1e2792d480967dcbfb85f0ce48f08da8054eab3e57972dcd48fe576c283b9461

Resubmissions

12/07/2026, 04:52

260712-fhvtvacz4k5

12/07/2026, 04:35

260712-e7mn4aey4w6

12/07/2026, 04:15

260712-evnevsey3t5

Analysis

user interaction
yes
max time kernel
701s
max time network
515s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GDLauncher__2.0.30__win__x64.exe
Size 150.8MB
Sample260712-e7mn4aey4w
SHA256 1e2792d480967dcbfb85f0ce48f08da8054eab3e57972dcd48fe576c283b9461
MD5 c10d9d8fa74bb73239d106b45707741f
SHA1 8f2530042599d9cf309875ab4a6c3bf133db26cb
SHA512 71d270e8a0fc8d3dc67cd76643ac4d0ff621b6cc4ddd71a45d50bffb2e60a6816f52eb6e028ce05e25bd237df13179286013e5ccef856d9d96cbc7a177148330
SSDEEP 3145728:01L+5eWgyYRppCi6pd5fkGe7Ckgo9tzBArJZ1x8sXX7S0xd:i65eWgy3o7dgo/+1Keui
TLSH
T17A783380633A5B47CAE6ADBC6ACB660146AD0E722A837C557D4DFC00F9724DE5CE81D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	GDLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	GDLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	GDLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	GDLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	GDLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	GDLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	GDLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	GDLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	GDLauncher.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2576	tasklist.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 16 IoCs

pid	Process
2112	GDLauncher.exe
4188	GDLauncher.exe
1972	core_module.exe
1256	GDLauncher.exe
1728	GDLauncher.exe
988	GDLauncher.exe
1524	GDLauncher.exe
2608	GDLauncher.exe
3044	GDLauncher.exe
5804	GDLauncher.exe
6084	GDLauncher.exe
952	GDLauncher.exe
3748	GDLauncher.exe
5408	GDLauncher.exe
5624	GDLauncher.exe
5124	GDLauncher.exe

Loads dropped DLL 22 IoCs

pid	Process
1632	GDLauncher__2.0.30__win__x64.exe
1632	GDLauncher__2.0.30__win__x64.exe
1632	GDLauncher__2.0.30__win__x64.exe
1632	GDLauncher__2.0.30__win__x64.exe
1632	GDLauncher__2.0.30__win__x64.exe
1632	GDLauncher__2.0.30__win__x64.exe
1632	GDLauncher__2.0.30__win__x64.exe
1256	GDLauncher.exe
988	GDLauncher.exe
988	GDLauncher.exe
988	GDLauncher.exe
988	GDLauncher.exe
988	GDLauncher.exe
1524	GDLauncher.exe
2608	GDLauncher.exe
3044	GDLauncher.exe
6084	GDLauncher.exe
952	GDLauncher.exe
3748	GDLauncher.exe
5408	GDLauncher.exe
5624	GDLauncher.exe
5124	GDLauncher.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3056	powershell.exe
2952	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GDLauncher__2.0.30__win__x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GDLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	GDLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	GDLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	GDLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	GDLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	GDLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GDLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	GDLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	GDLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	GDLauncher.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\curseforge\URL Protocol	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\modrinth	GDLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\modrinth\URL Protocol	GDLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\gdlauncher\URL Protocol	GDLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\gdlauncher\ = "URL:gdlauncher"	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\gdlauncher\shell	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\curseforge\shell\open\command	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\curseforge\shell	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\curseforge\shell\open	GDLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\modrinth\ = "URL:modrinth"	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\gdlauncher	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\gdlauncher\shell\open\command	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\gdlauncher\shell\open	GDLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\gdlauncher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\@gddesktop\\GDLauncher.exe\" \"%1\""	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\curseforge	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\modrinth\shell\open\command	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\modrinth\shell\open	GDLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\modrinth\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\@gddesktop\\GDLauncher.exe\" \"%1\""	GDLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\curseforge\ = "URL:curseforge"	GDLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\curseforge\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\@gddesktop\\GDLauncher.exe\" \"%1\""	GDLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\modrinth\shell	GDLauncher.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1632	GDLauncher__2.0.30__win__x64.exe
1632	GDLauncher__2.0.30__win__x64.exe
2576	tasklist.exe
2576	tasklist.exe
1972	core_module.exe
1972	core_module.exe
1972	core_module.exe
1972	core_module.exe
1972	core_module.exe
3056	powershell.exe
3056	powershell.exe
2952	powershell.exe
2952	powershell.exe
2952	powershell.exe
3056	powershell.exe
5124	GDLauncher.exe
5124	GDLauncher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	tasklist.exe
Token: SeSecurityPrivilege	1632	GDLauncher__2.0.30__win__x64.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeSystemProfilePrivilege	2952	powershell.exe
Token: SeSystemtimePrivilege	2952	powershell.exe
Token: SeProfSingleProcessPrivilege	2952	powershell.exe
Token: SeIncBasePriorityPrivilege	2952	powershell.exe
Token: SeCreatePagefilePrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeRemoteShutdownPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 33	2952	powershell.exe
Token: 34	2952	powershell.exe
Token: 35	2952	powershell.exe
Token: 36	2952	powershell.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe
Token: SeCreatePagefilePrivilege	2112	GDLauncher.exe
Token: SeShutdownPrivilege	2112	GDLauncher.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2112	GDLauncher.exe
2112	GDLauncher.exe
2112	GDLauncher.exe
2112	GDLauncher.exe
2112	GDLauncher.exe
2112	GDLauncher.exe
2112	GDLauncher.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 4332	1632	GDLauncher__2.0.30__win__x64.exe	84
PID 4332 wrote to memory of 2576	4332	cmd.exe	86
PID 4332 wrote to memory of 4284	4332	cmd.exe	87
PID 2112 wrote to memory of 4100	2112	GDLauncher.exe	101
PID 4100 wrote to memory of 2608	4100	cmd.exe	118
PID 2112 wrote to memory of 4188	2112	GDLauncher.exe	104
PID 2112 wrote to memory of 1972	2112	GDLauncher.exe	105
PID 2112 wrote to memory of 1256	2112	GDLauncher.exe	108
PID 2112 wrote to memory of 1728	2112	GDLauncher.exe	107
PID 2112 wrote to memory of 988	2112	GDLauncher.exe	109
PID 2112 wrote to memory of 988	2112	GDLauncher.exe	109
PID 1972 wrote to memory of 5004	1972	core_module.exe	111
PID 2112 wrote to memory of 1524	2112	GDLauncher.exe	112
PID 2112 wrote to memory of 1524	2112	GDLauncher.exe	112
PID 2112 wrote to memory of 2952	2112	GDLauncher.exe	114
PID 2112 wrote to memory of 3056	2112	GDLauncher.exe	115
PID 1972 wrote to memory of 2880	1972	core_module.exe	113
PID 2112 wrote to memory of 2608	2112	GDLauncher.exe	118
PID 2112 wrote to memory of 2608	2112	GDLauncher.exe	118
PID 1972 wrote to memory of 4236	1972	core_module.exe	119
PID 2112 wrote to memory of 3044	2112	GDLauncher.exe	120
PID 2112 wrote to memory of 3044	2112	GDLauncher.exe	120
PID 1972 wrote to memory of 1500	1972	core_module.exe	122
PID 1972 wrote to memory of 2312	1972	core_module.exe	124
PID 2112 wrote to memory of 5804	2112	GDLauncher.exe	126
PID 2112 wrote to memory of 5804	2112	GDLauncher.exe	126
PID 2112 wrote to memory of 6084	2112	GDLauncher.exe	128
PID 2112 wrote to memory of 6084	2112	GDLauncher.exe	128
PID 2112 wrote to memory of 952	2112	GDLauncher.exe	129
PID 2112 wrote to memory of 952	2112	GDLauncher.exe	129
PID 2112 wrote to memory of 3748	2112	GDLauncher.exe	130
PID 2112 wrote to memory of 3748	2112	GDLauncher.exe	130
PID 2112 wrote to memory of 5408	2112	GDLauncher.exe	131
PID 2112 wrote to memory of 5408	2112	GDLauncher.exe	131
PID 2112 wrote to memory of 5624	2112	GDLauncher.exe	133
PID 2112 wrote to memory of 5624	2112	GDLauncher.exe	133
PID 2112 wrote to memory of 5124	2112	GDLauncher.exe	134

C:\Users\Admin\AppData\Local\Temp\GDLauncher__2.0.30__win__x64.exe
"C:\Users\Admin\AppData\Local\Temp\GDLauncher__2.0.30__win__x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq GDLauncher.exe" /FO csv | "C:\Windows\system32\find.exe" "GDLauncher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq GDLauncher.exe" /FO csv
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "GDLauncher.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4284

