709b9d242f9ac88b2c6ebaf195cbeadb2d3cd7c968342a22f483a2dea919762c

Analysis

user interaction
yes
max time kernel
99s
max time network
124s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/06/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GeForceNOW-release.exe
Size 170.0MB
Sample260620-vptyfsf14r
SHA256 709b9d242f9ac88b2c6ebaf195cbeadb2d3cd7c968342a22f483a2dea919762c
MD5 87509f664609aff801925e0ff2eac37e
SHA1 5a69fb9ad3a79b759918c41c04484a54c766f872
SHA512 2085ebba27febf5b4f708a5098d2bbeff372f86c511229f69c13f98bd0d1fe61afff0ef28309617cd834eed40c356c08d88e185fab820cb6815390cb198fdb24
SSDEEP 3145728:sv2++R6B2kUVOGe7/yNFMty0/KIFSB9CzUbivqpdOIlAbrwkHLLQKOb4ybFOd:svTUAFzKFM4UKTQfvqErvrcfbFI
TLSH
T130883320748D5DBAC0C721767D386E6752C89D710B2758C32398BE2CBBB95E34A351EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	GeForceNOW-release.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	GeForceNOW.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	GeForceNOW.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	GeForceNOW.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	GeForceNOW.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping796_108545053\privacy-sandbox-attestations.dat	GeForceNOW.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping796_108545053\manifest.json	GeForceNOW.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping796_108545053\_metadata\verified_contents.json	GeForceNOW.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping796_108545053\manifest.fingerprint	GeForceNOW.exe

Executes dropped EXE 9 IoCs

pid	Process
4064	setup.exe
796	GeForceNOW.exe
4972	GeForceNOW.exe
5388	GeForceNOW.exe
1304	GeForceNOW.exe
4040	GeForceNOW.exe
5976	GeForceNOWContainer.exe
3300	GeForceNOW.exe
4944	GeForceNOW.exe

Loads dropped DLL 64 IoCs

pid	Process
4064	setup.exe
4064	setup.exe
4064	setup.exe
4064	setup.exe
4064	setup.exe
4064	setup.exe
5024	RunDll32.EXE
1864	rundll32.exe
228	rundll32.exe
4984	rundll32.exe
404	RunDll32.EXE
3352	RunDll32.EXE
796	GeForceNOW.exe
568	RunDll32.EXE
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
4972	GeForceNOW.exe
5388	GeForceNOW.exe
5388	GeForceNOW.exe
4972	GeForceNOW.exe
1304	GeForceNOW.exe
1304	GeForceNOW.exe
5388	GeForceNOW.exe
4972	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
1304	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
4040	GeForceNOW.exe
4040	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
5388	GeForceNOW.exe
5388	GeForceNOW.exe
5388	GeForceNOW.exe
5388	GeForceNOW.exe
5388	GeForceNOW.exe
5388	GeForceNOW.exe
5388	GeForceNOW.exe
4972	GeForceNOW.exe
4972	GeForceNOW.exe
4972	GeForceNOW.exe
4972	GeForceNOW.exe
4972	GeForceNOW.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GeForceNOW-release.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunDll32.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunDll32.EXE

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GeForceNOW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GeForceNOW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GeForceNOW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GeForceNOW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GeForceNOW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GeForceNOW.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	GeForceNOW.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	GeForceNOW.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	GeForceNOW.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	GeForceNOW.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264492651330841"	GeForceNOW.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\GeForceNOW\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\GeForceNOW\Shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\GeForceNOW\Shell\Open	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\GeForceNOW\Shell\Open\Command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\GeForceNOW\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\NVIDIA Corporation\\GeForceNOW\\CEF\\GeForceNOW.exe\" \"%1\""	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\GeForceNOW	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\GeForceNOW\ = "\"URL:GeForceNOW Protocol\""	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\GeForceNOW\URL Protocol	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\GeForceNOW\DefaultIcon\ = "GeForceNOW.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{60D5CDAA-2490-49BF-BEB7-1E523054357D}	GeForceNOW.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4064	setup.exe
4064	setup.exe
4064	setup.exe
4064	setup.exe
4064	setup.exe
4064	setup.exe
4064	setup.exe
4064	setup.exe
4064	setup.exe
4064	setup.exe
3352	RunDll32.EXE
3352	RunDll32.EXE
3352	RunDll32.EXE
3352	RunDll32.EXE
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe
4040	GeForceNOW.exe
4040	GeForceNOW.exe
5976	GeForceNOWContainer.exe
5976	GeForceNOWContainer.exe
796	GeForceNOW.exe
796	GeForceNOW.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	setup.exe
Token: SeDebugPrivilege	4064	setup.exe
Token: SeDebugPrivilege	568	RunDll32.EXE
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe
Token: SeCreatePagefilePrivilege	796	GeForceNOW.exe
Token: SeShutdownPrivilege	796	GeForceNOW.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
796	GeForceNOW.exe
796	GeForceNOW.exe
796	GeForceNOW.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4064	4824	GeForceNOW-release.exe	83
PID 4064 wrote to memory of 5024	4064	setup.exe	88
PID 4064 wrote to memory of 4068	4064	setup.exe	90
PID 4068 wrote to memory of 1864	4068	Rundll32.exe	91
PID 4064 wrote to memory of 5020	4064	setup.exe	92
PID 5020 wrote to memory of 228	5020	Rundll32.exe	93
PID 4064 wrote to memory of 116	4064	setup.exe	94
PID 116 wrote to memory of 4984	116	Rundll32.exe	95
PID 4064 wrote to memory of 4340	4064	setup.exe	96
PID 4064 wrote to memory of 404	4064	setup.exe	98
PID 4064 wrote to memory of 3352	4064	setup.exe	99
PID 4064 wrote to memory of 568	4064	setup.exe	103
PID 796 wrote to memory of 4972	796	GeForceNOW.exe	107
PID 796 wrote to memory of 5388	796	GeForceNOW.exe	108
PID 796 wrote to memory of 1304	796	GeForceNOW.exe	109
PID 796 wrote to memory of 4040	796	GeForceNOW.exe	110
PID 796 wrote to memory of 5976	796	GeForceNOW.exe	111
PID 796 wrote to memory of 3300	796	GeForceNOW.exe	115
PID 796 wrote to memory of 4944	796	GeForceNOW.exe	118

C:\Users\Admin\AppData\Local\Temp\GeForceNOW-release.exe
"C:\Users\Admin\AppData\Local\Temp\GeForceNOW-release.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\setup.exe" -log:"C:\Users\Admin\AppData\Local\NVIDIA\logs\GeForceNOW\Installer" -loglevel:6 -showProgressBar:false
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\RunDll32.EXE
    C:\Windows\SysWOW64\RunDll32.EXE C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\GfnPcExt.dll,LaunchUACTasks C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5024
- - C:\Windows\system32\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\NvConfigGenerator.dll ,GenerateConfigs "PACKAGE_ID|GeForceNOW;SOURCE|C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\configs\messagebus.conf;TARGET|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\nvc\localuser\messagebus.conf;NVCONTAINER_INSTALL_ROOT|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\dependencies;NV_LOG_PATH|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\logs\NvContainer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\NvConfigGenerator.dll ,GenerateConfigs "PACKAGE_ID|GeForceNOW;SOURCE|C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\configs\messagebus.conf;TARGET|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\nvc\localuser\messagebus.conf;NVCONTAINER_INSTALL_ROOT|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\dependencies;NV_LOG_PATH|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\logs\NvContainer"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1864
- - C:\Windows\system32\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\NvConfigGenerator.dll ,GenerateConfigs "PACKAGE_ID|GeForceNOW;SOURCE|C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\configs\x86\messagebus.conf;TARGET|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\dependencies\x86\messagebus.conf;NVCONTAINER_INSTALL_ROOT|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\dependencies\x86;NV_LOG_PATH|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\logs\NvContainer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\NvConfigGenerator.dll ,GenerateConfigs "PACKAGE_ID|GeForceNOW;SOURCE|C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\configs\x86\messagebus.conf;TARGET|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\dependencies\x86\messagebus.conf;NVCONTAINER_INSTALL_ROOT|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\dependencies\x86;NV_LOG_PATH|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\logs\NvContainer"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:228
- - C:\Windows\system32\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\NvConfigGenerator.dll ,GenerateConfigs "PACKAGE_ID|GeForceNOW;SOURCE|C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\configs\GeForceNOWReliabilityMonitor.json;TARGET|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\nvc\localuser\GFN\GeForceNOWReliabilityMonitor.json;NVCONTAINER_INSTALL_ROOT|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\dependencies"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\NvConfigGenerator.dll ,GenerateConfigs "PACKAGE_ID|GeForceNOW;SOURCE|C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\configs\GeForceNOWReliabilityMonitor.json;TARGET|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\nvc\localuser\GFN\GeForceNOWReliabilityMonitor.json;NVCONTAINER_INSTALL_ROOT|C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\dependencies"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mklink /H "C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\nvc\localuser\NvTelemetry.json" "C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\data\configs\NvTelemetry.json"
    3⤵
    PID:4340
- - C:\Windows\system32\RunDll32.EXE
    C:\Windows\system32\RunDll32.EXE "C:\Users\Admin\AppData\Local\NVIDIA Corporation\Installer2\CoreTemp.{E69FF09E-C246-4796-9063-01C6F533AB74}\NVPrxy64.DLL",Proxy {50E292F0-BFFE-4965-BE1C-3BF294B5CDE3} true
    3⤵
    - Loads dropped DLL
    PID:404
- - C:\Windows\system32\RunDll32.EXE
    C:\Windows\system32\RunDll32.EXE "C:\Users\Admin\AppData\Local\NVIDIA Corporation\Installer2\CoreTemp.{E69FF09E-C246-4796-9063-01C6F533AB74}\NVPrxy64.DLL",Proxy {E4D04751-75DE-465E-A3A0-1747F2AF8792} true
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3352
- - C:\Windows\SysWOW64\RunDll32.EXE
    C:\Windows\SysWOW64\RunDll32.EXE C:\Users\Admin\AppData\Local\Temp\NVI2_29.DLL,DeferredDelete {2B4E25EC-A748-4D29-B948-9B9507E793BF} 4064 C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\setup.exe -noUAC
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:568

