85216220e30eab9f3afbe6c468f75d40322af1fe8b680d6a92c5aae65f84c982

Analysis

user interaction
yes
max time kernel
128s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
20/07/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Notoq-Game-Center-Setup.exe
Size 104.8MB
Sample260720-xd4pmab13q
SHA256 85216220e30eab9f3afbe6c468f75d40322af1fe8b680d6a92c5aae65f84c982
MD5 85fbb0b7819c4dfb2dfca0c385ad3e98
SHA1 dd5fa6d417044723f38e8f9cd1d8b2728e126f21
SHA512 74e56ac64744e7a33b34abc35318b5657b09b4a069241417f82a9a7343e18a444b62215337cb53beac3104fbe164aa43df94a82bd1c705dfbf397689fb508757
SSDEEP 3145728:xWXCiwyyXYSqKOD/3GW+qAyEAFUz7BnR77m:bHaSqBfGWbDXw7/7m
TLSH
T175383359CAB65A5AEDFCFBF9200AF83EC5157FA126F24013859E1D1BDCE9F080384466
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence pyinstaller spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Notoq Game Center.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Notoq Game Center.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Notoq Game Center.exe

Executes dropped EXE 10 IoCs

pid	Process
4996	Notoq Game Center.exe
2060	Notoq Game Center.exe
4468	Notoq Game Center.exe
4416	Notoq Game Center.exe
4100	Notoq Game Center.exe
1768	legendary.exe
5252	Notoq Game Center.exe
5260	Notoq Game Center.exe
5268	Notoq Game Center.exe
5460	legendary.exe

Loads dropped DLL 41 IoCs

pid	Process
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
2060	Notoq Game Center.exe
2060	Notoq Game Center.exe
2060	Notoq Game Center.exe
2060	Notoq Game Center.exe
2060	Notoq Game Center.exe
4416	Notoq Game Center.exe
5268	Notoq Game Center.exe
5268	Notoq Game Center.exe
5268	Notoq Game Center.exe
5268	Notoq Game Center.exe
5268	Notoq Game Center.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe
5460	legendary.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Notoq Game Center = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Notoq Game Center\\Notoq Game Center.exe\" --hidden"	Notoq Game Center.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Notoq Game Center = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Notoq Game Center\\Notoq Game Center.exe\" --hidden"	Notoq Game Center.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4828	powershell.exe
4848	powershell.exe
1108	powershell.exe
2936	powershell.exe
4616	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1112	powershell.exe
4616	powershell.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000900000002450a-978.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5600	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Notoq-Game-Center-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Notoq Game Center.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Notoq Game Center.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Notoq Game Center.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Notoq Game Center.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Notoq Game Center.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Notoq Game Center.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Notoq Game Center.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Notoq Game Center.exe