C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
"C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2608
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\gdlauncher_carbon /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Crashpad --url=https://f.a.k/e --annotation=_productName=GDLauncher --annotation=_version=2.0.30 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.7.0 --initial-client-data=0x550,0x554,0x558,0x544,0x55c,0x7ff7386a3184,0x7ff7386a3190,0x7ff7386a31a0
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\binaries\core_module.exe
  C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\binaries\core_module.exe --runtime_path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\data
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Program Files\Java\jdk-1.8\bin\java.exe
    "C:\Program Files\Java\jdk-1.8\bin\java.exe" -cp C:\Users\Admin\AppData\Local\Temp JavaCheck
    3⤵
    PID:5004
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -cp C:\Users\Admin\AppData\Local\Temp JavaCheck
    3⤵
    PID:2880
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe" -cp C:\Users\Admin\AppData\Local\Temp JavaCheck
    3⤵
    PID:4236
- - C:\Program Files\Java\jdk-1.8\bin\java.exe
    "C:\Program Files\Java\jdk-1.8\bin\java.exe" -cp C:\Users\Admin\AppData\Local\Temp JavaCheck
    3⤵
    PID:1500
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -cp C:\Users\Admin\AppData\Local\Temp JavaCheck
    3⤵
    PID:2312
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe --type=cs --cs-app=GDLauncher --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --phase=40 --muid=06a0a66a-8c94-992a-9995-9aad4bbed87b --muidv2=68f205a4-b638-4dc7-b9f9-40471ff9258f --version=37.7.0 --first-run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1256
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:988
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1783830673532571 --launch-time-ticks=548710833 --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2884 --skip-intro-animation=false /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1783830673532571 --launch-time-ticks=550031903 --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2608
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1783830673532571 --launch-time-ticks=550784719 --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4012 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=06a0a66a-8c94-992a-9995-9aad4bbed87b --phase=40 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3044
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:5804
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1783830673532571 --launch-time-ticks=557443476 --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4108 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=06a0a66a-8c94-992a-9995-9aad4bbed87b --phase=40 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6084
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1783830673532571 --launch-time-ticks=563973077 --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3808 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=06a0a66a-8c94-992a-9995-9aad4bbed87b --phase=40 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:952
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1783830673532571 --launch-time-ticks=570522972 --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4128 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=06a0a66a-8c94-992a-9995-9aad4bbed87b --phase=40 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3748
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1783830673532571 --launch-time-ticks=577067523 --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3008 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=06a0a66a-8c94-992a-9995-9aad4bbed87b --phase=40 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5408
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1783830673532571 --launch-time-ticks=583613397 --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4184 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=06a0a66a-8c94-992a-9995-9aad4bbed87b --phase=40 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5624
- C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2120,i,8757368912191886380,8705255574039705854,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 022ac1b16993c8219333c38c0341a212a7d6e9a9fe9a577b90431e3891a25705
MD5 72a6959202d4cde0d59e691c7f288ade
SHA1 3a025221f250ec53a67b8fca790d7d8fcd34fd43
SHA512 179533cb6db25cd9c628ccf1d08ba9accc06665da02b03b679e159c193b838ac76c3024e4941f8709bcc43d9d597004bd5732c590829815c549d3a4c167031f4
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 e8e5c433e8d0d21440fcb2e0bb1362e4202c868905e5f1d794579a2d88474651
MD5 7c86d2cf9f64427b7012baf1b27f881f
SHA1 3d37d3574714e71761fedbe28415ed722d3174a9
SHA512 c2192feb0dc80b6f2d0ab08d0dca6ebe3469ebb45b3f1a9e0534bc53dcf325e0ee1094a17b25a706e68bacb9301a99e75264c4e9e2c79dd82561fda92846f3a2
MD5 SHA1 SHA512

Submit Download

905ebba3a8fc8cc.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp
Size 50B
SHA256 f96293cf708d2ba99d420949f5d251858bba7335bf7bd92b9b6bff25e1237ae4
MD5 4e8f5b89b0b7f3fa381c4274d7743050
SHA1 baef4620b07e17fe1b9f5aceceb26a3b8a08b35f
SHA512 416f7984ef7aa71254f6e27fb9729a46d429e312f9c78af5cf37278125da328b065a0e6c140010b9ab6b00c701dbadbb2051f05e03a29f18ffe7c5dbcfb8986c
TLSH
T1D19002644D44D54570C161D41B0468950389545C255E04A993494767D8906945529970
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 5a48860ad5bdf15d7a241aa16124163ec48adc0f0af758e43561ac07e4f163b2
MD5 5c3cc3c6ae2c1e0b92b502859ce79d0c
SHA1 bde46d0f91ad780ce5cba924f8d9f4c175c5b83d
SHA512 269b79931df92c30741c9a42a013cb24935887272ed8077653f0b6525793da52c5004c70329d8e0e7b2776fc1aba6e32da5dadf237ae42f7398fdf35a930663e
TLSH
T13171CF323275B0D4C9567F07192819C063BF4396EA98AF4CB25C621ED92751BDB122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 4ea873fb3d77a2f8eefae82c943f621f16723516e181bde133568f8f0c91290c
MD5 28c65370f12e84b734af87ad491ea257
SHA1 402d3a8203115f1365d48fa72daf0a56e14d8a08
SHA512 56eb34162b0a39da4aaf66aad35ef355a7709982b5060792e3b4849c36650725176e927815537ec58e7ddf0fb1763066b203d6b7f9d1b3dd2c8bc091c0c850cc
TLSH
T108511217B3C856E3E98D553EC09C981530D692878066BFCA6F8FC5E0A26F1B7FA30161
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\@gddesktop\chrome_100_percent.pak
Size 163KB
SHA256 4474d496b4eb082073fb439133728eed72da35f4519505c1c246ef2b9552cf49
MD5 7bd1757ba953d8b304da1d6fb4fd7573
SHA1 4d5744d0ba3444405eeb7f43e74653f2ed3fd799
SHA512 12d7124511067f2cec4fc9f3a9022971867c540d9f01f6cc0b5dde834f106c065faf860bf7a421a836fceae9616221dfe97e8b1181f636576509cfb63f5bab5c
SSDEEP 3072:e4PisCv+/P9NebGz8LI1TwuLjQBHUP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:jYWFUbGz8LI1TnjQB05K18Gb0OV8ld0Q
TLSH
T120F3E1D7B7F0ED7DCA5B4AB797560071ECB30B2D0792124A5A8ED475252AB88D8C83C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JavaCheck.class