C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe
"C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796
- C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe
  "C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe" --type=gpu-process --no-sandbox --disable-breakpad --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache" --log-severity=info --gpu-preferences=UAAAAAAAAADgAQAcAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3728,i,11303924003192701054,2142710277589045035,262144 --variations-seed-version --enable-logging=handle --log-file=3764 --mojo-platform-channel-handle=3688 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4972
- C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe
  "C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache" --log-severity=info --field-trial-handle=3900,i,11303924003192701054,2142710277589045035,262144 --variations-seed-version --enable-logging=handle --log-file=3916 --mojo-platform-channel-handle=3912 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5388
- C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe
  "C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache" --log-severity=info --field-trial-handle=4008,i,11303924003192701054,2142710277589045035,262144 --variations-seed-version --enable-logging=handle --log-file=4044 --mojo-platform-channel-handle=4040 /prefetch:8
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1304
- C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe
  "C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache" --log-severity=info --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=5452,i,11303924003192701054,2142710277589045035,262144 --variations-seed-version --enable-logging=handle --log-file=5488 --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOWContainer.exe
  -r -d "C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\nvc\localuser" -f "C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\logs\NvContainer\GeForceNOWContainer.log" -l 3 --nodynamicload --nodynamicunload
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5976
- C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe
  "C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache" --log-severity=info --field-trial-handle=7044,i,11303924003192701054,2142710277589045035,262144 --variations-seed-version --enable-logging=handle --log-file=7052 --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe
  "C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CEF\GeForceNOW.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache" --log-severity=info --field-trial-handle=6904,i,11303924003192701054,2142710277589045035,262144 --variations-seed-version --enable-logging=handle --log-file=448 --mojo-platform-channel-handle=444 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.nvidia.com/authorize?response_type=code&device_id=6fbc15c310987a72a5b3959be018aa2979a33affcb87adfd612e4b6faf6e97c5&scope=openid%20consent%20email%20tk_client%20age&client_id=ZU7sPN-miLujMD95LfOQ453IB0AtjM8sMyvgJ9wCXEQ&redirect_uri=http%3A%2F%2Flocalhost%3A2259&ui_locales=en_US&nonce=5e457040-e153-4620-afb1-327f41332870&prompt=select_account&code_challenge=1fuIXWOcWDJTz3eu5xcYgu_f8Owyor--my2KoKHgDSo&code_challenge_method=S256&idp_id=PDiAhv2kJTFeQ7WOPqiQ2tRZ7lGhR2X11dXvM4TZSxg
  2⤵
  PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://login.nvidia.com/authorize?response_type=code&device_id=6fbc15c310987a72a5b3959be018aa2979a33affcb87adfd612e4b6faf6e97c5&scope=openid%20consent%20email%20tk_client%20age&client_id=ZU7sPN-miLujMD95LfOQ453IB0AtjM8sMyvgJ9wCXEQ&redirect_uri=http%3A%2F%2Flocalhost%3A2259&ui_locales=en_US&nonce=5e457040-e153-4620-afb1-327f41332870&prompt=select_account&code_challenge=1fuIXWOcWDJTz3eu5xcYgu_f8Owyor--my2KoKHgDSo&code_challenge_method=S256&idp_id=PDiAhv2kJTFeQ7WOPqiQ2tRZ7lGhR2X11dXvM4TZSxg
    3⤵
    PID:4180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 f88007c9278daa48914441b85e38dbf9e692851939cfde853bd38a7eb8b144e2
MD5 4153af2f0d61a2af55df1c7127a5b81f
SHA1 127f1bd391e03bb86d0118164156af58436ccd40
SHA512 276c8270f8bd0564d50453c64bcd46ddf8517c14f7f30226ebe5e8f2a8db6c8c05b656220508f0f9f97047426c3db9012f8567cc0a991160d1293482e170023e
TLSH
T136C0921E40C16A08CF78CD7085CE4984332309DD2340034701F0C030E00A2D04069A07
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f6cf.TMP

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Code Cache\js\index-dir\the-real-index~RFe58f6cf.TMP
Size 48B
SHA256 a8cc222da4fd2fe733f034b9ff1e8ecf17a11aa645c0b71561a1c566b6469762
MD5 96c75dc24e686045a5c5f08fe8c6f167
SHA1 4257f25ddd0c26b12b846785090858bbc8a5ae0e
SHA512 ca216383cde5725b90eff819a4972b41c00167711fe3aa0891fbb54a3e8de2f539f757a4dbf27eb9f47ddb95e4df91aafbc103829de3a3130acd0732731a3b45
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\IndexedDB\https_nvfile_0.indexeddb.leveldb\000003.log
Size 24KB
SHA256 295c121806e69262ccb850d1a5ac67f730ae99548ecd8ddb3d685aa47f652b04
MD5 df430e28549e187edb0fa671d89b3cd6
SHA1 99321d4abde7f1bf6b74fb47d38f532f148d7cf2
SHA512 ed718377fc3ddaecb8ad04e2a4a2ea8eac50bbf2353ec1b14203dd0f018333b10cf81ae5326ed6997befbc5cd206869d4f5c89135a7ea14e3f31b8d454b1390e
SSDEEP 384:LTLd3xeZP81ove0K3ybSen2XeNrwNe+pqeFMjgehkFeWd9ye:nLd3QV81H0xnzP+nWhPiye
TLSH
T1C3B2FD0F74C40E23E91A467199790FE54B377DA26DCBC46DE184F72CCAB2B809975722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\IndexedDB\https_nvfile_0.indexeddb.leveldb\LOG
Size 363B
SHA256 80fa1f3637069d96a8a0fbaff8585bb68b0de52c96635f2a2f892c5ed8bf4f2a
MD5 f362947d2616ebd115e06aa990474898
SHA1 d60aa0fc2608f247e55a53bf2c859ec6835a3bce
SHA512 24c0956aa9c08a9a332957bb0102fed1a0c14341de49a6bf43b520003939c387181b806076f07afeabe825043ec339add9b0416034a3678b5ad4fa7b0c4090e4
TLSH
T1C0E0689380ADC22F01644067B2303B4BC233B88C9A493C840E81E92CB3C5408DBDC542
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\IndexedDB\https_nvfile_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Network\Network Persistent State
Size 1KB
SHA256 10944e9d11f8e8ffd8bd35ed9b701c7fe53ad376b4a33785672a782109acefc4
MD5 a8c689d886363f4ad33593faad837e49
SHA1 4543d0716b5882e20ebf7d6081a374dc60b3ec4b
SHA512 b473b82ff701bdab9067129aa01f329517af45a9a9d5e374216a9b13dae003511f80f85a722dd00523ec6005fc78a537393a5fdb3000561fb27d87249c5b3c19
TLSH
T1A2319DF7C3B8493ECE5151F86A202F17CE1D4505435C3E5686D06F5BD3E1860E291A8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59c029.TMP

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Network\Network Persistent State~RFe59c029.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Network\TransportSecurity
Size 522B
SHA256 b320d0d3cf3aa1baee736c2928df085e7b3b0bf853ee511e9a42cb64c6839311
MD5 e4d7673c32f70c278227638b242009b4
SHA1 33088c6379c76cfba7aae1c64711b49965de916c
SHA512 4c1a4203b2d601ee0a0242b2e0792d052377a43ff11b3644cb53316dba8bcaebf75e722a537a71d349207c331d109ec2e4f75780d36e6f57f4ce392dffa3d70e
TLSH
T1B6F0C9975479E42B20FA1C6B2E04BE0A3A3DF030215060FC8EAE962CA0428BB8602563
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59c6a2.TMP

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Network\TransportSecurity~RFe59c6a2.TMP
Size 522B
SHA256 dd68d7babaf8b43f09ca94bf35ba29f4b0cf2cb68fc08076803a486b697f9efb
MD5 105b23cf9523480bf80d8ecbe5572725
SHA1 03502bd700cc44886cbee7af115af5f0bf911c23
SHA512 de6d8fd2e9ba1e8b818369a85780cc3a7f7a18adfd75139a4159d46d7925f1e5fb91497671c19d78ed486c5b7e77786db4c6bfa323fa61993aa4c81bf6e0eb41
TLSH
T10EF0C0974939E06B20FA1C6B2D447C063D3DF034506150FC8E9A465C60454B78602543
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Preferences
Size 7KB
SHA256 6c75e60f2573ad45b98fb66cbed814c6429fec39a9477158e883251a5860ebdc
MD5 b5c9206faf59b17a04bf9f6555db593c
SHA1 5d6cff47722a4de28ce5c27f8b4658cde69e8b29
SHA512 154c75a5953c290cad4849870a60050e54ce5c75bac787d100e36a78dc4ceea8941ae0ad5715ce2ae345e1b8bba5526f7f3dcdb40108cbadb89b394e602c1316
SSDEEP 192:r8KS7O4qe7gPRpTSa895HV+Wi6YP+rTRVHTyIsnAwgp:r8KS7NCXma8jEJ+rtVDp
TLSH
T1FCF1951B6D68997F4CC6E719F9267B42E2F6102179D03D88D7FC8A1C18DBADC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5905d2.TMP

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Preferences~RFe5905d2.TMP
Size 7KB
SHA256 d8de7c78f13a842e79341f438176017acbada5425c568c51dcc37e1626f5ad2d
MD5 b68152ef3ba48c7c1da92d252d86a201
SHA1 ed5eb1977c8baf231fd6855109fc83c9462c879c
SHA512 2862bb1fb9dec1a98dcdb7bef2bc48b8af8ba6d127cd31e2e0a31a04616e8422f62fba8ba61f4aedce25313d77e3c67107ab7594df8c7012209b3c97665e3230
SSDEEP 192:r8KS7O4fe7gPRpTSa895HV+Wi6YP+rTRVHTyIsnAwgk:r8KS7sCXma8jEJ+rtVDk
TLSH
T149E1A51B5D68697F4CC6E719F9267B42E2F6102139D03D88D7FC8A1C28DBADC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Service Worker\CacheStorage\bf019c9662be08b9c995c6b73c72f23faaad1ea1\43215646-8e91-4788-9fb0-3d9e6e52bd4f\index-dir\the-real-index
Size 2KB
SHA256 1cac02f8d31b7553a9ae16ee31d4cfdce3a1b3d1cd05a4c275c3f34560e35156
MD5 6c2e98ba1e40b5288782d03b269d3cc6
SHA1 a6e4b013e871f565cea67fb2bdb9f0090833c91b
SHA512 92d5e3d80cd302da6cd163792a19020a65af1b46c263a129e537c83ca3a6bc3deec196cb7dd85b6f59245c197b3ddbeb98e8b462ac1a083fea8385f1b1e9dc06
TLSH
T1B0416219CCA1DCF7D615B9B6782B109433204DC4298A4F0A576DF5B8EE0E00D58545AF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5901ea.TMP

