf75075386c42a31e085f916fc82f3a18fed25b0e05dcc09e678ca419408f59f0c34fa5762e5f945db35f9c6f67b7b94bc0
SSDEEP 3072:hbeR82w8b1nmtMCRZLbp/UR2+X+4e19ceUvHCmmKUi:hbeRTvnSb9qR2+Xy1yFR7
TLSH
T123F3120B358005E24509C8F387388F77592A5A252C8FF2F923DCD77665AEBD50F85C5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\vk_swiftshader.dll
Size 4.5MB
SHA256 cc947f08b87f4636213211b22328c32d1986d49abc96a619799091fa6a15c851
MD5 0d3deb7dc62ea45c6624aab2b1ed8071
SHA1 0e4a7276784e3d8e6d6440669a65bd88f840b078
SHA512 38b674e0a0fefe1fa61ae144e6707b0eb7cfb73a8d01315f2b984cd1ebeb017cddeb89e39daa0f5806cc295a540e826a97422a677c361ebab3f8e4767228e5e6
SSDEEP 49152:53YxjaP0AETYj7g/yaI75j/7wiSmQEZLT/lbMnP3cuJUiId+R9iETUjdCB2KmGsl:UAbIASP1aRldQ
TLSH
T1BE264A03F6558199F02DC67D8B4BA622E631BC811B72B9EF12A03E051E77FE06B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\7z-out\vulkan-1.dll
Size 707KB
SHA256 26460b9250e904a9db6e5e0893e746a84ffae21c02e083e3f33a913d7cc79111
MD5 3cffcffbf394159458566fb79b9abd3f
SHA1 7e0f09e9ea67e9e587305e2f740c8620dad12595
SHA512 93a73aef9237d52119f9886ca6eff7975cdd6931d12087ea4c0397807b19c6195e24045d80b606bfc45f754c58ab5b1f789d95e91250828629724b9446501c55
SSDEEP 12288:Dwc+2rLfirhAu07HvM5BSNraGMiuvo52Ap:D82r79KBSwBiuv
TLSH
T1DFF47D3A7E94015DF5B6C038DA074621EA71BC620B64B5DF13A0131E6FAFBE42B7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE83.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State
Size 249B
SHA256 e247d5046e84b69e3f15391838d510e672222d50e5643488985756170a31d13a
MD5 6f80201b0846a23adcc443c8507d0836
SHA1 575389da53105e5af0b6288b98ab45b6e6a9e21f
SHA512 8acb078ea4808c148a10c3b981544530cdfbc910cc48e43359311bc9e10fe2525c2967f015fb47d172dda5047352bfaaf828bc942f7d254004d62769792fcfff
TLSH
T1E3D097BF17302CFF4342C3E4A5163A13C6FE004B125CBD4FA928372E41328BA880884B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe593733.TMP

Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State~RFe593733.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

DiscordSetup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\DiscordSetup.exe:Zone.Identifier
Size 155B
SHA256 8547860524c6b6c03935684482c4e94dbceab85a91c5fa0a96718dfef08e9657
MD5 1574bdebf596d90dce81bc0ee77a339e
SHA1 bd1159c4816b7f217621e28f3d7e8663efd24538
SHA512 dda8ddf2de0f9095688539a692f1473b73c38a98dfd8505da984191d419d0014b16463ecd25c13a8150ea9b91893f80985e2c02f660625dbc3df2a3a41b69b3d
TLSH
T19BC02B87490254B1078D91EC079EF21CB20FA1E81C5F07D0EC01007AAECA2E6DBD4C03
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1964-1063-0x0000016EBFD30000-0x0000016EC0098000-memory.dmp

Download

memory/1964-721-0x0000016EBFD30000-0x0000016EC0098000-memory.dmp

Download

memory/1964-1025-0x0000016EBFD30000-0x0000016EC0098000-memory.dmp

Download

memory/1964-1112-0x0000016EBFD30000-0x0000016EC0098000-memory.dmp

Download

memory/1964-1126-0x0000016EBFD30000-0x0000016EC0098000-memory.dmp

Download

memory/1964-608-0x00007FF96F960000-0x00007FF96F961000-memory.dmp

Download

memory/1964-1154-0x0000016EBFD30000-0x0000016EC0098000-memory.dmp

Download