Path C:\Users\Admin\AppData\Local\Temp\JavaCheck.class
Size 1013B
SHA256 c607f5871610bf9240c75f4abe947469496570b380f670e9d8d09f9c785978b5
MD5 8098d31488cd52db41f95188b9daed5e
SHA1 76988b607c667c86211fe1dfe57ed4aedacc5691
SHA512 e2b4c54e78daba4a04d17915eded43a3f59a744108cf28baf4c22545d807338a39de052d69243ce610981b930e49790ba8be0f7b370e042a9526ef09e2b9fb78
TLSH
T19911D96FB605C90BF541F07EBC426318636490329536F6A0EF4E8C570EE87C40E963C4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2ar1jkcm.umg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ar1jkcm.umg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\LICENSES.chromium.html
Size 14.6MB
SHA256 798583ab2464d3602a63a328c95aec829329a5253b3b2b9cea59979d38fb350a
MD5 e70cd212e843b2f5169adf6e2762b4d9
SHA1 1c47db5a6c337519d5576d367feacf4d4a50745b
SHA512 e5a9c93310fd59f093f737edcd8d8135dddc6ab5aae2080bd02e2287f2e2494585bb3df589a9e90faba4f27224a4e3c6c86a41702c7a631edf4968137a456e11
SSDEEP 24576:X8BdGjZ6JojjZ6XxjZ6yCjK6SwRquT1mfgjr6ZjK6yjr6mjK6ajK6XjK6QjR6pji:X8Te8rn8mfRxs
TLSH
T1A4F6A42F7B48037306C642A2AB8B65CBF31E903F3B561654345CD1681F6BA2583FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\chrome_200_percent.pak
Size 252KB
SHA256 3e815b1223026c0bdfffcee62a58885e0ccd99d77f0b950778d109832e38e9cc
MD5 6a460ee2c4e796e53f9be9b050cca017
SHA1 52fb1eba7629f2896c6432969010f34f1903f8c2
SHA512 23ae8fdf5618582bd51b3690526efd135228f97649c6755e2d024b8048e214e4069f355fe4e7f09f82be45accccabf06dd6c065aecc6ed354de996f88a48ce03
SSDEEP 6144:rGQ+N6uSZQDQYakvyAkcjQB0ugx5GMRejnbdZnVE6Yoppx4:rQN6uS/fkvyAkcjK0a6edhVELoXx4
TLSH
T1FB44F1D773B8ED3DD9670AB3A21600F0FDB611290AB2525A569FDC393955EC888CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
MD5 1a7544f942a9a9de9354e7a0f9060e3a
SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
TLSH
T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 d68a77d0e0e09e7c63e8304fee8d2f6fb71a070352a90b0b9c7c097f6a446774
MD5 390688d37dc0f4b831cb8223d92dec54
SHA1 b3fe646c3ba3e8aeb3f6c2d82ece13cf9bbbdbdd
SHA512 f27c1ad0007952aae5678398005ed40b34a23d5dd18dc6efb25c33ce06e0c0f8bc740d2ec66d35234124a0b2f054b65a7b6a24a7edeabb2bd384ee9452fd2bfe
SSDEEP 49152:MDySbgSR605G78PBsKGra12wLYW5sBUxo7l+ynjVmn7n8IK+ZJgQdhwlnwZGM6UU:MOocb78PZG7Co7l+ynjVmn7n8IK+ZJg3
TLSH
T197E5AD07F6D6109DD029C070979F9213F631345A8B205AEF26D089243FABFD86E7E769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\libEGL.dll
Size 503KB
SHA256 f1521023210cbb2bf4b8341c77369e278ff18b6218619faf902a77864c1b9554
MD5 f9b7a6d036b49099b0ef3986f5d9256d
SHA1 bd7c7f4dd5ce2a0d942e60785410a82060bb160b
SHA512 741a0a1f3b006fd749a8c18a5bac5c8a40f9267fa5f72665764085dad8bbd77880086541536ca32788796c1ae84de82494e6958e79876f312c1bec3ae5891168
SSDEEP 6144:ZRrffvhM4pquMRXqJln2dYtfg4/9L6cOMC+lZ8zVVpf1qr:ZR7BMqqu8q6dr4/9L6cOMCLpVk
TLSH
T10FB49E15B3D845A8E06AC1348A534642DB76B8860B65FADF03E493792F3BFE45B3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\libGLESv2.dll
Size 7.7MB
SHA256 574337d1d39eb5ff0c2eb88fe4b96ab161b1e0054e6b5ff94b94cefe19bc04ce
MD5 fb7be860fc21437f1bc4719052ea21f7
SHA1 ba27f4effba482f34803eeadd59a06859245b627
SHA512 ca98fc2d16e7516bf0a03a47fe32535380eeb831860f1589358df7fa5ba06cf0ed43e009d94bb2ade1c75b2b22231f5e1515482d968ac3a46fbb8bdb8464a615
SSDEEP 98304:bv78iLy9EinTQnFL8yiWYzz+SV3q7wjX45CRKG:3PLcZncYzJV67u/H
TLSH
T1E5867C03F69680DAD04DD2B8C75B9227FA3478850334B6CF279457152F67BE0AB7AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\af.pak
Size 546KB
SHA256 5f3f662f860d0f319027e68d4fb1e68933b2bc3d1beff05bbcfd13f490623bab
MD5 f9d4287aaa472d737c5e84cedb6b3286
SHA1 de63ba9fb66188e5e8af131545803e9ef3d00834
SHA512 473bf981832b7ea633a0f402b809cf05aa4e1da4b519871540a347d62c89d015853ce25f1cb78a04de1e90481e23095633af867f235d9ef823b48676a0d4fcaa
SSDEEP 12288:XR1mwiCkm2BRxBjtRGtGc0IRSuNCi0G4GlZWFN4H2JynIjl2BrILDEo0vhOIAgML:h1tiJTBRxttRGtGc00SuNCi0G4UWFN4C
TLSH
T1EDC41B0AE780273D09A076D6FB0845F7BB9CA26CD770B2BADDA982310566EFC117D1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\am.pak
Size 886KB
SHA256 ca2e31cb035c8f48758c1181078edfce56127ee782198f8765cfd16b5163bf16
MD5 b1dc128ebf0c6beee3c97474af9ad786
SHA1 837b4adc5545aa55c1d73e6c8925fd8285cc1386
SHA512 0038bf024f8887fa707e14a304042993c284a6041a1d6e820e271968d95bb7dfda8a59b82c6d71175d99ae3ead89b208071f49ed2143a27e535668377fd5c86c
SSDEEP 24576:g+Ts1nVhTCMuytBxIzU2jHFfrz6tXcO5eueiXlVoq+XG/6FZ2Pt5:w5N
TLSH
T1D115BC547EF9F7570F8E8A1994320E4EA594AE4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\ar.pak
Size 980KB
SHA256 a9bc6ec0e5d458468e0659e19641b52ca371f03daa92b84c63bab38e4ce3bdcd
MD5 d6b6f32878f4c37f34b191dd2359597a
SHA1 6adfa104ba92d70f92ade4571247a9efbf64d7e5
SHA512 f09690ba4dc35bd033f775d168e19491ef455b7ebe3f8854ed5b81fe90dc2d035905ecc62bce942ef7e43c55cadc29380d9e840c0891c509fdee8935cc6eec6c
SSDEEP 12288:t7p8+fis3BHztYtL9TjuFQZAvNUiKPVJk0pSe5xGNj32ExBDXEW6:8+c5ZEc
TLSH
T1AD258AE21B2984720B56DF0FD1E23668E872BD23DB4BFD3124934A2156D7513E78E638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\bg.pak
Size 1011KB
SHA256 5907a91c11524603f87bf474825d2f30562a89fd9a8e2595f2fb9003106e6201
MD5 5a5351742f232322c3226e625de7dbef
SHA1 38ccd2fcedad97b9cc5713df70878b55066197a3
SHA512 d8443422aa3d71960202444aad0610de69704d701f6d804b1fb94a17dfa2918f82bd0f6024bf1d21b3b10f624bf063033aa27c09920c4bf686b671e5547ae5f7
SSDEEP 24576:i6YKebgW2jDLYRzQkEClUDVb6e7/dz373ZAq3ADKvmVDmU574u2VG7705fOaG3tg:9YTbgW2jDLY2sUDVb6e7/dz373Zl3A6b
TLSH
T1772524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\bn.pak
Size 1.3MB
SHA256 0a88efecf87d216bbb081d3d26f8ac91656642ab52a66ff9d91ee8e61673d7c0
MD5 42f8c3e64605d9ad55ee90234ecd60be
SHA1 f945b0d100b8de8cecdea52c0b4f70e41e2f0ea5
SHA512 0c6625a5e7e52a4c788cc21957e776ff5d6fe01c3851477dce719903f31420b98040f44cef9dc93e744790b8e33b5683d7ef92584e73aad1b7c9e4e737982aca
SSDEEP 3072:0GAw55FNFGnZv/SJ3uJkDGMm28/P+ocaf1uGRPQnBwythBbTgQE53bkwsO:l5TvGZvvJkvSQnBwythBbe5Qw7
TLSH
T11055EF209C6E81B6A8D5CDC9434C6370C5236E9B9B61F74DDC17A25938ADC3C8CADDB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\ca.pak
Size 615KB
SHA256 74c25c05829be034b1ae6469205f07830f9733e28989a3e500322493536f0279
MD5 226e41fa1a8a71e9dfc7fd22a9b1b0a2
SHA1 1357847bf78dc913bc2b23f0d59dbdab39a219d4
SHA512 56300405359343a8c29ecf8bb8aad7e536d1158b75bc5cfae7a4121a01a87becac503fb225c2769b07c859e626b1b38f009aa10daf76b4f376949d9acb0a0c6a
SSDEEP 12288:nVWliK7hjnlCiEBoDQU8o5PsFzN3Mw2juwHzejm0t3lts7TfzJthwXLr/fnX9Flv:nVc8sgLExlTXMNzOKl5SwVn5
TLSH
T1AAD4E7239FC93B7704D3330AFB46C217B48CA9847B16D254E4AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\cs.pak
Size 636KB
SHA256 efb45cc491a3df934aee0eef9eeb147643823784d696a53036ff9c9c2eefeb47
MD5 5a144443a53c3f52f7dc72553cfe9d35
SHA1 a6ea8191d0a86a32a8ebe3c950cf6c9281c102bf
SHA512 ccef7f0ec1b1ab3e638b1a8fedbb01c8d2e36f5ddf184c9fa1508cd543c71e87e19e448cbcc98ea05dbc2a34b4cb53c02c747ed8da0d12a6b281a7eccdc716d3
SSDEEP 6144:s6ai0B2J78plMx5AZqDkAHv85qzmqmZ8OKwJSBhX8QG:Uiuix5AZu85qzmqmZ8OxJSc
TLSH
T1FFD4491EEFA2A435484002487FBE4128BD5E83140B6EB9BB7C9F9D91217577A8FF0D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\da.pak
Size 574KB
SHA256 6380dcf390f08fba53019aede4b5b26754eeaaf6968147780d8f085a9f8c2631
MD5 1d76a1b15b74825a07cb5bd7c4d98291
SHA1 7e7792315f05d333f3ec947cbb52cf131d348aa3
SHA512 5c96ff5ab5c0f7541af4a7329548f6d4d82c2aa2199455d66e8941e28f64433f9e5cb5d3aafad3d1809daff5839fdb8608916898d10e5ba545e9da6524b658d6
SSDEEP 6144:239uKnAgpk6/UbRHrzVIr5vuDS5C/e8MAwlA+yJwr7ob/R2a0Go5oK25ls3n5ld2:2NDk66DVMz8E5oK2vslW
TLSH
T163C45B4BCC9C732FC9A90764F6118DA7EB5D543CC684264FA5D8943A09CBDA093BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\de.pak
Size 615KB
SHA256 ae28e9e71aaf424c0323f2949f7426405ccf7509a2568c93bfe29690a7302094
MD5 5c44aa9e0f54beac2ff5ba330a3a223c
SHA1 6ba4c177a596d69331bfab8ef99b1f43636b61ca
SHA512 9d32c65497bafbd0cd90cb5dd170d76c8b77b1aa108060935eb469f0e4d97bce683519156cb004ca2f8faaf7610dc9e40a7b688db6fe3bc0e10f2b3307d5570a
SSDEEP 12288:UNbQm85rcr3K7UpWg3apmBcEj5GoM4UihiChI:WJ+cr3K7UpWg3apzE5HMZChI
TLSH
T135D40703ADDF625EC78673607705CDB77B19E26BC346322B84EDD02B614B5B283AC526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\el.pak
Size 1.1MB
SHA256 5e5f96c79a23c8c2a00efc76918594fa3c13d93d75effe5ff7df4cf78d820396
MD5 f68675c165a17227d4989239798a9b1d
SHA1 55ba95ce298a0e9d27cee9abea8c9d814f86391b