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Service Worker\CacheStorage\bf019c9662be08b9c995c6b73c72f23faaad1ea1\43215646-8e91-4788-9fb0-3d9e6e52bd4f\index-dir\the-real-index~RFe5901ea.TMP
Size 48B
SHA256 d1c4b81daa5a49ceaa17a1821d7eac60a7959ca1f502b6532b0f2a77d485de0e
MD5 e861b5d18143ea9c6d269ac84c16c16c
SHA1 3da0cd1889ed99382e62767ec010207ae8dc4581
SHA512 02bb821458d58fa3e4d4b6c55849390b9931aa6af806afd5f8e9e45b4094a12e4eadd147b0780bd7a545be1326ad937a53c4fef0eaf0dbae007d5d06007969b8
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Service Worker\CacheStorage\bf019c9662be08b9c995c6b73c72f23faaad1ea1\c8b403c4-01cf-4513-a2e4-5bde038fb8a4\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Service Worker\CacheStorage\bf019c9662be08b9c995c6b73c72f23faaad1ea1\c8b403c4-01cf-4513-a2e4-5bde038fb8a4\index-dir\the-real-index
Size 72B
SHA256 25e8e0186d570ef891cc1dd98046a3be74cf993921c7f76ccc216ea493d7f5a4
MD5 e259240e82f2a984a01e712f65c2b3c9
SHA1 07226680629af6f9c0f079d16345e9f63c1c9cce
SHA512 e3d449e1d9613ddf352eff488eba192e30c02b49b0bdc22765598f57213e68a03761fb597478e1642046661d6408cb3f901430d2f757a88057050b7eb09e2e69
TLSH
T10CA0021855504041CA446BB5F0D185C22F34C95A43124605599C484489A41855113542
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fa0b.TMP

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Service Worker\CacheStorage\bf019c9662be08b9c995c6b73c72f23faaad1ea1\c8b403c4-01cf-4513-a2e4-5bde038fb8a4\index-dir\the-real-index~RFe58fa0b.TMP
Size 48B
SHA256 b5616630e1bb8f7a33b36f7933de604da9d6ed1c98a658cf2251e1c2dd74aa25
MD5 81c475931a90b4f3ef020b76b31ae4bf
SHA1 eb345ccd6f57b62dedcb1db7a590fc7e8a1c1360
SHA512 22c373027b7ce8ab77d2d3c07964d8a02bae334db5d954ea8bd9173e5c1594d675890c4be8a98fdd3d95c52eb0c6ac1a810e26f18edbfc1885c15b2d967e82c7
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Service Worker\CacheStorage\bf019c9662be08b9c995c6b73c72f23faaad1ea1\index.txt
Size 184B
SHA256 2b7a29efa553ad6b0145837ff554cf8eb5643540325c5b0dfc73de7c2d78005a
MD5 8a747ed877a5eb046dc0f520a28dc962
SHA1 1b704e062d8126bbb6c31c37a1a619942e091a1a
SHA512 b744515637e3c75006b2a2f300723e9f0938a6e04a8c8f807d095e62d1bd79fdc72ead96590fa79477aee118bace22b0e2b7696c962dd7d3559d499fbc7fb30f
TLSH
T138C01273030460B13FC5C2DB6501734AE476CDC689D95B499246B685ABB013364492A3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Service Worker\CacheStorage\bf019c9662be08b9c995c6b73c72f23faaad1ea1\index.txt
Size 181B
SHA256 e6ddae3e237571915051d8a359db96d8506933d027a4a961e1704c0f317799ae
MD5 53289fab4fa86ec9bfbc1709af51af77
SHA1 65d5060a96514c448c6068d26b1df5b86c9d8d06
SHA512 6450d5cdc938850347bf3212eaa0fc7caf871b3c14d57cb9635cea393516a6fda4390addc235b4ff7ee1c1bc0f98576ed3c9f4198a4e400aff8df92f48dab04a
TLSH
T161C01263030460B52FC1C2DB260133CAE436C6CA89E85B4AD302964597911321449672
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58abeb.TMP

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Service Worker\CacheStorage\bf019c9662be08b9c995c6b73c72f23faaad1ea1\index.txt~RFe58abeb.TMP
Size 114B
SHA256 4a987aade7159d9ce68902a6f1e725c152d5f199889da0aa4f35e2bcb95a55d1
MD5 68b21c3a2a40b4dd79c4a7febec992f3
SHA1 e51e981470fdc32c0a3e46cd3d99f16039f86912
SHA512 0aa1d2ee0f7e4cc993f932f6c71ca2fdedf2c4a2e2aa479f07a3451439ecc45ccd9db13049560335fcf8ee8a06b06f573c88384fd1eb63a1ebc0d73baaf8ba95
TLSH
T135B092A3425050A42FC6D2C7A561734AD46ACECA88E82D40924672802B705335096206
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0dbe8af3e18fd3249ed33c3baab7ea0d05aaa7117843e427ac140a090c38cecb
MD5 609bc4f3ab4f1af48529674111e27ec8
SHA1 9eb93437d824ab77063fac9f1ddd309611f13f79
SHA512 638e2358d0c7d81b767c6bd248ad5a26ce45d3af97e49c8509287f8030423a8c1359cd14c92b241189bca9ca36c543fef2d84348144d5f4d7f1f746c98325f9d
TLSH
T195A002150D518151CC0402B01EE52A8422546DFDD9A16352A6E20697BFE4574921128E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fa0b.TMP

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58fa0b.TMP
Size 48B
SHA256 87b1852e25053ac8e338db5d3aa4d61b2ee4145a10a92fcf0435b2f6c468ce1d
MD5 fbdd184c8c12a50769def9858c9d2952
SHA1 0e3ce28d88888666ccc3069d30c4e86a437d56b3
SHA512 5ebda6f2c5eaf7e1a9fa0dd40d57201de4cc71e33e0ca72703a5226e48882ffb96fffc774673a54bfe7a07a1318cc5cea1a5a8833c2ce59d58281bd48f3eea85
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Local State
Size 5KB
SHA256 f1ca3c75e5be35b744587e19580a5349c01a5fab3e32ab79a6e37376d3988a39
MD5 fe671ca41752847cafd31d84b79a07e6
SHA1 306fa54fd2291b1a3df2e2db53a5496fa3d025b6
SHA512 183c12540a7f331f394d86d35b83374cb91b498b003fc08e56ffd18e05903d9d2128a26ef4d6e2467e814a37c21ca32caa48a23a7f219630430f2cd9b907e6cc
SSDEEP 96:KIbJ8f6q+5+DototPcWBmoqYv6nO3VG5QYojQnopsFa:KItbqDUwPXvV+QDKo9
TLSH
T1CDB175BDF5AACA37EBEBC6911A03F7AAD750121956404AD48DD94E8C40DF5EC350381E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Local State
Size 1KB
SHA256 384a2ad7bcc42512c99d9332d82d9d929881d568ce3c2c915a9358a42adff964
MD5 e2b98a3fde3fe03710f9f7258261eea7
SHA1 261f155230a86a5fe3545625ce2186d15ce92d75
SHA512 4e21a154894772212daad3ad39fef3eaab5701cdd7b369000ec7a91b7e2cc7f72f6caf019430dca7df798724a8223f2805db8bcff75f7db5336486e359cfcebb
TLSH
T14E116875F4D04B65BF5A4525734A7F731D711425C0204FDC61CF1B19015B88D5623C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Local State
Size 2KB
SHA256 fa41f88ddc09c3bae1b84bece9b2df1a6e5c897cbeaa485e50459bdd73dbac2a
MD5 3d6551c49141b862c86f48c5b084954a
SHA1 81e41f09451240831d5d1e5ef35e17c4c2280011
SHA512 93d94693430f533683f623072adc82773e4eec861f2fff615cbd8085d723589d5691add546c8b6090248a5972b732f6f8b64a743e6d252009ded215c975999aa
TLSH
T10B518436B4E98933A667D551B6473E139AB6212AE1206FE4E5ED0F0C01EB9DC1313913
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Local State
Size 2KB
SHA256 2deeb004e745f470417bf7c00ec48e6ef0c33b4daabe7a6207f0ba7e7c0a2886
MD5 a0c5467e7ff5f170ca0614e92c00a977
SHA1 c005b859abbafd90bac3d88b641ac97d236f4705
SHA512 abf1272e78b357a7413058c1559cee01b03d4adfd699c7c3e4c8a37ba3dabc06245bae9373fe0645d44924e37235afb91e27ffdecd482d1a256206c78a39780b
TLSH
T18A519336B4E9C973AA77D551B6073E139AB6252AE2206FE4E5DE0B0C01EF9DC1313817
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58a090.TMP

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\CefCache\Local State~RFe58a090.TMP
Size 889B
SHA256 848be5268027274f8d93b267a6ca925b0fe72ac6547a2c4a67761bc4a2ec3b51
MD5 c2bd9ddfa2187055b470d2f56ac260e8
SHA1 94f68c781fbfad048ffd54db587c5b530484b2b2
SHA512 cfe1eba9a9c72e615d78fa2a37c18eaabcc349f7bc29c64d8804a2592c2850da10b981783de3610598aa84260fb3d9825065fd8f8cf6af153270a4a44a86c689
TLSH
T1241152B6F8D04B35BF9A4525334A7B571C66281AC1200FEDB1CF075900AF8AE9A23C36
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\debug.log
Size 18KB
SHA256 b58869cd443b124bbca5a28e478010d91ca686a54fad0017ee7bfa509cdb5cc8
MD5 5b8f4f6fe2f721c4f48f9abc902a96b7
SHA1 c2ea90254be0e6e4ae0dd650df6708d82dfe7ad4
SHA512 9bbb72ce068ca281ae33eb8ddcf9cc5b0048fc2f9e90905c117e0664ed106573ed0467314b6bdbaf066bccf11877248ee7c25d6e0b93f8d61f85ed2f62a5abb9
SSDEEP 384:AHICKcnlVP7que8buBEuppfmxYahVwYwDwxk:EIjquue8bqEuppfmxYahVR0ak
TLSH
T13E82CB8144BAB1EB0F6C08FC93B46AAFD233B6C5868645793776B0D83AD54067BFE054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sharedstorage.json

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\sharedstorage.json
Size 868B
SHA256 76bda5fdc1a62c168890f2f251a5f8db03640eed51527bd2f22cd620a347f3b3
MD5 022c75b4ea0922f23bfb57b957e6a339
SHA1 488aae157a473c516cc704cfd132e3b707716749
SHA512 4f1814099ddb0d7ca19cdf57c5048a75f928fa4b95733a681511f755596e8d1e5453712aa793cecc6490df549f7ccb5c47175a9c2cdbccf147a9d25673bb6690
TLSH
T15F11AF83778C1F66FA19B599C84DEECD1E18188446D004883676C066876F6F67D9F133
MD5 SHA1 SHA512 TLSH