Modifies registry key 1 TTPs 16 IoCs

Modify Registry

T1112

pid	Process
4620	reg.exe
3052	reg.exe
728	reg.exe
4060	reg.exe
1464	reg.exe
3348	reg.exe
2568	reg.exe
5284	reg.exe
6104	reg.exe
6100	reg.exe
5320	reg.exe
1864	reg.exe
1096	reg.exe
1252	reg.exe
3452	reg.exe
5904	reg.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1112	powershell.exe
1112	powershell.exe
4828	powershell.exe
4828	powershell.exe
4712	Notoq-Game-Center-Setup.exe
4712	Notoq-Game-Center-Setup.exe
2936	powershell.exe
2936	powershell.exe
4848	powershell.exe
4848	powershell.exe
1108	powershell.exe
1108	powershell.exe
4616	powershell.exe
4616	powershell.exe
4848	powershell.exe
4616	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeIncreaseQuotaPrivilege	2936	powershell.exe
Token: SeSecurityPrivilege	2936	powershell.exe
Token: SeTakeOwnershipPrivilege	2936	powershell.exe
Token: SeLoadDriverPrivilege	2936	powershell.exe
Token: SeSystemProfilePrivilege	2936	powershell.exe
Token: SeSystemtimePrivilege	2936	powershell.exe
Token: SeProfSingleProcessPrivilege	2936	powershell.exe
Token: SeIncBasePriorityPrivilege	2936	powershell.exe
Token: SeCreatePagefilePrivilege	2936	powershell.exe
Token: SeBackupPrivilege	2936	powershell.exe
Token: SeRestorePrivilege	2936	powershell.exe
Token: SeShutdownPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeSystemEnvironmentPrivilege	2936	powershell.exe
Token: SeRemoteShutdownPrivilege	2936	powershell.exe
Token: SeUndockPrivilege	2936	powershell.exe
Token: SeManageVolumePrivilege	2936	powershell.exe
Token: 33	2936	powershell.exe
Token: 34	2936	powershell.exe
Token: 35	2936	powershell.exe
Token: 36	2936	powershell.exe
Token: SeSecurityPrivilege	4712	Notoq-Game-Center-Setup.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe
Token: SeShutdownPrivilege	4996	Notoq Game Center.exe
Token: SeCreatePagefilePrivilege	4996	Notoq Game Center.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4996	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe
4100	Notoq Game Center.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 1112	4712	Notoq-Game-Center-Setup.exe	96
PID 4712 wrote to memory of 4828	4712	Notoq-Game-Center-Setup.exe	98
PID 4712 wrote to memory of 2936	4712	Notoq-Game-Center-Setup.exe	100
PID 4996 wrote to memory of 2060	4996	Notoq Game Center.exe	105
PID 4996 wrote to memory of 4468	4996	Notoq Game Center.exe	106
PID 4996 wrote to memory of 4416	4996	Notoq Game Center.exe	107
PID 4996 wrote to memory of 1108	4996	Notoq Game Center.exe	205
PID 4996 wrote to memory of 4848	4996	Notoq Game Center.exe	109
PID 4996 wrote to memory of 4620	4996	Notoq Game Center.exe	153
PID 4996 wrote to memory of 728	4996	Notoq Game Center.exe	114
PID 4996 wrote to memory of 4616	4996	Notoq Game Center.exe	115
PID 4996 wrote to memory of 2568	4996	Notoq Game Center.exe	189
PID 4996 wrote to memory of 1864	4996	Notoq Game Center.exe	117
PID 4996 wrote to memory of 3652	4996	Notoq Game Center.exe	118