SHA512 69b542bbf82e5a074e6ea380afd6318d4d631f79befba49ceb3ac6988d9309456f541524a943d810b29d2cd30596c6370cc90165fdfa96b407a9b1c675bdb851
SSDEEP 24576:gM3eVTHWFbr4YsYh9Ak2tyZuyIJXDsSuAm1gpqO2sBHZp3jnmWz4VoyqIWYNQKUh:gEcHWFbr4YsYh9Ak2tyZuyIJXDsSuAmK
TLSH
T17535CFEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\en-GB.pak
Size 498KB
SHA256 2565bfd2216dd922c6d099e276c9c098cbbc0bb65d089c191b253ba592e74cec
MD5 a0e02077f48c7ee2c2bd51fc00d0bfdc
SHA1 00275864e83ec5ea65920a71b9447d74b0b377a5
SHA512 6dd2c8e4f032c64b471957ede8aa7a2cfeca7bd3f3deadb1b064b4bb20afea8551bc65585535d5264c496da0a60706114066a6c4bfe529f73ec052941b431748
SSDEEP 6144:vP2n0aeYS9HSZk5W5XlGHFwaQsMP9e7QNKTfaYc18I5jgj5y6DItBcCRhW:W0sSI7XJsM4QNKJn5TDb
TLSH
T13BB44C1FF784126A069312627B0AA562FF36D07CB35112663CBD901C33B675A837B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\en-US.pak
Size 503KB
SHA256 b9a2cccc13d7dac53210e37248dd70df32dbec43bd33d2c663c6290155fb751e
MD5 b9250d18cab3a4a1c738223a88a5643d
SHA1 146e75cf40b17d5a071342f13cedc7a7bd4d6aba
SHA512 b8ccde22534ed07c0330443aad2a4194e22ef26b70d908cbb2cda010f91ab2bbba25650cc1fa676060958f914be5ba19554ad4f985f74912e720876e8034d35e
SSDEEP 6144:qeSLg/aRhPAq0uWm9KYMP9e+QRt3faY7szalYA5ehj1JngH8/WAwf:5SLg/E2rxYMvQRt4w5Aj5wf
TLSH
T1D5B44C1FF7441269069352627F0995B2FF32D06CA39112563CBD812C33B7B6A83B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\es-419.pak
Size 606KB
SHA256 6cee6e9e899e7ee46dfacfc21ef78533e1b98907570d82fd58f1065e1efb645e
MD5 4315e6fdd9d8a46c29ae1e0f84264a4a
SHA1 c6c85f07450bf89560eced0a83cce8e41784bb45
SHA512 72d979accb27bac24b3bb11b0a3b62f47179c222e34d6b709dc2b8c1f5af0ab69e6bc5e2ae3877966a722f57dfefe32ef45a54f74487a1e6db20831fa9e5ec9f
SSDEEP 6144:EqzfxqmuEt4EHogfWkysgFx6c8A/N6YC7ooZKzY5Getr5AKuT/L6A:E2XuEtbog/PgFo6615GePA2A
TLSH
T16BD40922BAC81F5310E3A388B743D757E8989145B408D25BE8EB876522CCF8CD977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\es.pak
Size 604KB
SHA256 cf47d64bad26d12f6f39f56c4cef093aaec2ee4a1f7b4e88f6b08d34034865bf
MD5 8c3147bf5d9f7141f9cac31f9b5fd851
SHA1 d0f571904decb4da3970286281bae854430407b3
SHA512 0d40d484db2e0fb472c25050e0a92b49146e8b8b4b262d18775645f57a0a3c825c9f7713513e30af56785fb6b191a146e0a592e1b2c600f1e69ef9c653d979c5
SSDEEP 6144:VzIEjoIWCI4UcJNI1z/AGBgKH5+114kQXRB8jY5Jb/AJQHvJC8O6PZOYO:V/xWCjUON0AGVe4k8B8jY514J0vkvv
TLSH
T12AD4F726AACC1F6310E3A389F743D753E8949545B408D25BD8EB876622CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\et.pak
Size 551KB
SHA256 20c0c24314c9e49011220ab545441efdb49780d9966285e48c79a9512665b7d8
MD5 ebe2257a6bbecbaa59300fb48eea11fb
SHA1 53381f2eb744ae1803d7fd8fe20f029ed07e8343
SHA512 2b0be1be237623a088b7106dbb526beae840820920f39553c660bca75d699f7baed9c25b5b250cec1c9e64785b655d5977d02263fd4b02640e79f45bab609d0d
SSDEEP 12288:AtU84ZxveOsNN6WSTmFtz6fAqgOL7X5jqBr:VZx2OQN6WSTmFtz6fAqgOP5jqx
TLSH
T17DC43C42A17D771B282412F9E737A933DC9EE7D8B4000D9668964A1970FEFCC38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\fa.pak
Size 907KB
SHA256 9f687b6e3ab82e33ac72f866c101558aa49923ac98ca6e49c0daf5d2220b130b
MD5 27ebc034ba8190af31515890749ce3ef
SHA1 225feb07d1d634fc9f9b148e70a7f10cf358d3b5
SHA512 07e0f80b8124ac8cb89885753a77f542fbb7e612e1863b282a3719b86ec233d02a8d27912b4d471372a29273e06be910c7c0a661ac2f9adcc57ffd27e561658e
SSDEEP 24576:Pdq8u313uyqoT+sLqkRmXXloTUOmdAQifaQ2XxFtJGk62Yhl8iipYMX4OOcUuEkV:VB5Zl
TLSH
T14615C3956AAC9AB15746CA0341E33834C773EF12D34DFE40ACA1076609A5B139F5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\fi.pak
Size 562KB
SHA256 e8ee33a17b25b64ba25c55d688eabb90f49d8f3ca29daed0d54ef693bab9bca0
MD5 8b03beb6d773d5fc88e7db24dda91b29
SHA1 577467b7a7c5b391f23f8f4b688bae271be521b1
SHA512 5d328ee449a5c1078521d67fe4ea27cf8a539cd4657d269e2e348e5991f562d96685fdda6499df18960a5e5c93da6bf43fcb9cc438bdaac4501b0a45482547d7
SSDEEP 12288:jDwPunQ19nMUjTaD56i0dU3RIDp/WaIPgYG:vwmr56iRIBh
TLSH
T1F7C45D915219C22237C4D29E7DB0903AF6E5E3DCCC284D99E843C7D849EE9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\fil.pak
Size 636KB
SHA256 5c2ec565f41cf4b2664054d52dfdf8db1782a13b97b5e227917941e7c5ae8887
MD5 26384216ce4ff382592c026ecac8f1e3
SHA1 88afb13bc355dacbf71a68814b484f83beff4d7f
SHA512 2673d0d0b909bb3500e53d7729275d0df01c7a075ebc57ae6e439dca322ed166e07b0f4cc00ee9724993f2a8b98e29d323a38ea30e508894f90401340a648df7
SSDEEP 6144:vZ9toiNxfymcMwyPDQ/0lJE8taEhlNuf5hZlvYtxnoVKA7zDO:rtoytCP5Nv8
TLSH
T11DD4C61577401748DBC352E55360A82FAAE560B83F823C6E0FBF269B7BA7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\fr.pak
Size 656KB
SHA256 a33c1812a95c46fd03317620211bf1f2212b6f089d2520df30ffb1c116de95b5
MD5 325f8d6002f73bcbf997492de84ecfdc
SHA1 3facd98a5763bb749c3b49aa07fe2e854620fdb9
SHA512 10bba1c6f1192313f776cf678725b0cc821b33882e7fc100c37b766ab4e1a40b443a2aec340827383ef54dd0343dd010717a8f0f93d516936aedf155a4dda424
SSDEEP 12288:83LpwTGb1PZLcHW5CZb5ZUh6QuaaVDez9fxl/ZFMYnY4gT3TBcEwqpDzN1S8zxvM:8STqAVV6Aa55D
TLSH
T129E4E66FADC432CB19C613A7FB12D663DD348248F215E340D89F4295129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 89ce115c7b2c5c4eba2640fcd5b11355224e1faaf3950d7a16de203db4b8ae08
MD5 9e6416bfe60d9c1147d45fbc16ca4223
SHA1 c4675f6106f6875c229dfcd5d1060b32f143abd4
SHA512 dd9a2ce8cf7b6b08096416d29b6c088fd37ea322a33dde9de2fd4999f1d5a6493237a69623e75efeb79e8be91ee842d4a1b9fdf4e5b9acc942474ad4dc2180c0
SSDEEP 3072:xWSOqt7CA1rHrG+WrXYpbTPjAwREJKVMjNiT7llj63rAulfcSi5NnWsWi+/GQoyo:xWJaRvzEXWbT+sZP65qQ7CK16sQD
TLSH
T18D5519D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\he.pak
Size 796KB
SHA256 e91cc42a2e369914e6bd3535b5c15bcc95334974b6a059c585b995ee92143df9
MD5 d1fbd78d7ca535d6ab0362d06cc407e1
SHA1 d1caece24d19f6ff0f167d8a5a3b9cfbd4d0cdc0
SHA512 30f2e24626f63a0a4e01ec5f1769686fe80a78207285b776e89cc7b84af0bef28539a4b8db1b179a0e8f1c44ca685c9aa4bfe025f74a6c828d8535281e83ade3
SSDEEP 12288:TJb51xZiJnQYyoDYQPTlnhrwgM6iAlAWqD/+g5k7HiA5dXcUeQCajz5U5776iL9K:TnDg5u6p
TLSH
T16B0599C4B2E452255131AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\hi.pak
Size 1.3MB
SHA256 b7b9c280c81b6e3ee3e5a8f7884602814740cf72983faaa57b43f6e369b240b9
MD5 75595320e6da60db6ced94b3c5e34a4b
SHA1 a949dc3c0d939b96ed718f6e5aebc517f92a3593
SHA512 23a4d3fdb003d3bd2c0954e322912492d32ca85cecf1fbd69987693df880d20443cd1503623a46ba4622ee4c5d59de74ea6980ea7b8df316979e5273bfad545e
SSDEEP 3072:E3UYtLo3pkCg4ryp182JdlwEV/B90ZV1d3uGlqvN5tJEOTByntDPtDVePn1s4f4O:EkYtLQY4S8wdxs5p+dHh6W
TLSH
T17555F60CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\hr.pak
Size 613KB
SHA256 bb05be3c417bbda1662a5fbb0ad411e5016b5be59e28ce466be6294908c6c961
MD5 a3143ac7ac45d94dd570015a114cded0
SHA1 7da913f721d0660e923bf8e57a11d08688849ffe
SHA512 1ce63a48a6ea379ebf27f0a638c44080b3fee8710ac2bed22c087b5a6a6f267a4be0db37f7bb30ecc988c497492a6db6db7a41f9b5f629a9b26d7393b485ed23
SSDEEP 6144:KZN/9Fu/ZEEY8wT0K0qfEJ5LABOs/IUc7J:KZN/aZEEY8wT+Z56OEYJ
TLSH
T1B3D42B7DBEF297090897B34AEFA643447DBE08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\hu.pak
Size 658KB
SHA256 484a56e14cd1fdc0933f6c1b94a57af6f5fd774c729e100f10ff3406740d5184
MD5 b49ca5f2fb42684243877ae7aa4224a6
SHA1 40f1357b47d60552e4fccffa297bb3633b4384a3
SHA512 527c86c7b9396a7b52fb2a4d71fb7f7166e1b26b304fee8a27fbcad5c8119cc745f6694ce38c0fe934e2fe306acb2bd3e04f00effa5fc1fd09cc603bc81654a6
SSDEEP 6144:sBJVPjjeWRgiEWCUdgLrHk7QIDRpA4jtsuaU5STT8BZ49ZcZYhDic3NDe02KnjDS:Cxj0ibCUFAzU5S/8fUDS5pE6
TLSH
T1FBE44C7793769459BC6C178778643F16892E481BAF3B36FB2883846D34A178D0D83C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\id.pak
Size 543KB
SHA256 91cb6812b4e995189b1e2b61ae0565b92dac4ab3c34efd6e0920591dc005d82a
MD5 fe685858278b29672cafd2c6710c6158
SHA1 20aad6a445a3feff24fb1a317e749eaa39b23afd
SHA512 f43fc1270bfff5761021dfe93fdbda93f789a4d0cf60b1e467a700dec8e69da6a1ffbfebedaeb30699c02247136619d6961d3bec890d001df1e1ca708667fc3c
SSDEEP 6144:GypJj+CgXNOFCI2MC0aDOSfjITFjlFZTmBz8CZMhT5166YROBLhmliT8uJyHq:7zj+K2MUiXTFjlF1mV8L5166V4q
TLSH
T168C4F8632ECD300C494843D5B2CDAA1E7CCE233BAF05B76E8E748F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\it.pak
Size 596KB
SHA256 a71cbb5cc0336c0732e9781e6965b9080ff2f160be1696724da27d78b470262f
MD5 2195aacd0e55f63d74c886f61a1ad774
SHA1 cb7ae2cf909279078303895ebec390bfa767f0bd
SHA512 c8619ae900fa4f2036fe0a9c92c68e32ab436dcb0959e90ea6cf4431c85279dc69223cc27d2cee32abb9ce17394a0e191eae312209db567e421c49676bcbe44d