Submit Download

sharedstorage.json

Path C:\Users\Admin\AppData\Local\NVIDIA Corporation\GeForceNOW\sharedstorage.json
Size 6KB
SHA256 b4ce566248f8a251d79a80549cde7e48c417033482a0d1fae88e0079f79642b2
MD5 0b4c47b7c95415f0a79e4f23954fd423
SHA1 e1b851d4190f85eb16f543b1ca36bbde20780384
SHA512 16282b2716316ee16ec2ffff6900a7e4834111a7d8f8f24ecde7530a98d2015be800677f7140dc663244f222f6c109fcd1970cb8355d3b90ee66495f7dece944
SSDEEP 96:P8f4MHNG4AB/xK0L+l+d+cRFinxuYq+GlAgSMGqkjYP/SC70WRgeQG/t2CS2FeyD:cX8xK0L+l+d+cRF8xwOnqv7hQG/sCVeW
TLSH
T161D1960F15147DBF95596F62F4063F896F7C12A32088144C55BEE54807BFAED111FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.setup.exe.log

Path C:\Users\Admin\AppData\Local\NVIDIA\logs\GeForceNOW\Installer\LOG.setup.exe.log
Size 865KB
SHA256 163cbf958783e64a402a82d962b8973d2f9f8a1b4a5adde9da7fe68a7927bca4
MD5 9016470c1e4a2417c4f4c6877f6d0b4f
SHA1 067ac7b76f9f9612a860d88d232f6dce45abb51a
SHA512 2b7a26249946769e244b97080321e26998f80474877dde74ec1b644f72b218c56e5a0e37566bffd8f630c93e9879f69715079be55183f2733ba966a9fb7c5b22
SSDEEP 1536:F0TCDc1DHb1BSbgJpdyMYuhWGRrL9fTj1DnyjDL3nSYed/JSH:eCg1DHZBSbgZyVsWGRrL9fTj1QSYeVYH
TLSH
T1E415BD912D0D726587236D6B1393E18EFE7699216A9A8644F10ED4842F720063FFF3ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultGameArt-TVBanner.svg

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\GeforceNOW\Mall\shared\assets\img\DefaultGameArt-TVBanner.svg
Size 15KB
SHA256 ccd440cdd1763f761e1966fdb58a0249215bb9971c961ced1212f55ee689edaf
MD5 87a5f76f994acb2e8b731159b9abea00
SHA1 8880d369ff97010925b45c92c56b0078970d839c
SHA512 762f7af197fd1e6fdcf63fec4e02b62e2c5256dc6656dda3285688b9dafe58494fa871c80fa76b51de78a930960ac85f174c5d0518f76481d25c4dd015405bfa
SSDEEP 384:Z57ajkKUpoCG5+YUjkKUpoqVUaC3eI8axQXVNmjfePHxaHr:qj9Vgj9VX4Pj/xor
TLSH
T1DA720D8D23186D7076984BC5EB02F068122F6473D7977240D4503B39886E9BE9CBFEE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0000.ui.forms
Size 21KB
SHA256 35d82011c1017f416676fce9c684edc28c2d182308545bee6b8448d64e66a588
MD5 3555d2a2e19ce6f0828983023974f4e2
SHA1 bf26c703f871652f03f0b747424b640d5bc85fbc
SHA512 23fe0bddc89fd21ba4e164afb51e3ea241dc639cc500311b9cbc4c99e99c4d40dbf3cf4aac9740e4929bd84221f0a21d3f0ac0172ac5fb2c43021ef12380830c
SSDEEP 384:4zypL8lq7Sg4RILzxEmRNhT9BccLOuZRtMBrT/OOBeMAoR5K:4zypL8lVFizCyj9BcwOI8/z0uW
TLSH
T186A2F300E1619E356B714A29BF92950FDE55F4E3C24C29AA71DD77672FF2C2220A324F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0000.ui.strings
Size 1006B
SHA256 4a150a952446aff1822aab07687c16185530120e31f5c0966f2ca33948ef535a
MD5 36213e67ba727b059d8117eea2d3c24f
SHA1 20f5c6a4b5e143802d7dc3752ea31be1a999dc4b
SHA512 804444437183ca4aac31188b7d62dac0fa7d0e308f6475176692c66dee67b08e1efba9aabc98ca758df1ef1abc674258be92f93cbecf05f4ae3b498646d3f8e6
TLSH
T13F11E79455A2CFA53F714F322AA03D48A41CB0B2A62827FEB9EF79365F326451137251
MD5 SHA1 SHA512 TLSH

Submit Download

0401.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0401.ui.forms
Size 1KB
SHA256 87905b2c200545440e962335b743b34ede515f95f425d198f46bb9f5e4b487c3
MD5 e2406e0d941be01d43651df04e8afe2a
SHA1 f26837313c7830e0c15c6e191a457096356ec70f
SHA512 e3f85b7c1fa88da5cb5892655876ffb7a8d93d87e3596b38ca4e5d8bec00ea3252218017b14fb6d7e86e9c64de7937faf21b8f9c18dfc111b0524bc71dec53a9
TLSH
T15021246640225E233F658BA8ACB79C49D7680774132D990210DF6BB3729F76F35E7306
MD5 SHA1 SHA512 TLSH

Submit Download

0401.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0401.ui.strings
Size 11KB
SHA256 5c24ab18a9fad7a73fb1ffe649d34cb03c2bf1d24ea83b9fbcd9e36c8953ee98
MD5 cb9d66c5df2ae3ad2524ee608775152a
SHA1 345861692b2450a77dc078978daa3ac2b73f9581
SHA512 b825b9ddc9644ede5021000b227c55fcac1c0c255b548cfef62c8a0c10b694c87aec56f78d8c65320db5b5de7d98a356cb90e4542194db288643df6fc378b448
SSDEEP 192:Bzd6Ia/UkgANfoQWkImKHUDm8vQdQ8FG/COPOD:Bzd6IEUkgANfokImgUD/v4Q8FG/e
TLSH
T1C13257A07915FF601F491F2685F13C58A47E9C32B369B5FAE8CF322AA3E39019575231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0404.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0404.ui.forms
Size 2KB
SHA256 58f3f230f5f311189604f385d360fb22f1c995fc88bc672122658552eb369676
MD5 04a58c0db145ea00b34def604830ad9c
SHA1 4f00470c86e2bd0fd5aa2232e2fc7dc6bc66f76c
SHA512 25c6419a26a7c36fc90fb70addaf5d6490ea88e507da9717aee4218f7fda633e87deb40af344dac5ab7ed5ef0772a3ec98b40ab4f5047c8128687c598b3cd57b
TLSH
T10E51554241424D733E710B647CB74A18E37898A7160D1E5A35EF0B963FBB22F91E364E
MD5 SHA1 SHA512 TLSH

Submit Download

0404.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0404.ui.strings
Size 9KB
SHA256 673c752874b02427975d2f45e4b4bc013f289684cde9d76461730fd2d68a7c86
MD5 98302c1a23ad15ce6265c6353f114d0a
SHA1 1719c5698e297dec1c31a6f72f955b465ae2595a
SHA512 70d7820f233a1f78059d05d43a6b72ebcdc4c8360de4e0fc4ce6afa442f7dc58fc8994af0928d8e1517f5c62ad2079878a21268ff0b9e0ca3fd71c2b46a11431
SSDEEP 96:q3/6tBuKTEBcsGF0oqxX2YJipFRb+fDck6qddQNQBG0FCvE:vPfEBcwxXnJipFRb+f4DqHQNQBG0FCvE
TLSH
T1F6224225A9D9CF645F321F265A922C119C6C30B2B66A30FCF4DF36878B739241A73436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0405.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0405.ui.forms
Size 2KB
SHA256 f600f3dad65e099b13d50118f33b6e738cda48323fb6c97e98febf9a05360684
MD5 98706caf31b104088c15172ae1013936
SHA1 9289d23e8f10b82450cc42f3568269cac5e0403d
SHA512 63a186b0d378edbb35139086d5505c58c648c4405ed6153d54917750f5b48188cd43dc219b7bd5628a1295ec0c4744b8981a18d0c92c34c7d9114c973c12e398
TLSH
T1E841450245420D723E714B647CF74A29E3AC88B7160D1A5A35EF07563FAB22F61E368F
MD5 SHA1 SHA512 TLSH

Submit Download

0405.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0405.ui.strings
Size 10KB
SHA256 385823a9c35b57a4f647b45c4781656216c8f7c315c75eaf74b89f33905d016f
MD5 b28a78a0d2e47e8c291e68bdd3d91ac6
SHA1 4580130d8d90297c4bf9ba6db8776ce106654d9b
SHA512 5cb6f7d453143a5dcb123354148e38accae016eb49c2d2321c1178672ce8824c8e9bf88fd90d678cdc679cb5024884680c731a112d4873f0eadb05fbce66d90e
SSDEEP 192:8ogbgRbdc17ryKvAHAQ4lOfCfGilu2wvhh2virFOX0LH7Src:83sRbdc1yWAgQ40Cfw2wvP2ar20LH7SI
TLSH
T16A226324A9C6DF206F651F666A963C01AD5C26F2622B70FCB9DF3547CBB39050873172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0406.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0406.ui.forms
Size 2KB
SHA256 0ffb55d1eedfa98bc0f6b95af8829e66208e3a5f14116dff8bdb6d00bd07a25b
MD5 9bbd641d037b6ae1b18d36a1603e185a
SHA1 da3fcd0d5f88ec530c4b9dafa359251a7298d329
SHA512 5acae567a260dbca0882ecd8ef8d0f451350455b2c0e59b56231d4c18180ac14c7185075689499fe49719bfacd4ee8a074e1ee9aeee66490469bf7d1a447972f
TLSH
T1E141140241425D723E710B647CB74E18E3B88867160D1A5A35EF27563FBB22F61E374E
MD5 SHA1 SHA512 TLSH