PID 4996 wrote to memory of 3052	4996	Notoq Game Center.exe	119
PID 4996 wrote to memory of 3348	4996	Notoq Game Center.exe	120
PID 4996 wrote to memory of 1096	4996	Notoq Game Center.exe	129
PID 4996 wrote to memory of 1252	4996	Notoq Game Center.exe	146
PID 4996 wrote to memory of 1464	4996	Notoq Game Center.exe	132
PID 4996 wrote to memory of 2752	4996	Notoq Game Center.exe	134
PID 4996 wrote to memory of 4060	4996	Notoq Game Center.exe	135
PID 4996 wrote to memory of 1700	4996	Notoq Game Center.exe	139
PID 4996 wrote to memory of 4768	4996	Notoq Game Center.exe	141
PID 4996 wrote to memory of 3832	4996	Notoq Game Center.exe	409
PID 4996 wrote to memory of 1252	4996	Notoq Game Center.exe	494
PID 4996 wrote to memory of 1936	4996	Notoq Game Center.exe	339
PID 4996 wrote to memory of 3584	4996	Notoq Game Center.exe	210
PID 4996 wrote to memory of 1768	4996	Notoq Game Center.exe	149
PID 4100 wrote to memory of 5252	4100	Notoq Game Center.exe	156
PID 4100 wrote to memory of 5260	4100	Notoq Game Center.exe	157
PID 4100 wrote to memory of 5268	4100	Notoq Game Center.exe	158
PID 1768 wrote to memory of 5460	1768	legendary.exe	159
PID 4996 wrote to memory of 5528	4996	Notoq Game Center.exe	160
PID 4996 wrote to memory of 5536	4996	Notoq Game Center.exe	527
PID 5460 wrote to memory of 5600	5460	legendary.exe	164
PID 4996 wrote to memory of 5708	4996	Notoq Game Center.exe	532
PID 4996 wrote to memory of 5744	4996	Notoq Game Center.exe	167
PID 4996 wrote to memory of 5772	4996	Notoq Game Center.exe	290
PID 4996 wrote to memory of 5828	4996	Notoq Game Center.exe	230
PID 4996 wrote to memory of 5844	4996	Notoq Game Center.exe	173
PID 4996 wrote to memory of 5912	4996	Notoq Game Center.exe	450
PID 4996 wrote to memory of 5920	4996	Notoq Game Center.exe	475
PID 4996 wrote to memory of 6032	4996	Notoq Game Center.exe	389
PID 4996 wrote to memory of 6052	4996	Notoq Game Center.exe	181
PID 4996 wrote to memory of 3344	4996	Notoq Game Center.exe	183
PID 4996 wrote to memory of 3320	4996	Notoq Game Center.exe	185
PID 4996 wrote to memory of 180	4996	Notoq Game Center.exe	251
PID 4996 wrote to memory of 2568	4996	Notoq Game Center.exe	396
PID 4996 wrote to memory of 2028	4996	Notoq Game Center.exe	191
PID 4996 wrote to memory of 5156	4996	Notoq Game Center.exe	257
PID 4996 wrote to memory of 5200	4996	Notoq Game Center.exe	538
PID 4996 wrote to memory of 5216	4996	Notoq Game Center.exe	329
PID 4996 wrote to memory of 5360	4996	Notoq Game Center.exe	489
PID 4996 wrote to memory of 5404	4996	Notoq Game Center.exe	201
PID 4996 wrote to memory of 5248	4996	Notoq Game Center.exe	337
PID 4996 wrote to memory of 1108	4996	Notoq Game Center.exe	205
PID 4996 wrote to memory of 5472	4996	Notoq Game Center.exe	338
PID 4996 wrote to memory of 5564	4996	Notoq Game Center.exe	209
PID 4996 wrote to memory of 3096	4996	Notoq Game Center.exe	276
PID 4996 wrote to memory of 5580	4996	Notoq Game Center.exe	213