SSDEEP 6144:AqrBGERuLhK5AemiX9RY2NCznSIqBRRs61wtk/RT9Tb+ikEAoTYrYyqpzSj9f3wL:lrQEihKMCZZT88xrsJHZ/r5fVSlh/
TLSH
T152D41B3AA5D6211559976359E611B085FBAEFCCCFE417218C99B031C22CFF80E2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\ja.pak
Size 727KB
SHA256 30a10162ef5b90e31fe708e7de992622b659c13e5fc4b7c691142fb3d959cc7d
MD5 6996d09d17074dcff94011b82b2c42a8
SHA1 9458c95bac84e5e006b3c6a461ea6992996dd7f9
SHA512 3cb511b60d6594f2c706d31bf57816eabdd0d75892a2894d5802fa19d0d4ecb4b6208d375ca3d47d5f15657e2dffb4e80d387d9e28c680bd16e0798b1b74e368
SSDEEP 6144:4f28OkSLdxbmChdARsGZ5Q2xsGVVb25zenDxpbVD:4FOT3nFGZ5Q2xsUU5zKDxn
TLSH
T1EFF4307CE3C569369D6193A22C0E76E17506AC5FFCA23A3A442DC070BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\kn.pak
Size 1.4MB
SHA256 dfb1512aff3d9622b8f46be89d05d7927a74b984eb0213e84f27d248f75bcee4
MD5 20ad8965bdac080ae6b8f7d4b1051bd6
SHA1 6f51056999ab56887ecb5aa13b985d4fb5ddda8a
SHA512 d25bb0cc82c1d25b0486a3ccdfb72805fd7106a327d8239e57eb9dd1d2fc0d13d3386b4ed13b32784b705e707f12b4d84c4924bde29dd6155c5e5fdd68369d1b
SSDEEP 12288:sKPqNv9fdtzo6VyS0SovUul+WEr7y5j3AMr4MAyWjx:sKyFfcB5sMA
TLSH
T1E765CD18ADBA7D301BD5006B24EC603ECFF16BD29CAA47D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\ko.pak
Size 615KB
SHA256 aa78a00d77318d70a356f83ee5e9a0cbd579a560f8b8ffd05f9959ecb965b6a2
MD5 c4fe561646d34da40992d21b3c4c378a
SHA1 297016d1e941aba7f72bd24fad847f04473ff692
SHA512 7587314b77ff14a1709d74ecf3c11a14397982872ebecfa7419cdea88e2eadbc71a1d8c44c372a3a4b2134d2ff2ef4d8cc053fa5ff62d0f14ddcc54008f36dd7
SSDEEP 12288:PyvVrDmgNtifYj4ZGRyxYxgKrPH56MZInyxWSiG0G1zLhwwtKst8SnLVrN7ruchW:kVDvRN5X39aus
TLSH
T1F6D4C5F238DB63CD1193CD82AEF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\lt.pak
Size 666KB
SHA256 3e9afca6cb3cf70dce1c3b5a0becd2714aab49c9ceb5bbec39f313a063fb3d05
MD5 cf96d3e2f98a273c00611406b1b42630
SHA1 602320bfccb3c27c9d0f03f5dc00999a5ebf5a53
SHA512 3f18aa8f741a892a423e2b01e4f354c1b2ceba2bf4b97bdf9a9fafec7a2eeb6b9401117087a1dc65a871bf688f662878a8099e30e3b9ccd63d09f5d224fdf848
SSDEEP 12288:/4DMUaqa645MPo25Je48W3YT15n737yLmK6ShA:JFVMr+H1577CmX
TLSH
T1E3E43C0069E3AEFB9A4467C982A48E78DEFD50005727BC61EC69C79BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\lv.pak
Size 664KB
SHA256 28115981e00562f3028fb55dc0ebf6d9d2bdf4735bb0d4d2d90aea589d24c822
MD5 18273ccc2672ed7a41b158e0f01ebde3
SHA1 592f9b87b9056159f8cb04cb48cc9743f60849e0
SHA512 6d5508a3a21e11e99c64cf35a4e8e5346d070115b700e270a86b8b1e73fa3a99f06517e9fb78960528e2c352597268cec0947e2efc56909323247b3a97ca3734
SSDEEP 6144:zXSY0aJ6Cw28CwqjADWNVtVFxzf9jGznsIB4tgVbOS5sNnaRacdTuaooMwpz2w45:zXSY0a9Xw0lBizsN2IS5UcdTu3wo858
TLSH
T12BE42A959EC68FA94D908DCB7326D123A8CCD740FE07E112DD7D8B3A550F52822B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\ml.pak
Size 1.5MB
SHA256 3415158190b1d8880811a4f54a3998fb1f3f9f71ed913e1d3452f15f1495facf
MD5 95699070c123a86da6d1d6c82dca5e6a
SHA1 ffba99ff799e97e316bc58245d03d56f07a9fb10
SHA512 9c7c066b9cdc5c9df9fe63aacc6d9ea63006be961f325b8633b1d0c84d866735d3d2823592079a91d7ef6dad7f2957f7539cc5bef41cebc70b6645aa1d7b8583
SSDEEP 24576:ro8h+9y9XBkx/mZKfVB3+zXd/+v2Se13m56aLa+l3b:o5h
TLSH
T16F759D5BA036CD3B0FD102257B4E2FABCD5B9FD140AF668B5869B2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\mr.pak
Size 1.2MB
SHA256 c0b1cdf0bba3e2762fc5afc89ac7d443f53f6c1079f40b7683ceedbe2ba58e65
MD5 8ffb35b7049cd25f2cf447f900c16843
SHA1 dadf1b9e7bc9dceeab6adf4bbee1a141753e0f46
SHA512 294137ee6892041b0892ce1c90a2d350d05431ba5295df039a8d8ba2f7d4a49cd8e9657429abb1afed3d37eb65950c38a670985eebb51213af52cf8b360dc01c
SSDEEP 6144:GGFXtCLsubiA5mMiDUmDKZAj7vnxrC5umo67D:YsPA5K2Z87vnxrC5umo67D
TLSH
T13655E14DF7BAF3685DACBC8E36540D3BD8FD31B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\ms.pak
Size 571KB
SHA256 cd9a68fc1b1348b29e6c43adf5c94b9f6238146b8ec7d551e1e1997ae1773e8f
MD5 00a19db5c7b273bac3f30ddea310254c
SHA1 25f6d14215aeacbc179627aa88a53fdd243ad403
SHA512 24d3b8a2d7dea5025637751c5d1c97bf93cf2ce7344d0c1705cf74375968d71e31464d5e83f261e9c413e320cfb974b3165df68c2c0451e8f804c26240b571be
SSDEEP 6144:31znAqOdBoLl+xkBq77STXzHuqwW5THFocoxP5bnMVl4xuBDxA:lOnLxeq6DHuqwWsHP5Ql49
TLSH
T1BFC4B6569EDD3118045843D9D2DAA92B7CDD3332B705AF2B8DB08FB0126E7E53315B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\nb.pak
Size 551KB
SHA256 40277ff47002ca9e7a64c692c2e6b39667bae45ea3a411daaba16cb892e8dad0
MD5 3ddabbac1f5ecc2eab21b70469d4e2a7
SHA1 d7c71c507670643e219e45248c32932bcccfa5b2
SHA512 15a16ecde5d982e3cc45608b4672dd2b479f7149f922dab479d5ec306de8e10c0cb82e4c3accb27a3b15b422af75ff16275e0e505a8551e634b2360b5930b764
SSDEEP 12288:QhzFbDTQz8DvjOp7fKYzaLw9ez5W8dBvsZVH4u:UxbDVDDnLw9ez5hdBkTN
TLSH
T10CC40883EE86B72EF6A443A4F41985579B7D942CCD98199B94CCC22E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\nl.pak
Size 572KB
SHA256 114a11236f70de85330ed374e9658a4dfd21721f7e7cee80e746451bc68a5250
MD5 f9a46d6333632c442d9b51851feee785
SHA1 324c407a26d7b6b0d1bc9daa01ed2282be25485a
SHA512 e917d26024c15ccaef41bb93fdd57e58252729957412fad54ea2c28c69cccd99eb2da87126c5bd7eb55630db68a3af555198d307c5e78c58bebb6af6adc72ce1
SSDEEP 12288:VYCdF42lbJWQusSU02gh5fpa6f5btAdyEvNqHnGqnTF:VYCr42lbJWQusSUw5fpa6f5bKdyElqHx
TLSH
T1E4C4F917A84E653E59C0B385FA094FBBBF2ED22CC26CE66DD4DDD1340443FA842AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\pl.pak
Size 637KB
SHA256 d5179295319698755b51af402731a34b75b32b76b99ad92640319b65c4c52992
MD5 0377153d0fdc650682bb96b4fd9370d4
SHA1 dc7873f89c08bd058c03f3f4ecce007b1a4d664d
SHA512 f729ac57808c4b354dcfc6b64f7e8c96ff0bdac010baceadd2b92c7ec1425eb70a23fe9d88ec915d7f4f2d345f6fcffa31c3c233b32440a7e9664f4a7d90c5cf
SSDEEP 12288:FckgHdTwO/Ny3WoOBALr4OfQfuzSJabZjbAwPTCUdBe3mIxUmYMvmV1QhTb5ZRYp:Fckg9TMXwLYMU1Qh/5CZ
TLSH
T15CD45C0D56E58A4E4CB008E6F2E71B7CACDCC808F209D35FE46F452A615B19FCABE594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\pt-BR.pak
Size 597KB
SHA256 b111cb265d59d861c8dac2ec37733bbb2df6c923236c79d99452535215fef58b
MD5 60510f2ead7af3988e25f224a18ab718
SHA1 73d877b068a5d5f8490c00a32200821a071e0a58
SHA512 3a4244cc6a9b5641aea67f9927680009b9410b49b0534defebb8ce87a55c4f2ce4c3c2ccaf483019ffd06e23f08e2179d0f521e44159a388e9626f9994b6eb19
SSDEEP 6144:/lsT9yjNnI4MvMWDyMNBXBLdvPEyMQ5rETbMOypsRLJLrJ:/lQcjyBH2A5rELksR1Ll
TLSH
T1ADD41C296EC9136604226350B74EEB43E5890745FE0ACA87DCFF4F45A3DDE40DA23BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\pt-PT.pak
Size 601KB
SHA256 252ae86b97ed89e0cac7b9f581dbbae78e7041b28dd6b8be836048ea905dafd5
MD5 2ca014d665e71a734e8b100bba095ccb
SHA1 6dd3503fc49d0e9b1c3d808feb7af65d9f84b86c
SHA512 699b7825da44b418bb8e270cad52f0b9c432c8f32f50f5258ac5110dfd4f3283101fb26d62d06016a52642b9afccef6ae93c445dea5713874afbcaad0228f78c
SSDEEP 6144:RTB2K+pgnSqEieJVJJxhBbmfaEfz4w5anUXOzLSR/3:RNQ+nxUw5anUSLSRv
TLSH
T148D41A286EDA136605136381770ADB03FAC86655F809CB87C9EF0B4272CDF94D677B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\ro.pak
Size 623KB
SHA256 5094807f7e9fa04fb9eeb451c09542587e48ec432dde00c13ed3135b72df2309
MD5 4c221d2eb2e9d0853db023ef93dfab03
SHA1 d9e2fa821f88698d7b86196c769634e450ecfb3d
SHA512 d1294f56c20546309b7e83a48547038c63ee3404b6c44f9578cac556ecbe8cac55658cbdd02b2bae64f6ce95bbcbdccdce74c3bb0d2553eece0da0965f0dd17c
SSDEEP 12288:K6OJjsrNTXpXDzQTCo+eKBaN15adg5vlL/FP:sa215t5tx
TLSH
T1D5D44D23A1C85A97199152B2B73624D3E88E105CF641D2CDA4EEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\ru.pak
Size 1.0MB
SHA256 cc4307b19d0832b86cff809367f23346e9da41e3fc1155aa723b29542aea015b
MD5 d1a1f5e943d1b46d1dd4466c07980643
SHA1 d237e3b4cc311972be92f7bb8f601ebd6e93dce1
SHA512 b16394e6ab301f4b474cbfd958837ee842d5fa7fdac5fd00748bd0f4d9dee76762b9a98485788b52e8e62e6e9fcd47ed49ee7ae9cb08fbe73c2168c7920fd5bb
SSDEEP 12288:fneDfQeRo4YwMspLzJ9hF+afaXHXp6HzW/oqSvus2zTm2qge3YHWO3j/xIwXN2hg:fnePFq5Boj2
TLSH
T1D2258760669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35619A42D7F35F2024C67E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\sk.pak
Size 647KB
SHA256 12b0f67bff228cf65c6f9f5a410c0758e4d52f0cdb9abbd4dd9ef828f99e07c4
MD5 7ff63957e4a40d9546e890909bfa76d6
SHA1 be335df24c73eade633759ce447a1f33075e473f
SHA512 66ae633e583700aa340887dbe9186f9192e05772151d1c344826598d7f4c5c7414a05eb628197d1708c8d646b9f90467b27bc8078630a2d1fd53c5355b48782a
SSDEEP 12288:c96UcluDkuZWAziUiOVl5JnD7YwOafpTjsxt9J1:nUclu7liG5tYOqtT1
TLSH
T172E45D3FDFE7181E8E8D0144EFEA7110F97E86508A4EB4A6940F374714E26ED8AB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\sl.pak