Submit Download

0406.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0406.ui.strings
Size 10KB
SHA256 9468c2677837dcc36928a301cc4f14fa5467fdece3f615d07d94dca08b32c14a
MD5 0bc80f6dbd8e55385e5c32121d960358
SHA1 4937edc766c7b97f2018359b4828de728cf18b32
SHA512 f655d0b0d682d853a88303893106e640af8a747479f7b1ee2798f10a53ae460c4aa8e7ba79e63205bad27f37cd826fecfb01bd243554c8c89544f7b5183749d2
SSDEEP 192:Cvnntv3vFBQaIPjo7y4dJr9/JMkdTlvAB1rcvAFSPS0XAVyRQ:aRfFBQaIolD9/TLA/sAWSye
TLSH
T1A0221224A9A6DF205E651F6B9A962C11AD5CB4B2623E30FDB8CF315BCBB3D040577132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0407.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0407.ui.forms
Size 2KB
SHA256 b00b51bada50e03bed0c5362ebde3e1de370cfe4bc2ab9d6b3e6a2fe02d40198
MD5 ca383e2efea67a6c224da6c8efa40c56
SHA1 93c328438bb8d09ba598b74a5a3aed4cb1ba653d
SHA512 4b72895ce233ad9c8fe3a645ac9b9b6634905050957c57a592c9b89dd65d682663089b737d850af39f33e42ed66a782c4a5e7a9b00cf88a1bd7156586ba28204
TLSH
T1C341560281425D733F720B647CB74A18E3B888A7164D1A5A35EF07563FAB22F65E364F
MD5 SHA1 SHA512 TLSH

Submit Download

0407.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0407.ui.strings
Size 11KB
SHA256 9f03201779ae43b5ed99de6c1284f7dd47246ca483216fcd9f7afddf151b1415
MD5 9822a77f8cdea05e481558b77e6dc34c
SHA1 0183dd53dd38ec43e77173d2fa97bb8ff6bc1a6a
SHA512 6c22a1ce43540780c437d37aee9513f006e94f489b7eea0a47137e92ee8ab639b0ba88ece08a3cacfc1f5164c75de0289114aa388ee9d6470316c99c2b9d510c
SSDEEP 192:8Hb1EOh24pIfr3DrXfDpcGkTWcVfNll9v:8T24pIz3D7sj
TLSH
T1D7327720A9E5EF245E262F665A912C11BD2CB1F3622A30FCB5DF7157CBB39150877132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0408.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0408.ui.forms
Size 2KB
SHA256 739f4ed43308ff22b206e2698e976d5c01087c0b18655214ecfaed19763cfbd1
MD5 735e7a96d32393a9cd4df87e3fa00a57
SHA1 e0a4a16023032bdf104eb2cea4b1280c15d5b9a9
SHA512 cfa848af315662886c3c3522ee69261a11a4723d838eeead6ebde29f887494481419f442a9378b6db9fc50c0cb963b09bb2c5bed742201346ed2ec19863df0b2
TLSH
T13F41590241424D723E710B647DB78B18E3B98867160D1E5A35EF07563FAB22FA1E364F
MD5 SHA1 SHA512 TLSH

Submit Download

0408.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0408.ui.strings
Size 14KB
SHA256 697035f886a98863de94d676006495fc8f3483d50670332a14c2b192e32935f6
MD5 226c605629babdb948eb695c49300084
SHA1 c24bc5aa38ae25eaa3410f3c7dce2ab67eb2cd98
SHA512 66f4c887fb0e454cfd2c32a0171489e07638bcb3655baec69718b1cb23eeb7a14afe2f3947b1bf70d36bd21b9c129f4beca28984f2d52a075ae2ab53ba8223fd
SSDEEP 384:NboRwTZLhqzTahhGxYu1sMwZwhqfkkOw2sND:5ZleckoyhmkkD
TLSH
T18B62676FF885EF644D114F1348D078286B4E2C79632AD1ECB0AEA722FBFA4505433927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0409.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0409.ui.forms
Size 2KB
SHA256 ca0499e31f6655c76aeebac2c87aa08e706d005343a89cdb8bd7744da61c9766
MD5 bfa9b8b200b4666f9901444510abeab1
SHA1 99b430cc19d1771132930836fc7279f83ad04f91
SHA512 f4f03e46fece3a6894a5b7ea214195fccb74ceb82c28a23328c2cde622e05a8c8067ed2816f8bafef8fb3625052e31012c3a099edb7bf1120c9da0f4247c8980
TLSH
T1AA418B2241420D73BF710B64BCB74A18E3788867160D5A4A35EF07563B6B12FA1E368F
MD5 SHA1 SHA512 TLSH

Submit Download

0409.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0409.ui.strings
Size 10KB
SHA256 c899be1d616220b0e61dd097926ee57e8de91692865e2539500102b9220d35e3
MD5 9eb1260200b9876244542adfde3e3827
SHA1 0651354da893285e19dc64e7ae627b315420c0ea
SHA512 a6d96e8cb74d31bb23754058e5d703514c27eb64236343548afbae2420b6a2cbbfd8def2619c7f996b44efa755ed5f4803b622ff65e8c7a9dbff484bd6b056d8
SSDEEP 96:qg/3CAsTygaZjh0mevS1h6CEQqv8iz0Secgh6a2lMkmhY/Eq5TUQR0:zCAsTydZumR1akW0SecghF6Mk/dVR0
TLSH
T1D6224024AA95DF246F611F675A922C11AD5C61F2A33A31FCF4DF329ACBB38490577032
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040a.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\040a.ui.forms
Size 2KB
SHA256 8d1ac57746359af112bc673595047d54f04a6db95749044d9ad5f106383919ba
MD5 2cc6066a40acc3288afcecc449499e66
SHA1 1dae3e8db12d902a466d28b1c13d835698d6be1e
SHA512 53e45b217aa9c0ec5cc0379c0c1850f87d4efef92e85f798c5b801bc30d94b29dbea4aa066b94320c41f66188d3f9b498fb4420c7a8d0937f7bc6faa064af861
TLSH
T1C5416A1241410D72BEB10B687CB74A18D3788867171D1A5A35EF07563FAB12F61E364F
MD5 SHA1 SHA512 TLSH

Submit Download

040a.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\040a.ui.strings
Size 10KB
SHA256 6086ea5d3744d1f16c8920d74df59e8cf609031975a60a4232e27b135567d8da
MD5 74f1140e288cc7b9f52cb22c864151fa
SHA1 a2054fee86beeba036ee997682a327e86a527812
SHA512 5e35d8eaaa85545b889bc1f384d0b10a3ca739f9476a9a966eb14326fc000ea817cd0d3ae734f0a3b9db93ff58d19808e5ac842d87ddb40db65b702765f9ecb3
SSDEEP 96:qA/sQjfACD7R1jpA6jhCrrHYuaZOpOPmxyMILGW3ZahEAm:AQzAAjVjIX4uxcT7paqAm
TLSH
T1CB228624A9C9DF106F621F6A5992AC12ED5C64B2722A60FDB5DF7257CBF38488433072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040b.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\040b.ui.forms
Size 2KB
SHA256 4e8111e3ab73b34bea12381f0a534900cbafb223b4e06b669b3f773074320805
MD5 2fb49646572defe8fb7b70443ccbe119
SHA1 b8c3777b7a3909089ce99255d57cbc9c30f5671e
SHA512 a78af9168b2ad682735d195d8a891c8159dfbddb38800f09da5e23955653b9eaa59b100b30ad781034a64db4cf6482d4885711a59f21347d709d0efc62bc7c75
TLSH
T13041160241425D727F710B64BCB78A18E3788867160D1A5A39EF07563FAB22F61E374F
MD5 SHA1 SHA512 TLSH

Submit Download

040b.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\040b.ui.strings
Size 10KB
SHA256 ad6589d8efd1c18d70ace8e713f66ea1f3d6df8d0c80b38d9b3e26f9f2f7da67
MD5 9b9803dfd61df3d7d068b8484fbbb5e0
SHA1 0f32a99141a3034ea9e964d365d70f9668614156
SHA512 3c07e6e15d3ff955d71b5722deab2d6532425aa744616484cd5cd9d7fd46d2861fffbb3c93563b558201e4a285f43649a1eca695a9194359bf06fa6ff8e848ed
SSDEEP 192:DVnNnZJCDUzDtec8NARjoZwDFt+UnlyJ7nhCS:FZEUzDtevARZDSU+CS
TLSH
T183225235AAC9DF602EA51F265E916C119C5CB5F2622A24FCF6DF329BCBB78441873031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040c.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\040c.ui.forms
Size 2KB
SHA256 d307e59aebc2c92098114de8ebc3ce0a2b14f7e91507ac91a4728128dff03197
MD5 48e4151a0e76223c1f13bf4a3bf4bcfe
SHA1 523a124dbdadd5ffee8b94fb321f0fcfe3b01ce4
SHA512 cfea077e760e990cdf5b8be275bba906327b95bf85da8a681751ac79df891aa970950abab80e7ecd9d99463d521c067aae4d45fff4a67659d507c075667a71f4
TLSH
T16D41260241425D737F710B647CB74A18E3B888A7164D1A5A36EF07563FAB22FA1E364F
MD5 SHA1 SHA512 TLSH

Submit Download

040c.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\040c.ui.strings
Size 10KB
SHA256 19b004f476d1acd14ec3134ef634bde4e154a1b5879df8e9bedb5c0629048ee4
MD5 d22e7e53b9bc7cf617bd651adfbea8e9
SHA1 479a48fc0e5f9e74b0094acc1c2999e2fbff0cd8
SHA512 793503782afcf78dc1a13333ad33e352c8a9db9ad150fb5f09ff58e158a414fe67b08edbd1e7129f0fa76f7f6a5599ef584cf420141222c5bcb358546a47b3e3
SSDEEP 96:q6/GSpAVewYNXlKEhpgiKeubo04tBy0dc5oSHNYiYNQ+3oMcH0cNL:8SpKcX1pgiKFo/LOxtVUP4Mbc1
TLSH
T1FE327924A9A4DF206E612F675A822C01AD2CA5B2723E71FCB8DF3147CBB7C154577032
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040d.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\040d.ui.forms
Size 1KB
SHA256 53001cf9f4850a9631c66e4b068e9542d835024a8cda9b1927cfaf19c8b53dde
MD5 2003bfeabbda9f60d592e7e948032d76
SHA1 80a20c4629fc796696b74cf60354f4912ab998fb
SHA512 827e5f66e2cc5c3fad7fb441023e8eff9745ddcaa354f1b2753a433091590e6252f8f652debbba32245a56c1ba5bdbfb8d5f461906968e8755048945f9f13483
TLSH
T16D21936280225D233F6147A8BDB79C48D7680770535DAA0260DF6BB3729F76F29E3246
MD5 SHA1 SHA512 TLSH

Submit Download

040d.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\040d.ui.strings
Size 11KB
SHA256 2d30997468f63fb80da83642c3fa4ea7b40a7a2dbf1abbda5decf169735873fd
MD5 d9faa3a4aad6532a96a8db184aa4d940
SHA1 bb21188f311ce91a0f097045831266c9f1bd99eb
SHA512 fdb627ebf8e2b78ffd61e521c3a1f47aff0ba5e03bf2d0f09ae5dbb3bf00e5728e67292e717b556e6e0a95f3583a93629b07705032f3dec816f23e8ee2cb1173
SSDEEP 96:qhHBMR563YqA0KDRbms3i16DXA2UB5jb511oUWywtiHOCELE2scM5bWOPOD:e+56ytRdojN11dwtiH5EA/cMZWOPOD
TLSH
T18F32E6A0BAD5BF101E355F935EB1A8142F7E4D713A2631FAC6C8327EEE774959832021
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040e.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\040e.ui.forms
Size 2KB
SHA256 29d80aa69e348bbd85c400296cb59489d1a7514a501053d5fdd08226f11bfcdd
MD5 272752860682bf43819b9a9605a42dfe
SHA1 1164be5ef3a1f43ada89a3f32e1e8815c5a3117a
SHA512 00d831ef3d47fb48fe6146727bbbf8fc0e02ded333f68466e372ad4aca5d6ccc67163febe81733e270b7ada731ef4b9c9f8f70b087618b7a25e074abce044643
TLSH
T17A41120381825D723F710B687CB74A18E37888A7160D1A5A35EF07563BAB22F61E364F
MD5 SHA1 SHA512 TLSH

Submit Download

040e.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\040e.ui.strings
Size 10KB
SHA256 459121222fe1e10a092222a56e5b925c413e8af59dea08140534c0dd7f87ec02
MD5 fd3788a10b27747ebc49495bd8810836
SHA1 3bbf8e8f98bf4ca08b17cb791c994f74ea4965c4
SHA512 2b13afffbb1e0d724b8bc8280dbccf37103622444afe87c4010c834fe35e27ddc16a29c4dd70fb74fdaab592df80f25e4c7269e0654b305dcdc5f2a906121bbe
SSDEEP 96:qm/GbXbRQJrJgr1UvpjuJiMQBy+a256LmZEs5RNjzhiQ4QM5lqig:N2r1URjuJiMQY+aEwmZEs/Njz
TLSH
T144327435AA91EF205E651FA369912C44AC5D25B6623F34FDB9CF3057CBB7A18083307A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0410.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0410.ui.forms
Size 2KB
SHA256 c7e8839dc2ff2dbe16afd71f5505194b35221955e6f0738b5bc1dd5d5e84110f
MD5 f731e928704d8f881752f90fd1056a63
SHA1 b6479bc8ffb264fc8cfd45cc127f09a4f50e6c1d
SHA512 56ff3b8cdb77085986efd66b0348d6b979333554b8bfe00d98f826ce47a428537a33195e521c8377dd297b9f4a066db07f5103091eb667192b847bdf394198c1
TLSH
T15641581241424D737F710B646CB74A18E3B88867164D2E5635DF07563FAB22F61E364F
MD5 SHA1 SHA512 TLSH

Submit Download

0410.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0410.ui.strings
Size 10KB
SHA256 70c567f7cc109d56e0e8aac6e9c32094a81a150d46e8436fc4df3e0937b3c6fb
MD5 5434a41f44ae5f2f4361a23acb4b2d5c
SHA1 78326768a42e34bd99ade1fbee5034dcc8485ff3
SHA512 266e8bbe8b6064cf13f4b5fbfbd19e86b688084e17cb7dd3138c92275bcce0426d6ef4f511fff77e5ea3d10d63ce7861f0369698651251992ae4a0b3858a544d
SSDEEP 96:q5v0/kktE3I77Tql66UKlNHoixpxu+N6dIvXlnH+MpMwkm8H7bjxe:yktjwcAHoUpxu+0Itfi1v1e
TLSH
T13D324630A8D9DF105E621F6A4A927805AE1C74F2B62B30E8B4DF325BDBF7945447B132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0411.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0411.ui.forms
Size 2KB
SHA256 5ffb41d77e592b7139ea7575158dc5c27b3ac7b276b63f34a724ddf011880cc6
MD5 633167019b2760bcc5d849d613e6bcfe
SHA1 e53997f48e9a7c6e33dfdfe3e00c3d873634fc2e
SHA512 257fca458780cb94bcc3df30be1190f7d8f1ba23df6e75073ebc50fca60fbc2c374ad9b389432e59e0349e0140b2f10c3f711264d394133b93ef31288786fb44
TLSH
T1CC41541245428D723E714B646CB74A18E3B888A7170D1B5636DF07573FAB22F61E364F
MD5 SHA1 SHA512 TLSH

Submit Download

0411.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0411.ui.strings
Size 11KB
SHA256 c1046b20ffce5eea7feb9b021af32663eda2b11f1d938b9cbed779f13029706b
MD5 c9e0be8a472b534cd013c73ecae16f6d
SHA1 274b8c9d9b9e68701379db6ec820608001927915
SHA512 dd5d025a3a0395370198e20d5d8ebf212f976857b29b5a777e173f99548f756d1b4e78ab73dca52540833b0c553e777cb5b21a23c40963f9f77009ac7098114a
SSDEEP 96:qj/vUtG2RRpHd30avhudh+bdnL5W7+O+bwXPK9kGg/bBzWy7fRlEdllM:G4PE1d2nL5W7wwZGgZ7fRsTM
TLSH
T1E942032CEAC5DF116E610F3219857991990D6CB2EA6B20F8B0EFF112AB72C8DC537571
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0412.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0412.ui.forms
Size 2KB
SHA256 812ebf3f6b28cd6026bdfeb3c372dc4b90d9dec8b3d46e6a22c447744792f90e
MD5 fa7dffb562611e9216834602bd8459c4
SHA1 75c01092f4ce0ab617e82bf8e64cc8f774a74ae1
SHA512 346503b4b30ac3e733b5969caad7d0b6cebe52d5bd5617f738cb6a5052bae2b4fec76dbbd042808cace00d4f44eb5b558cef9497e69cd6199e6098553b0aa043
TLSH
T18841551281428D733F710B646DB74A18E3B898A7170D1A5635DF0B563FAB22F62E364F
MD5 SHA1 SHA512 TLSH

Submit Download

0412.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0412.ui.strings
Size 10KB
SHA256 b699439dfb8d3a389b6e51d6da91a60fb0f9c7a460a8a771a579c9a7382e63cb
MD5 a43a8c95e21abd644d4e8ce9f6e3c3d4
SHA1 81c0bdd0af4c29239f27d43f92eb50d9eed5419f
SHA512 9f61b0bf7c228d9d2ca064e56d87c6af5824219c43ec4c35bd97ebdda3d435e60e137bdb650cbdae03da37f3f0106b9322926bfd81b142541b02315ee1528d1b
SSDEEP 96:qDc/BC6I/Ch3vNgavKhqytvRRYjDSLQ+KvAfo3uxZqrynRGJAhgWLt4UN/ZV+Oyy:MwCywvImKIfo3gZqr7NNA/BAmKQkAFl
TLSH
T18B326961BAD6CF501E221F121E9278119A4CA5F6B32720F8F8CE7987CFB78950877572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0413.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0413.ui.forms
Size 2KB
SHA256 3b5c8d61aa41963fc720f3bc826889d56ba84ac41e8ada7a0b19a30a38b91596
MD5 21be67c006639c34e9cefed8875c6e60
SHA1 b192e7d0dfd37406379922dd81051d94e94e6ca6
SHA512 f85aa9c4f206c6ca87b84743e75cc6c68f1e38fa542a8460059f07503d3e4b80db9f6cb718b99d585c80d7f16a649f807238f7221d6806eabc91142e641866e5
TLSH
T1A741411285424D723E700B647CB78B18E3B8C9A7170D1A9635DF0B563FAB22F61E364E
MD5 SHA1 SHA512 TLSH

Submit Download

0413.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0413.ui.strings
Size 10KB
SHA256 2595210c1a5dedf86056f5ab535deeab54a6a5b486fa8d612802b0bd026fe950
MD5 6cbd3d0877fd05082b91397a0a864a21
SHA1 c770f7c28149764e48b0c681293f72686f61f14c
SHA512 6b921185d7dac064ad14f5fb315c1e5041a60053de382b64e6967e4869c8b9f8aef9c0b37351697c138f613c5f9f8be64a3bcb786e77b963e0e9e38ac66355f8
SSDEEP 96:qP/xl6TXgBXTMrKBxoGFFvgmLzZjIur5LCrrROTr3NYrF3/XFVvl4AQ9Y3OVCJXU:/SXoShHZMQ5LRvNaVNwoVZo8I
TLSH
T1F1223324A995DF246F611F6B99862C42AD1CB0B6623E20FCF9CF7167DBB3904047B172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0414.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0414.ui.forms
Size 2KB
SHA256 2ece3f0f272629e38918434cd1584db852e4a9c2d43647ebb55127e9a03d089e
MD5 eadd1f7fb3087b0ca9f927f42561979d
SHA1 f053600bce6c5e3843ee54221e103252971bc7b1
SHA512 c4516429a5d17a144727be772af873d4648b516613a5e5957ce3b3ae73e2cbc0c508568f53fbc37d87427e550bb9cb7ab269feca76fbb92636416bfda7746dc2
TLSH
T12A41051241429D733F720B646CB78A18E3B88C67161D1A5636DF0B563FAB22F61E364F
MD5 SHA1 SHA512 TLSH

Submit Download

0414.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0414.ui.strings
Size 10KB
SHA256 3c46590e59ef05c2f80ca7f61c3243647035c2d92e9992c1df5126f67d631369
MD5 d7230603b5b514d21bdfc3bf10dd0c65
SHA1 8b67fa374f61743b5dbecc21ccb7d2d0044db46a
SHA512 9e15dde2faf07e0686fd7e1fcec4d2884da0bd68f1af1f656061459de540bd9de8379dc3ad3f72a2a0dc17a010fef47d084aa0deb7dd2273a861b26ee1750bbb
SSDEEP 96:qe/NIz2r1MH4QJa76jmKPfHmJZrVHgrEokNRbmi5GmIPiFxi82u:vIK5MH4QJtL3H8ZrVAwo8mwiPiF482u
TLSH
T13D224424AA95DF212F611F6B5A966C15AE5CB0B7A23E20FCB4DF315BCBB38440437132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0415.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0415.ui.forms
Size 2KB
SHA256 0ccdf1d9c1479ee36dbe5c6e555d614e3eee8fe2c2e88d973ecb930218a0df68
MD5 cd266c0db0306e4d219dbef33ac235f7
SHA1 ca686bc4ce9faa6ec3fbb0b65caa7406f037d024
SHA512 2901c210b8d7fbe5019f960cc4ebe9e1315c56d8d38404feff7cd768261e2bc0c1ae1df9d7c1eda03fc351777a9363f771254bb0c78edddc6d7af39f1c9e06e0
TLSH
T13041541245428DB23E704B646CB74E19E3B888B7160D1A5635DF07563FAB22F61E368F
MD5 SHA1 SHA512 TLSH