Size 620KB
SHA256 bf4846b38adeae6794d2565faeee093e9ea77febe1c2db3ac18193cc1e0e8d2f
MD5 18ca5ee4f5ecbfdce8ca67b4856eea18
SHA1 3b085fe57f01a790e5db4d9944dd440316777605
SHA512 b330d3f9f17c97a612ef31a77db6d37d807a32d4fcecc188a65bebb75ffa8e0d68b6bee9a8d6333b6fb13b995a2819a66bcd9ea59f7d4261a11716157089afbb
SSDEEP 12288:sJHUL/HtcB2gUykCy5QQHslWOq8xZi/fzhtqA:BjHykCy5QQHsXi/fzhj
TLSH
T136D43C397AA79E0F0D9BB2CBFEA202007FDC044CD256A662EC4F33795415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\sr.pak
Size 956KB
SHA256 ae56d881a0f06647dbfe173f3cabedc734a8353d6183099c734570276f38e104
MD5 4cb80051051796243068b1e9fc191838
SHA1 a9dfe18694dd7b467e7fec8fe095de82c8d67160
SHA512 3090368c06d5c7ce19e3e64661b9c3d0296cb59370931029ab96d82e77bbe5d1b3dba255d62f0fdec130d71e5e6938e70cca4526c0636872f2d4925b39b478b8
SSDEEP 12288:PFnVE0WIVlTSgdastWi4I/Q7vM5YF4JXCFxdi037TqcYU/k/J:VmfY51CFs
TLSH
T1752557A19B9E64DB0501F41BD808BE493DAF41FE3FAB975211601DBD34E20B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\sv.pak
Size 555KB
SHA256 5e44c6ff9d4f432696c747fda111a7ad99df0b818254bbf251e578952ae06d36
MD5 7f306443cd489e526912cb2ddff66263
SHA1 baf98d5fbbbdc7aaed6a201dd4c4e63a9ec7713c
SHA512 e9bcf53d08b1d72352ee67404d7a47aaf7cf9fb42ac6fb59dccbf6816142290d56e7b91405f4ddb8548140ed0586edf5bae7da359268b2ec381b857e11b19281
SSDEEP 6144:tZxfJEtssvg1QjkcXxh6xRi/l8b3L4VRFcz5RtGmA+SF4p6FMo5SOGk5ulpQiXHS:xx07vOih335Hi37yN
TLSH
T15EC41D438A50F526FB72130DBA08115B0AEDE25CE7E2954EB8D9883DAD8BD5805FF347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\sw.pak
Size 586KB
SHA256 bd6ab24cd929d6809dca3ea0a5105cc567e9c9c2bf65f8814b480def6cf1992e
MD5 67371e232529103f310de3244da78654
SHA1 5bdcdadbd620409eb5ea152cf92f83d1ae0bb39d
SHA512 bbe39e5304244353788004450178c958adafe8b09e7f0eaab9e57182d34b8c1d39264535de40a4e80e68719516f640e90a11ac36788a0de2e01aba3db7cfc92e
SSDEEP 12288:p2r1cb/E7R0xGa2qH/5hmedqYGjRdAu5ObQh498loLGaP1ac0GbBjNUiB8bBvKv4:MEMViL5KWC
TLSH
T1A8D4D6629871D0191233618603D9FF731BDCED5C2E2B29935A46BF0F218F98C57ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\ta.pak
Size 1.5MB
SHA256 ca560534ff3ca837cbcbbfc240af7dae12a82466bc16e99e7b79376cd102e342
MD5 2a5230c4a097fa0c31521d3f2ca2c9f2
SHA1 68a9ad148bb28ecfd6765e93524e9c5049c0b2ac
SHA512 137b4e73b904a953d263ffc06ffd955e0c107fcd410b65b8c21aec0cf4e6f3c5ddea05f6c1818e454db0c2c84d010d8347dba15577d51b6d5b3f5b00bbac2d02
SSDEEP 6144:GEIl2FMazGk3hKhGP+m5zqotRdwtm1vYpiMyZ:pIgFPIhGt5zqttm1vYpiMyZ
TLSH
T119750CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\te.pak
Size 1.4MB
SHA256 11a1d2d935b401bc9b24f158774310d73c31b1616bacc61a054c7ef4661618b4
MD5 77deb27924465ce85a0ecfededd691a0
SHA1 9d034fa72c8049add89f9df330eaffcfa4cf1291
SHA512 6115866b353b77b30e50f168dd80378186fab1f022212e9ded1d23da54ac38e2e452253e244023825db3c49fc30f479023314f2fee4f0454f25cb1b6b0d735a2
SSDEEP 12288:v/T8ISA3B7McKN5ye0aPF602ngIC8ymoRRT5hb8O52CRW1s6Uu3p1FPnY1FAC/lF:z8IwM5MucEy
TLSH
T1626591023A6AD310DAE60273752CF66C49781B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\th.pak
Size 1.2MB
SHA256 d8f5800cb99e227287bdbed8d807380185e20d166901917b6b58dedc5fdafbf6
MD5 34ba508cf0f34d200ff2d5f1a6678911
SHA1 bfbf9eba82e959abdbfec026bdb0b7be666b7bc3
SHA512 7363b9500c2a81c288f025e8c531c33ba292ee644e6ea1c28b3d29f4faf7ec5306ca52f9b9849648373e9bf62050b52bc519c26a387cc80c4f0c7c8d2a0dc51a
SSDEEP 12288:B8CCVuN9LyZYAhzYLiJ1s3UlkJUsGPsO5eXffpbDfc+7yvm1qsl5UP6/dLL3fqj0:eYs5cs+
TLSH
T190454BB37247DDD479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\tr.pak
Size 597KB
SHA256 71b1b037ab44e6ed3f954b2c6318063d29e708dd87306c9051f1e48e43714322
MD5 4010148a18c1795f5f343bf5d11f1d33
SHA1 10117ae8c6d45711209e7bec45501e608796b39e
SHA512 0e8a1c39e3eee6ad9d3d2f5e19105890045e679cd68938ebcd266d46a25a13f6907da007c8ce48c7581d77352dec9e729fa2cf08683939641792d3c36a3a8abf
SSDEEP 12288:Yy4OzDPxUDZeHzNsgNDPfZFDo6RPJkM5MA4N:51zaNwJkM534N
TLSH
T17ED4FB8178EF681C8BB9278FD6E90666F89F0766B331F446DA268636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\uk.pak
Size 1.0MB
SHA256 fff206f5f631d0dda9579cf806cde4de5848a7474bb1ac2b1239ab967a8ca88c
MD5 ba540ead51b31c295132a27002fc0ca4
SHA1 f428530f83edc644005830e86229d69bad9006bb
SHA512 b0a2e3894b50f7478eeb96682fbf4ed834a1dedcc07bd554e0e23939bfd4bbd053fafef587ef9184c5f2dcc6e099c92eb99160941ee82447d512bcc65a5b28c2
SSDEEP 12288:ttSPM4hfLraIwzdCpAY/sSr+FhZuMSLrGBnIU3PD56NUlDAHe8tJEuILNiXEBqqR:t4k4rqd538a
TLSH
T19E3598A19A9D58EF0105F05BE94C7A0D7DA701FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\ur.pak
Size 898KB
SHA256 0f3cc59fd6c706ae8d84a0cc50301a4929ea1f0204ad5e48250f1a354d6613e7
MD5 80cfdd6a4397e1d72070c8767c04ce0d
SHA1 29cecb0a3b5c1e5d6042b33dc93aea5a15ed4bcd
SHA512 fb89183bea472cac709f78b2f7ff8d85fb604d1ad96356044a6ea0645499e4a5ca190fbfda19ce02d140c90920a7229b3ea8fa9cbd888ec6d9961ca8a34404f5
SSDEEP 12288:gQCZ3Toob38PMVrxqtdQ1t9fylbYH5Fd5E8jGjOxODDQYrTEYjwadcJKwUZu5cos:gJTv57Gci
TLSH
T1C01500D2E6BC96B34A21D92780D33C34CB635F13D34AF285E92246C54E9A0135F6DE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\vi.pak
Size 709KB
SHA256 f7df08dbb5ca133109ad809bdd89be82cc956a0518e6dee7e02fe4f65118d77d
MD5 987e308623db58c504e7a14a63dc502b
SHA1 2fd0376ec7daf5039f155ffa42491d1e9413655b
SHA512 4e16cf9f61be84f274866b76a0422741b89938a09b3577f0516c1529d4a4d28da3dac8b863861f4e0e8629a65567273fb9c43ee535783d16eb5c8211da8e438a
SSDEEP 12288:zDgTkmb+coIsoErtV0ktzn80NHMFrYDbwZoJev5a8itCcPj8lV6ziDHBbryq10:zkTk4+co/Vdz80eFE/+5a8KCeIlVMiDm
TLSH
T165F4851216E1302680AC553EC6CD540D6FCAE42FF7C1CFE56FE529747A221A46F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\zh-CN.pak
Size 508KB
SHA256 e27395a6c73ac592f05e0de00f4c17efe181a4900c1f649e69d3a21dbb87cde5
MD5 eaf211357d9bdd9069f7f823abf48e57
SHA1 f03f84797cfe599ba102e6fe93a836da30a326ac
SHA512 c2c51eeb9448ed69307648841e4f77d4d04f701234e8dfa7ab7ea55628eda0c47a09f412553d0aaf8135ed1ce10e0b178a2cb9abe4a81762f625b454c8dbccd0
SSDEEP 6144:LErIcpubJfIaWUQ5W7Xe7fSSyInZ76ruEYBSVv59pacgI3CYG243KCv19tlk:IOfIaWAuSS1nwruEYB+v5z9jSY03xI
TLSH
T119B48DA911F9BDEC004650E03B29613D7C40720BF66BAF766ED248DD2AA2F9D0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\locales\zh-TW.pak
Size 503KB
SHA256 aee4d9c6230c5ae8257fecbccaba6b8668e5a34d6c44ef06e4574e12fed7fd8e
MD5 cfe1fc7d3433456207a9455056136f44
SHA1 fbe7f0ae63a4dcc527c6fcf24a111b610b24c940
SHA512 cfbfeffa821059ce8f662ed49cf1746814f59a1178d77ad1980bc1473b351e0cb3f946d66ed180b3cb02ae6a8e79ad9e361f9e7b1c0c034ec453fbab8ea16fcf
SSDEEP 6144:SAqsxe82e/mwIRwyuo/VJRxr622Quujh7J5hnfVH6D/j6h62u9mnTX:jqsxe83mwkwoNxOSjh7J5xfVHdN3
TLSH
T1FDB46CB608FBDBEF0901F884B7CD563ABC9B342CDD777636FC8518D42E6AA580A61045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owutility.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\owutility.dll
Size 2.8MB
SHA256 4b75969f28449b0a1115fafccf7b9bb26042d45c48e6bb7f829329caf2ccae8b
MD5 019dc4e1fd7003911a694c9511b68c02
SHA1 b39bcf279a914b7cbedde4771478115f575881e2
SHA512 cfe1f75f7e357e9d488cf11f5a4a1047fc2e2a48f02ca7ae9d02157b7abe423da287b9ee5bead6b96005ad9d2964fdf722f529e43ea32e10425d3f828f50d029
SSDEEP 49152:xuQg45iZHPvFocfYKdTkToSpgnAAuBUmGXz+cthzmrvStDYhXO4kerPE:xhCZHPvFFfYK1p/tu6Jz/irviMnPE
TLSH
T17DD59D5766A540E8C12BC17DC596B60FF7F378290B3593DB42A5A32E1F73AE12A39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\resources.pak
Size 5.8MB
SHA256 71b305ddcea5bbe169b1fc1b7b7c039431da46e6fbdf9abb1e55848582859491
MD5 e053039c0181f16a37ae423f6e5523d3
SHA1 b9319adaa273d803acb2d9c47682faef3db49539
SHA512 248c94d909ae176aec963ba1c59d82af559b235b470eb7cf1ec849b99cb61e25cb2ad4dbd2a77275b1f13592f4d3e0aabda09f3344985155d7acf9f5beba444f
SSDEEP 98304:G/RTeUPl4jFPOX7P8kARvlaLIPz5H9MnsRrwrC/ICGaZZJjoMzL9+CfLRneSmD0s:u9emujFWX7EDlZbLMsRkrCAGoMFnxCGk
TLSH
T1835633D177E61D6FE60893BD81A98271CE2D4425342A600A604CB179FC36B6FAFD217F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\resources\app-update.yml
Size 133B
SHA256 d7358a93f52b95baa21cd49d81bf22c3edcc2169f9d1728dd70a7af0af212f4a
MD5 fb01b9479a97014234fbffba6dbd7811
SHA1 677cca903beae0ba830e569bfead4f1a74f52bc6
SHA512 e805b927e30cdac3d5a0f65a15d2b91dc6a511c05e08cdce676a9faeacc88f86ffbdf8de6b63060b71edcb2f8fb85d3d627d37a8b5f0aba45bebf0655f61be4b
TLSH
T15BC02B62D3008042C3300D343547A56D81D428CDC045C315C0C1104A4152E10AF2209C
MD5 SHA1 SHA512 TLSH

Submit Download

core_module.exe

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\resources\binaries\core_module.exe
Size 44.9MB
SHA256 aefecb82a7493a420f5a6cd787323c6f5a47ea818cf09067ec5f253e94aadab9
MD5 9100298a20755cd9cd05f5ced0e72c74
SHA1 350af8911cc683cecc41bd314ffc3fbc6b11bcb9
SHA512 1871510d3bb612248a717426459bcfaa8c0273cf43b1d3d338c3321d01e85a5d448be639886f3658d52dc59fd6020f3dd259fe9f74a5d03f64f07433e52fda21
SSDEEP 196608:X9DFAX6Pv+z8p5eCSoInM97eLf6BGWGSBE+3WFa/SSn9CvnHjbjAqwSRKR:tWW+CdInM9Wf6BTGShWFa/T6nDbgSRS
TLSH
T183A7F7157BABA96EC55AC8B0C34A4A735E6130CB0B35B9FB44C486353F79AF42B38714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\resources\elevate.exe
Size 115KB
SHA256 15f2fbcc376f78b61f927660810f66a476b2deb378270eaeff77993c9c1b0605
MD5 e103fbb1f1d5d0ac3d314f417f450315
SHA1 487b2f497fb8dac07d80f5889782cdf27d37b5ec
SHA512 7109365bd508e88509fecdffac5f86d37346a3d60057daafcbf7383bcc966d0bb6efbc5a299a8f9774395651a80a130455995de5a1aed54f9eddf0d33ff8249f
SSDEEP 3072:+CbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlMZ:NPrwRhte1XsE1lk
TLSH
T112B37C1274C0C471E9732A3559B4C9714E6DFD710E759FAB6398027A4FA02C0AA3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\snapshot_blob.bin
Size 314KB
SHA256 f5799826224d193037fb019e793f4e3cb03c28d18d25948239bf45fb0e640171
MD5 9df16f6aa1b2ae47dbef18464a4b80e6
SHA1 96d16d9fd3142f94b95cc0b502de7c78f52c6745
SHA512 8f3ec5ed371865916c5096ef48d4bc21f2846646f71378c3e3a7c0c3dd0e7f87f43ee54bc9755a71cd394bfd26c546d72700d8092eb52da9ffda19861fda84d3
SSDEEP 3072:MRKUbt+xmR13ZcOol/lxwsG5enXqPy2VqEahdffawkSz2J:MRdt+yUFld2Fq2Vpah1fawkD
TLSH
T19164FF06B31EC737C95A2A7A4CE9AB853674B1CEAF86621B350943FD387057C4DA1B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\v8_context_snapshot.bin
Size 683KB
SHA256 9537f5ad5847faf38a7030e0688b2b77d1582d196c034a9f2d5f19038f11b813
MD5 d635b18dbc2a7b288603216c0c5b3fa8
SHA1 a6210b0bcf439eef14854797cb1f161acbd1014f
SHA512 e825955307c0668676186245ac77245c6a5499c45eafb8c11f0f67d10b13718086eb50933e37f42221719e6dd98c080ad3e3a9b4f1aaf521ac6a9818a5df3370
SSDEEP 6144:qqGRvt+yUQj/sFq2Vdk1p2VXy1fawkWe9YITbg1HoSFrUb6keXjxQOLL:qxMk1pX1y/We/Tb8HozbeTTX
TLSH
T182E46156A75FDF27CACE187D5EE59F453DB5B08EAF0B422B311803BCA43A2640A9530D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 a52712b9545687582f8160013a03a6b362114a2579a0e4ad12f07a24a494fd81
MD5 772cd0d03bde5a339a029913552d37ac
SHA1 bd49ce0b75d183b01305e5cc8f40d02653adb566
SHA512 c822efdb4ec957d60951af16d15012a06741c1f447e8aa48036fe1fcc084bf6be9ca2bf4a92d42c32dbdfe5f88d5ec812852af495a89d124bc31242e01dd4a35
SSDEEP 49152:fDW1Poli1Z7qWQaqMVEgGL1G8MZ0CsEzKnzzA6Pr3kd7bCXTGnHIzHC2Rmgeqwkl:fDW1PTkdXLR04q6
TLSH
T16B463803F28680D9F05DD679875F9622F672B8814B2276DF52A01F192E7BFE0A739701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\7z-out\vulkan-1.dll
Size 910KB
SHA256 d6222e3877379a4f967fc9a08286288cdbf3675cb94de474ef181a3b78e76daf
MD5 a0d802f03f7501c8162e36712f44b88a
SHA1 77ad88236f20f00ba58b187055fde8a2d19c74be
SHA512 caea4c0b485e060fad8784af108c3773daa09c39c469179413896c2b4b815d9500ca5aaf95f6d263121ec0409189af93dd95220ae3bc5825a5dc7f66a8adddd9
SSDEEP 24576:jsRkqGlxBNI4OBs8lG0mt16Z5WRDYsHm6g3P0zAk7Nlw0:vxlxBNIasG0mX6Z5WRDYsHm6g3P0zAk/
TLSH
T1FF154B13A69485A9D57AD034C9D28603C9B174822316B9CF02AC5708BF6FFF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpiderBanner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
TLSH
T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx4A92.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Network\Network Persistent State
Size 702B
SHA256 42bf3476eca5423d1e292f1bdaeaaa037d2560c9d0eb5496cc21ef3dff8dd8ce
MD5 a99aa6ecc431118a7dfb4a868d70c302
SHA1 72d5424fddab3a4bb5a58a05fa9b9f4804d65564
SHA512 29b199f6462b8f43ecf143f36bfd6ce7c0747564a5217344a4ee059fa54f1ce9ee52b4bc3ac85e5ab9733b88b1da297850717cfcea04f883d9b10f5b49168dae
TLSH
T1080147EB83F4057E8A1263F01E267D23CAFD0A18539CBC4285D89B0E47F2976540148E
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Partitions\__owepm__\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Partitions\__owepm__\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Partitions\__owepm__\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Partitions\__owepm__\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Partitions\__owepm__\Network\Network Persistent State
Size 196B
SHA256 3affa42076b02185a6eb9ec02b9360e3451d200a964a91e406cf75a07052e414
MD5 166cdaf96b69b905c7674ebb974296a3
SHA1 498c4bb07ec7fa31573f3e813eb5e2605cca2124
SHA512 d3dbe4d43fef34f703305cd3df94c937e1a9a385fb0ecaeeda667a5943d12d7376301e9a943ac90b438e6a087f0d318cbcb601e2a47a8ab7369ecd6884dbdf06
TLSH
T13FD022A6923028FE0B4583E00A15AC13C6FE0402130C8CA69264772C86722AC0818C8B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Partitions\__owepm__\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Partitions\__owepm__\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