Submit Download

0415.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0415.ui.strings
Size 10KB
SHA256 51d7752d00618416d344e7b3ab8ec763f58bcaa46513223a5f7625f2ad8b26b1
MD5 b47ad3c8df8000225ba2ecc02a1509c4
SHA1 b45c0331d6f6796488da449816ddd1e67e3ee292
SHA512 db9a6e84ef5c0ce20b6bdf437edab1d6f77ca02b27cf1e4d17f86d54b4da41e75f22a5bd12307f1b7492a3acb0bbdd482df85f39a2b668d6f4dbd63e4c39318b
SSDEEP 96:qZb/5uSQSopkKhuQnIk+veXl3pOpFCrCYfdxJB/Yg1nlcpkvtQjBmNqwHzz9r:0uDlRnIk+ve1iFCmYFfB/YgtlcpGt2m1
TLSH
T1D022A624A9D5DF606F311FAA5AD23C04AD1C68B6A23A21FCB4DF3557CBB7A080477132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0416.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0416.ui.forms
Size 2KB
SHA256 976d272ecdb5e1b4c094317015576d6aa7ab81a10727488a5a7389d83ce90b54
MD5 d30f796f5a40761db7a91b5c0fa25767
SHA1 4809a1b80cf2aec948335e7375fed9ad0bcfde32
SHA512 ac692c149cd6b6897d47e11fef861bb54bc441f6437673315c4172bb7d671e322f8fa57a8852f49a47e156a476a939b0f6684699cbd8dc98ef73df258b48f578
TLSH
T1D241281241425D733F710B646CB78A18E3B888AB161D2A5635DF07563FAB22F61E374F
MD5 SHA1 SHA512 TLSH

Submit Download

0416.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0416.ui.strings
Size 10KB
SHA256 f48d4798cfffe7cb5dcc6de06556269c70b1592aea748b7e6400b061ad87bd13
MD5 c09b08645af85f2a08e620440c951063
SHA1 07c04b0ce9478aac5224c9a166e072e3c054db9f
SHA512 e81080bb104cac98ea82cf6c6b6953430aa7981de1cb59bea5c08a1a87d134c07d4a24f9a8fdc44663114c65b9f64e18959604f379357129d773c89389b3d764
SSDEEP 96:qE/waHyOajfFKMEaRJ/+VkwtU+RSftIBFXKzthbm:QSyOAfFkaRcVJHROIFazrm
TLSH
T1C6225320A996DF201F651F672A926D01AD4C65B2B62B24FCB5EF3287CBF38454837432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0419.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0419.ui.forms
Size 2KB
SHA256 2a43c0d2fd699233fabd43ba120005cd75d626d15fd958d864f5a889092b3c98
MD5 03eed68ba7ac9d76a8860bb23a11d67f
SHA1 fcde8e2af01614e9af8586e9d4c178724bf4ba72
SHA512 2a18ca65c7115159dba1c338c737adb969c7c4f3c790bbb5a9183ee53462bd1c8774d3aa88a051cb1b3461db95c023b95b05044ace5673dc7960cad7915246ad
TLSH
T19841882241525D733F700B64ACB74A18E3B88867160D5A4639DF07563FAB22FA1E368F
MD5 SHA1 SHA512 TLSH

Submit Download

0419.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0419.ui.strings
Size 13KB
SHA256 8e44d8570a8f285cb3b29e40b389fe7782925880cb33579e0fb8713c28b79b15
MD5 b43e7dee5141230579aa0f2dec46c862
SHA1 8530fad499f95422211cac4db2aa87a658a594d5
SHA512 7e9efb0c61e2b9d6938809298c067029ce80a1f92910e31f0cbe292ac6fc6d2aa7e7d10b0d07fc2ef5ef5a2f386d2c20e1268f6e744f11d194cf95b2a03d23aa
SSDEEP 96:qEa/JqQBLbLCRIdiPwb85WmmeFZJiFofqD6a0acxEC0X3nIPK9Z20GSG8TELbf88:ROriPwwMmmengp6ez3IP+ZTTELbU8
TLSH
T171524520698ADE950E106E37D9407D057C9D21FF373B62F970EE392ABBF68144637122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

041a.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\041a.ui.forms
Size 2KB
SHA256 b38640bc04931fb12cc3391078ba7ce93ee34231a59b58879a997dc764d94c28
MD5 32a5d0524afbfd83eebd8039a6b5e7f7
SHA1 1e4f540cb5d87cbe02f57546193e802b5df94611
SHA512 2a458abdfab037a8e021f92f33c34e13de8a01650c92a4f11b40b4c0dfde011100574c7bafdd0338acacd6edeceb6d7e5feefe376f094abeb2eb35b7b392b793
TLSH
T17241352281429D727E710B646CB74A18E3A88867170D1A5639DF0B563FAB22F61E364F
MD5 SHA1 SHA512 TLSH

Submit Download

041a.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\041a.ui.strings
Size 10KB
SHA256 091ff518a200e02afd19d7c9a9c69216cd381b48782b1d7f9fe0499a08db7254
MD5 71ea568930447f086026ecea92eda745
SHA1 10da0948ed59ab9f7e3224dc95a7e476b8ab355f
SHA512 4cf352123ccd8d813707ae10b508c810a8c30dd5103a2b34b9363d7b64f3f4241d3a39ff6269663aefc85010e6f98cbc84b83dca54fa44dd14bf95fd331fe60c
SSDEEP 96:Lz/6RJ/fbDwXprWiBw2JJ67dtGOdZaH2wffVTpmIrHRAmSVVojqmhSdTNE+NeoVx:S/oZt+yGTGOdZaH7zmIrHE6mdTNE+Nwi
TLSH
T1F6225524AAC9DF502F751FA64A926E019D1C64F2B22A60FCB8DF3117CBB7E490477132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

041b.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\041b.ui.forms
Size 2KB
SHA256 cb435911ba4b95563775f5c561557bff2aecd7c960f279af213c3c683896c130
MD5 336eadc33d524568fa1b3670828756a8
SHA1 3679a2a9771f8c7fe6dfe01f43de0f832c312969
SHA512 61d4212b3e4c0f4d70df3f6c1428d1cebb58ccaed73bb1d1abf6946dfe9a1bd90d5287da4724fdba165c7a6bc561453c878f428b82c768b6c51aa675a81777d1
TLSH
T18941231241428D723F710B64ACB75A18E37888A7160D1A5635DF07563FAB22F61E374F
MD5 SHA1 SHA512 TLSH

Submit Download

041b.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\041b.ui.strings
Size 10KB
SHA256 8b12a11203931e6ec76040722b68b3b776fa3393117ff516b5e202d35b11d2e2
MD5 4c615cfef7a04a3f8d927b5159dfdd48
SHA1 5a8e955dc66b6068c2731a6f0f3f48f487542e91
SHA512 06b05acaaae212ae9ffa31a6b56559e836521b4574f387afe5d1f2d7654efc232af508bf1f5a314d8c8adc6a3ed92e3e84d7806f7dcf39a4138a7439234dac90
SSDEEP 96:qzUpV/feSqluV9RulwNBI7ntifDoKjsvSGLieg8rLFMNTWKLY:LpsA9RuYBuAD5IKQiepux8
TLSH
T193225526A9C6DF159F760FA659923D00EE1C65B2722B61F8B5CF3287CBB39090437172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

041d.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\041d.ui.forms
Size 2KB
SHA256 49ca42f42e3d0b42484f203b8b2e2b402508076907a694b4f8c1415308a5a11c
MD5 9e8f05d4c0fed5437c5e4bfcd9e17b50
SHA1 6750d05324a85edd225926431ca7a4c8bc9445a7
SHA512 b4eb399e8216610f840f2ddaf9bd73d66f0b703da2d2c4c902c04d88adda8fac1ed163eba93a5715cddd0a4843cd5e776b2b73fb69e7cb0f37fbbf415a909bc9
TLSH
T1FD41141281428D723F710B646CB78E18E3688867170D1A5635DF17563F6B22F65E364F
MD5 SHA1 SHA512 TLSH

Submit Download

041d.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\041d.ui.strings
Size 10KB
SHA256 639e8b6268b2900a6f600380fa72ed115238b6a811533b81d01bfb23a4be43d1
MD5 7d6f06c912b426a4d27fe3f130f86930
SHA1 01f9082e850570e033fb86d899b64854ea17a1d9
SHA512 34fc3a5e8900a9b34397adce1279c35f1b2c7594a630ee7b2f5d3f6ab8c28543b8fa9a40b4555ef2768a5f1862d83ef257fec07bcf15f5abf03680933e7f6749
SSDEEP 192:gSQjvIvm0RV+MMUTQcNQY8rrrExKPF7gvLx/zXqEvQXa30x:kkFRV+MMUTQdr/NA9/z6I1S
TLSH
T1BD223625AAA5DF202E221F6B5A912D01AD6CB5F2622B70FCB5DF315BCBB3C440577132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

041e.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\041e.ui.forms
Size 2KB
SHA256 33d464f8f15a22471f42e50a4049106a521644abd62134a39f765ab7e5658186
MD5 35f2e35b141cb3e7f4c130a390ed0c3f
SHA1 25df6239d5aa1c8802cbd8863c2e6b73c409b4ae
SHA512 81e96bff7b2537f303b9a3ffff05d00f93bf1e0cafbc97c233fcfaa6b22a96432ca972bfb0727a5e643554d485e2d3e07b1869cf6b76997cfeb117882abca691
TLSH
T15241572241429D733F710B646CB74A18E3B888A7160D5A5635DF075A3FBB22F61E364F
MD5 SHA1 SHA512 TLSH

Submit Download

041e.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\041e.ui.strings
Size 16KB
SHA256 4160177f0731b8adc35b4d3b5951ffab723fc19282f5d75b7037904e7aba4a34
MD5 ebfcf7d25553fade0d29d56f1b2b654c
SHA1 6f37190c1e25c3b40abb2afa606052b990600353
SHA512 74609b3dcc69c663c3be54ebc05234ffcb1054dd8d69aab2cdfb8daf5dcca3c47dbdecc920527b3b5c6464a71676facc96869fa60a16e5587e57a8d6c33f537e
SSDEEP 384:2g73E5JHuKRPz7f9omNqqpBf6yTqTTc0Uspvjq90JJ+TP72Q5DkUKzBiPs/6APg3:2g73E5JHuKRPz7f9omNqqpBf6IqTTc0a
TLSH
T1747203732986EE506D502F171A527A406A1CA9B67E27F4E874CE314797F1B0A4833EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