gdl_conf.db

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\data\gdl_conf.db
Size 252KB
SHA256 24a964e4befb70d8b42a312740027132e884e3f47023f2491c856d2cf6622631
MD5 3d79b23bf43eb4325c2120f2ac031199
SHA1 40a0afd138ff620a5c8fe83733718fbccbe89643
SHA512 57c37ee2d5afa9b2d0a2838ac734deda721dbcba9ad21b69a2d895d7582fb18a4cee8b420555f8c000680dda1a743bbc7747f35e5de87c089558cbe383b0d048
SSDEEP 384:ZHkgexjhtDesGBoOpt+0Mr/0HrG0Pp+0Ve0jKc:2fxfqhpo0Mr/0HrG0Pp+0A0mc
TLSH
T10944CAEEAF543F21C0F051B188F419632C3E661F4F56768039E811EA9FBA12F65361B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

electron-log-preload.js

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\electron-log-preload.js
Size 987B
SHA256 bdc6bdfc1a4c4c42b430a4021b073b8e0c2c6a21bbac53a644b54ca2a7c47f52
MD5 0d73c9c6128b61fa4e7f3c5562041f0b
SHA1 83552f1768a43c2a50d53f1b8cfdb956d49f10c7
SHA512 7736122846db3d3bf9e0b6d1c63e72c09fea475ffd2f66421bb30e79f912f6648b74d802c29d6a7ac0fabb2ada6934134caab71a368208fc43753864a3e3b0b3
TLSH
T15C11217DA8FA1C771405402CA8D62A415FF6E756283DE1843B4D42AF2FB8D512F02348
MD5 SHA1 SHA512 TLSH

Submit Download

main.log

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\main.log
Size 1018B
SHA256 41090b9ab11d297788302a720d84585e8ad5be4e9a59d993304338af582bcd5a
MD5 878dc33d852b82752f72d19c2b6cdaf2
SHA1 9c60fec737949633ac68cc5342f1e6a09254626a
SHA512 2ef654c77a9ff2b3ea28d801133d7a234e5a0c17255474e283e88478d964121eb162eed76d261b4c46303dfef2ce7f46b9fbc631584304df6bff12d3c5d4c131
TLSH
T11011EC345ED5A0EB414003A1F7E6AE9DE5B7F3932DA16E6473AC10E82318D0AADD6C0D
MD5 SHA1 SHA512 TLSH

Submit Download

main.log

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\main.log
Size 1KB
SHA256 f5568c59c6d7c3bde00f8e4e3883429feab2b59ddc0412708e814d512c6f890b
MD5 e4cc211a0172085c6b9de6466ca5d162
SHA1 d9889a026dbfaa779aa3fdf73d29ca3d203fdd01
SHA512 badcac3f37fe60f70b4efa0788763a73d2076f28eef63b7d1314fcb46731604d62662f721f2ce008ceda51bc3b2bc0a293c062505a226a50fe6b3d1892ae295a
TLSH
T12331E9605DD960FB44400365FBE6BE9ED5E3F7A31DA0AE6463DC51E81308E0AD9CAC4D
MD5 SHA1 SHA512 TLSH

Submit Download

main.log

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\main.log
Size 3KB
SHA256 ef5e608eb628deb8011110ffc059779f2590e9c8ffd05865af83c25ef6a9f2eb
MD5 c97d9686551e8cfe4afa304fe37bba60
SHA1 463b70e558d36f918eb36b9526078a0a21d2af38
SHA512 de5f62b054f4338580b198a10c86ee80a1cea2c8cb5e9a7c62a7322de6bfb1ef49ef6e21922095bf3144ed56f9e7c49f8510a44f974b252a3b3ee716f747f1c3
TLSH
T19C618D206DE660B70401423AFAB6FDCBD1E3E3632E657E6566E811DC1304E5E9BDAC0C
MD5 SHA1 SHA512 TLSH

Submit Download

main.log

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\main.log
Size 4KB
SHA256 894e6ff1250a12b5635b7c80b06b5d252dbf96c2d8f38c34ae2fbe0bd1d9c148
MD5 ae6b48b66c77d441b5b7eb874677bbf3
SHA1 9b4c01bb20ca5ae1d3050fbdb68de96aec6a0b43
SHA512 6dcaa7ad3c700a5a1801e8c390dd567f0848592e153891dadba23ad7769212bb48024bf5f7e016e12031fd02588418985f71c93436ae1e3d498bdf1f119d30a2
SSDEEP 96:oMqpzJYHTHvwVhLnvhHw1Nd0fIfJI/IGyO99nScG2qLO1P:lqpzAwVhL2vd0Qy/IG79hGhLO1P
TLSH
T1C491D0306DA660B704114235FBB7BD8BD1E3F3771E516DA196E851D82308E5E9ADE80C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\sentry\scope_v3.json
Size 11KB
SHA256 fcf540e67b31004b33e955ad2f81d84012b11b2c3642bd2e4f48fb257204b023
MD5 a6daff635867ff26f3fdd92bd67c1e65
SHA1 02fb5a8b19be449c92470f32ee582ac9d39edec3
SHA512 e7546c0fcb87acad228319e11e2903b569e0c0c0fb3797d45f5ca2ba27a3a723b8d0350a09ab7d6f66db974361e24cd56dccf0e68037dc56f1151b6d4322d8b8
SSDEEP 192:Iird0Qy/IGfHbZmalQjWTx++/4O++/4Or++/4Og++/4OsaO404mICPIr:H4R1Lh2GaOXZICg
TLSH
T1773245201FBC5C755F96F5AEB4A16C45D3B46A8BEA483CC308A4DF2C456A9F9203D13E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

session.json

Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\sentry\session.json
Size 271B
SHA256 6d6eb2bffff760841d090855e7ffffa3f6c177521f715a9ee8ac476fd64845d6
MD5 56d3c1ff6744def81bae4c3af305e10d
SHA1 711776adcb03411c8945a94b500fb5b000569413
SHA512 4293d6d7261f30bb33fa1cc48057b1f4721c8c6e36ea83a69bd63382e8a97fa2ccf99fa5a0a8c5b780071d59614139fcb301f75e3375cb8942f97955f9e8eec5
TLSH
T19ED0955CD36EA0F354074163410E2F6C58EFF6374440DE7055AF691883545331D0700F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/952-1228-0x000001E322B70000-0x000001E322C1D000-memory.dmp

Download

memory/1500-922-0x00000264F93B0000-0x00000264F93B1000-memory.dmp

Download

memory/1524-1133-0x00000224A75F0000-0x00000224A769D000-memory.dmp

Download

memory/1524-714-0x00007FFC78E10000-0x00007FFC78E11000-memory.dmp

Download

memory/1524-713-0x00007FFC782C0000-0x00007FFC782C1000-memory.dmp

Download

memory/2312-1030-0x000001663B0C0000-0x000001663B0C1000-memory.dmp

Download

memory/2608-1068-0x00000264B9950000-0x00000264B99FD000-memory.dmp

Download

memory/2880-867-0x0000023CF94C0000-0x0000023CF94C1000-memory.dmp

Download

memory/2952-924-0x000002A9D82C0000-0x000002A9D82EA000-memory.dmp

Download

memory/2952-907-0x000002A9D86D0000-0x000002A9D8746000-memory.dmp

Download

memory/2952-925-0x000002A9D82C0000-0x000002A9D82E4000-memory.dmp

Download

memory/3044-1132-0x000001E7B3DF0000-0x000001E7B3E9D000-memory.dmp

Download

memory/3056-876-0x00000180E41E0000-0x00000180E4224000-memory.dmp

Download

memory/3056-830-0x00000180E3DF0000-0x00000180E3E12000-memory.dmp

Download

memory/3748-1275-0x000001AC1A8E0000-0x000001AC1A98D000-memory.dmp

Download

memory/4236-908-0x000002744AA80000-0x000002744AA81000-memory.dmp

Download

memory/5004-694-0x000001E38DFF0000-0x000001E38DFF1000-memory.dmp

Download

memory/5124-1369-0x000002DB9B3A0000-0x000002DB9B3A1000-memory.dmp

Download

memory/5124-1371-0x000002DB9B3A0000-0x000002DB9B3A1000-memory.dmp

Download

memory/5124-1370-0x000002DB9B3A0000-0x000002DB9B3A1000-memory.dmp

Download

memory/5124-1381-0x000002DB9B3A0000-0x000002DB9B3A1000-memory.dmp

Download

memory/5124-1380-0x000002DB9B3A0000-0x000002DB9B3A1000-memory.dmp

Download

memory/5124-1379-0x000002DB9B3A0000-0x000002DB9B3A1000-memory.dmp

Download

memory/5124-1378-0x000002DB9B3A0000-0x000002DB9B3A1000-memory.dmp

Download

memory/5124-1377-0x000002DB9B3A0000-0x000002DB9B3A1000-memory.dmp

Download

memory/5124-1376-0x000002DB9B3A0000-0x000002DB9B3A1000-memory.dmp

Download

memory/5124-1375-0x000002DB9B3A0000-0x000002DB9B3A1000-memory.dmp

Download

memory/5408-1320-0x000001D5B70F0000-0x000001D5B719D000-memory.dmp

Download

memory/5624-1336-0x000002793B0D0000-0x000002793B17D000-memory.dmp

Download

memory/6084-1172-0x00000285FCC70000-0x00000285FCD1D000-memory.dmp

Download