041f.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\041f.ui.forms
Size 2KB
SHA256 8600ba61722fa9124739ff2e6c1e75ac560d7d16dafa03d5698cff0a2a9e9b00
MD5 967997ef6f346990faf0ce9e02f17007
SHA1 19698d725ebec9a919a2a23fa5fdee8bc5729a7c
SHA512 65008939cc262897a61f31f603a46bb902505a09d1735f27d14dbf560a97936be4036eac9b0ce42da014d38f28f5104fe7ff9df7d1d9a655b39de481640dd3b5
TLSH
T1E841031241429D733E710B646CB78A1CE3A888A7160D1A5A35DF17563FAB22FA1E364F
MD5 SHA1 SHA512 TLSH

Submit Download

041f.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\041f.ui.strings
Size 10KB
SHA256 0e6b6cf5cfefaa4b6d32e13a4e2363bb7a069d4c5c54bbbb2afd459d0e509fd9
MD5 a6db1a7bee55aa547bcb5533b029ab04
SHA1 2b82e6c10f7fe07366e4f534ae3e6e227bc8c34e
SHA512 d55f59c1d76fb3c5e0e7e0039c63468a3d63cf1b24922096f6e4cf754a348d84ce94a72bd01854d74f9377adce373c013ece55aafa6fcb2e31517fdc334fba7e
SSDEEP 96:qU/O9SXR6Hv18e1bEBrFPc5RuhGRzBDn3v8UJni3oWPGz:O0XoPD1KrFPSwhg9rvvWE
TLSH
T147226324A995DF145F212FA76A912C05EC5DA5B2B32A30FCB4DF3217CBB780604B7531
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0422.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0422.ui.forms
Size 2KB
SHA256 6e5024088d6b9403adb1be3f134bdec290623ab2ea9dc3d4a7b253ecc7b06a65
MD5 e2ca27698fae5d36c294b56c64340c29
SHA1 ad6274c23b61860243fff385c260f21a896eaaf5
SHA512 6d6d80767c09dd48160acb26e21a5cc3d5c8822472edcd59bd2d25eefde3407c5ea86041a4c7201ae7a9aef349abeecd40476c57d7903d0916a655953f29f098
TLSH
T11941960251520D333F710B646EBB8A0CE3B89867170D1A4636DF07163BAB22F61E764F
MD5 SHA1 SHA512 TLSH

Submit Download

0422.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0422.ui.strings
Size 13KB
SHA256 4620b09cdfea30a7a2ec8626cafc359a2a713f8fe07b919f9665645a1d47b640
MD5 8ab07c52a7a996b701be1a934edb5d03
SHA1 e9f75353cfdf64e641d483c2ec3ce51854aa1d74
SHA512 5cb9bb890ee22772aacbf7c69e3287ab44e93e8a492cb343583e937f1036254017a7e93dd531528d489450f5a26f30734564ff4876665f2d0cf842e8f97765d2
SSDEEP 192:7NmF/8KtPsFqkLYb27yYAeiqRlwvHv6HThkwpVX4ZTOsOD:5W0KtPMzLGLZoAH0BA8
TLSH
T13E526F20758ABEC90E01AEB7D9647D0838AF05BE376923EB51F93D7F7AF24140639215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0424.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0424.ui.forms
Size 2KB
SHA256 264bcba085c8828f064509629af23959a808dbaf639f6884f471aa7cc7f72359
MD5 a2c9317d894ebf59675571bfe1e29a1e
SHA1 1985ad5f5f9e2f1cbb0985c045a69c6346db7021
SHA512 6d0699b790f0b66d1cb4fb36ff5a29e2de35682cb58eed89ec9bcb6994a90883256303b7fb9019993543780cb2a6084f6827af127dc1856d8e0074e32bd06065
TLSH
T19041770251520D733E710B646DBB8A18E3BD8867160D1A4A36DF0B563FAB22F61E374F
MD5 SHA1 SHA512 TLSH

Submit Download

0424.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0424.ui.strings
Size 10KB
SHA256 d25c8d6c9d71f448778150ae6301e5838db4ad43abbca278eb2dee6712b1c521
MD5 bfe52982e5c7a46dbc9710dd8ed1a9af
SHA1 bb3e8213bdb96c0d21b6aae16399132e5307e38b
SHA512 59c122569c5a0dfca95585809598d9e5fa096d8f6b3f81e4bd8e07210840cfa040b25c0cccab83a674b1c94b2683f084384b0a56e28e00bd907403505d61659d
SSDEEP 192:W6Yv1pd2FrvNg0Z6FIaIJ37/vIZKfbf3wOA:BFrZMIaK37/vMKfbf3wd
TLSH
T138224F30AADAEF141E752FA659926C11AD5C64B2A72A60FCF8CF325BCBB38150477071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0804.ui.strings

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0804.ui.strings
Size 9KB
SHA256 ac551ee1fa474d2e8e3f63dae29a8bcbcfb28116c5551601046e13392dee93dd
MD5 0330aaed7d27ecb5acaf0eb44ecf3fa6
SHA1 64f5e8d0dceca82dac61b8714bea77be1e30bff3
SHA512 b004058e0802167763bd86a59468601f8f7c28e63b44544ee642336d6860d54b8b9337dbfa05e0a945e0a97bc0c1afdb35497892550dbaa859db43beabbbc765
SSDEEP 96:qD/pJH2FCxFTG8cpT4KPdOtb7uNGnDJH2iDjDnr:oJNFTG8cv27uNqDJhDr
TLSH
T1841243A5A9D4DFA05F221F231A962C10986C71B2736B30FCB4CF75539BB6C280A73536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0816.ui.forms

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\0816.ui.forms
Size 2KB
SHA256 e33f6ef6cd07baa22c20cbcf807977bd020302e8b24947e2c5d5fe9568541dee
MD5 7a27f095b5b96c651ca4a4a5762d1f2c
SHA1 e459aad710bfc41fdef80b71ee75d2d5c29e28ab
SHA512 4b66bbe720a977ad4222910600156f49bb38abfcad7ee3765fdb5dc9defe56b50742c87d38302fc989921d7f8683e92670c97cfd83e070785671fbbc5fb1327a
TLSH
T15241F71245425D723E710B642CB78A18E3B8C86B161D2A6639DF07563FA722F62E374F
MD5 SHA1 SHA512 TLSH

Submit Download

NVI2.DLL

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\NVI2.DLL
Size 6.5MB
SHA256 b1b816599c73a1f480627f010f41b6c34b635009100d3f0891cfca0770255484
MD5 0a54b8c7e263404f51542d5d6b104735
SHA1 d94d1b1412fa414854076d974c4b731d2213c709
SHA512 13c9ea3aa36be7fd1d6a1672cac8ad2b3ce47e43242fbff4e48fad70c6ea315956ef6b3088f3ede4d7916bc0dde1ea39b0f8b84e651923cbcd7257ced46188f7
SSDEEP 98304:CdRMwaYvV13N0NmGOAbBAoyfZjNUYd2u0IDrXA6xFVFYV:CdGFYvv36NmGOAbBAoyfZjNUuDr1cV
TLSH
T1E0666D32265ECA2BD59F06F1797CDF9BA158BD710B3140C3A3849DAE24744C3193AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

theme.cfg

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\NVI2\theme.cfg
Size 8KB
SHA256 fe58a26de87d6f1cd3c462553aab14670561f1b118565d081f417279aedfb734
MD5 49a0979c2f49e7566f2c543027776ea8
SHA1 dbd30b065b5da1e6c6ad221304c4de40dfd514d2
SHA512 d7babd7f47d6e15bc93ae380594efd91e5163e61c61e4818a4d349eedc3a820a8088908492cd9e8492414f1c9d89a7ce806583b70314ffeed1d420e17508ba2f
SSDEEP 192:OlWESZ7K5eyHE2QKGrO4g+3wL/LaLlLbL2LrL1LqLPLALLLWLRL8LXLBLGL7LwL+:OlzSO/4g+3IT21/CPFGjYvihU7RSfIVw
TLSH
T14002264124AAEF606FE546736EF33418981C90F3AA3865D9F8CD33969B73A580673707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.CFG

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\setup.CFG
Size 3KB
SHA256 d5c2ff4a604e2661d6b95783d583a4d57401a4b81f096623bedad66a0eaf0266
MD5 afe51e26a74cc77ef4f4a58ea7e89b92
SHA1 b62f9a1ee1a50cbdba7dd489181a2e74647913dd
SHA512 04f5fa1fa7988576984dbecf5b4d90a7a77593849624d29df3313a46a14ee5f56d6b07d3fe613dda8cd5d36cb9f60370c6bb6d3d30f1e6e5d0e2461856719fe9
TLSH
T18A819B51B989EF384B80567B0E763C96A81FEC26107D31A7A3DFB737A327530A861153
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\GeForceNOWInstallerTemp\setup.exe
Size 636KB
SHA256 3e83628b2e78cde497f1ed702f09e11fd7c21a587885e1eec268269f61f8eb38
MD5 a48da79ed3031a1de27ae8260a544ea8
SHA1 575c1ac121bcadbf2e5b975aa4d8780154fe3b76
SHA512 52b0463615e25f5553f5d38f0b3161af571c4d6f5f7d0825dc8be53465e726a4c0de81bb790377470f7863ff5a84a6276d910f99ce20bf56c40fe1071b7f8612
SSDEEP 12288:3YlRfNVdSdwFPuMpeFFD9Sg5oBUPCVKL7267Hh4MhyKyVkKB0HaNAx6TN:3mAXMpeFFZS83/H2hj4ko6J
TLSH
T14CD47C217AE5C43AF5B357306E7EDAAA142DBD600F3980EB7BC4491D29705C25A72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-1571-0x000001FDD9C30000-0x000001FDDAC30000-memory.dmp

Download

memory/1304-1602-0x0000012654B10000-0x0000012655B10000-memory.dmp

Download

memory/3300-1630-0x0000020E390D0000-0x0000020E3A0D0000-memory.dmp

Download

memory/4040-1603-0x00000245B41C0000-0x00000245B51C0000-memory.dmp

Download

memory/4944-1767-0x0000022386F60000-0x0000022387F60000-memory.dmp

Download

memory/4972-1600-0x000002AD13360000-0x000002AD14360000-memory.dmp

Download

memory/5388-1601-0x000001EBDD500000-0x000001EBDE500000-memory.dmp

Download