C:\Users\Admin\AppData\Local\Temp\Notoq-Game-Center-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Notoq-Game-Center-Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Notoq Game Center', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2936

C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe
"C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1844,i,4429753871538492027,7848339209201985663,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1848,i,9017518805723080388,11118596463493710952,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2060
- C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --field-trial-handle=1844,i,4429753871538492027,7848339209201985663,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1848,i,9017518805723080388,11118596463493710952,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2008 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --app-path="C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1784572921119421 --launch-time-ticks=646247278 --field-trial-handle=1844,i,4429753871538492027,7848339209201985663,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1848,i,9017518805723080388,11118596463493710952,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2552 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\gc-bt-4996-1784573573960-11n8f429m3ig.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\gc-bt-4996-1784573573965-1luz3g14nml.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\Valve\Steam /v SteamPath
  2⤵
  - Modifies registry key
  PID:4620
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\Valve\Steam /v SteamPath
  2⤵
  - Modifies registry key
  PID:728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference='SilentlyContinue' $pkgKey='HKLM:\SOFTWARE\Microsoft\GamingServices\PackageRepository\Package' $rootKey='HKLM:\SOFTWARE\Microsoft\GamingServices\PackageRepository\Root' $fams=New-Object System.Collections.Generic.HashSet[string] function AddFam($s){ if($s){ [void]$fams.Add($s.ToLower()) } } if(Test-Path $pkgKey){ foreach($vn in (Get-Item $pkgKey).GetValueNames()){ if($vn -like '*__*'){ $parts=$vn -split '__' $name=($parts[0] -split '_')[0] AddFam(\"$($name)_$($parts[1])\") } } } if(Test-Path $rootKey){ foreach($k in (Get-ChildItem $rootKey)){ $n=$k.PSChildName if($n -and ($n -notlike '{*')){ AddFam $n } } } if($fams.Count -eq 0){ '[]' } else { $start=@{} foreach($a in (Get-StartApps)){ if($a.AppID -match '!'){ $pfn=$a.AppID.Substring(0,$a.AppID.IndexOf('!')) if(-not $start.ContainsKey($pfn.ToLower())){ $start[$pfn.ToLower()]=@{ Name=$a.Name; Aumid=$a.AppID } } } } $result=foreach($p in (Get-AppxPackage)){ if(-not $p.InstallLocation){ continue } if(-not $fams.Contains($p.PackageFamilyName.ToLower())){ continue } $appId=$null;$logo=$null;$dn=$null;$bg=$null;$xml=$null $manifest=Join-Path $p.InstallLocation 'AppxManifest.xml' if(Test-Path $manifest){ try{ [xml]$xml=Get-Content -LiteralPath $manifest -Raw -Encoding UTF8 }catch{} } if($xml){ $app=@($xml.Package.Applications.Application)[0] if($app){ $appId=$app.Id $vis=$app.VisualElements $dn=$vis.DisplayName $bg=$vis.BackgroundColor $logoRel=$vis.Square150x150Logo; if(-not $logoRel){ $logoRel=$vis.Logo } if($logoRel){ $full=Join-Path $p.InstallLocation $logoRel $d=Split-Path $full; $fn=[IO.Path]::GetFileNameWithoutExtension($full); $ext=[IO.Path]::GetExtension($full) $cand=Get-ChildItem -LiteralPath $d -Filter ($fn+'*'+$ext) -ErrorAction SilentlyContinue | Sort-Object Length -Descending | Select-Object -First 1 if($cand){ $logo=$cand.FullName } elseif(Test-Path $full){ $logo=$full } } } } $s=$start[$p.PackageFamilyName.ToLower()] $aumid=$null if($s){ $dn=$s.Name; $aumid=$s.Aumid } if((-not $dn) -or ($dn -like 'ms-resource:*')){ $dn=$p.Name } if((-not $aumid) -and $appId){ $aumid=\"$($p.PackageFamilyName)!$($appId)\" } [PSCustomObject]@{ Name=$p.Name; Pfn=$p.PackageFamilyName; Dir=$p.InstallLocation; Aumid=$aumid; DisplayName=$dn; Logo=$logo; Bg=$bg } } @($result) | ConvertTo-Json -Depth 4 } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games
  2⤵
  - Modifies registry key
  PID:2568
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Ubisoft\Launcher\Installs
  2⤵
  - Modifies registry key
  PID:1864
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Origin Games"
  2⤵
  PID:3652
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:3052
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:3348
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
  2⤵
  - Modifies registry key
  PID:1096
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Ubisoft\Launcher\Installs
  2⤵
  - Modifies registry key
  PID:1252
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\GOG.com\Games
  2⤵
  - Modifies registry key
  PID:1464
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Origin Games"
  2⤵
  PID:2752
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
  2⤵
  - Modifies registry key
  PID:4060
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\EA Games"
  2⤵
  PID:1700
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
  2⤵
  PID:4768
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:1252
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\EA Games"
  2⤵
  PID:3584
- C:\Users\Admin\AppData\Roaming\@notoq\desktop\tools\legendary.exe
  C:\Users\Admin\AppData\Roaming\@notoq\desktop\tools\legendary.exe status --json
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4620
- - C:\Users\Admin\AppData\Roaming\@notoq\desktop\tools\legendary.exe
    C:\Users\Admin\AppData\Roaming\@notoq\desktop\tools\legendary.exe status --json
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:5600
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:5528
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:5536
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:5708
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:5744
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:5772
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:5828
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:5912
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:5920
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:6032
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:6052
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:3344
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:3320
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:180
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:2568
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:2028
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:5156
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)"
  2⤵
  PID:5200
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:5216
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)"
  2⤵
  PID:5360
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService
  2⤵
  PID:5404
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService
  2⤵
  PID:5248
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:1108
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
  2⤵
  PID:5472
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:5564
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3584
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
  2⤵
  PID:3096
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:5580
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}
  2⤵
  PID:5316
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}
  2⤵
  PID:5540
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}
  2⤵
  PID:5656
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}
  2⤵
  PID:5660
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}
  2⤵
  PID:5716
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}
  2⤵
  PID:5824
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}
  2⤵
  PID:5792
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}
  2⤵
  PID:5908
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5828
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:5932
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
  2⤵
  PID:5996
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:3336
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
  2⤵
  PID:6024
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}
  2⤵
  PID:5952
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}
  2⤵
  PID:5000
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\Valve\Steam /v SteamPath
  2⤵
  - Modifies registry key
  PID:6104
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
  2⤵
  - Modifies registry key
  PID:6100
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}
  2⤵
  PID:1608
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}
  2⤵
  PID:3068
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}
  2⤵
  PID:180
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:3856
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}
  2⤵
  PID:5176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5156
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}
  2⤵
  PID:5224
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}
  2⤵
  PID:5300
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}
  2⤵
  PID:5248
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}
  2⤵
  PID:5444
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}
  2⤵
  PID:2404
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}
  2⤵
  PID:2128
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}
  2⤵
  PID:2208
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}
  2⤵
  PID:4808
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}
  2⤵
  PID:3204
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3096
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}
  2⤵
  PID:1840
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}
  2⤵
  PID:3396
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}
  2⤵
  PID:5540
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}
  2⤵
  PID:5604
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}
  2⤵
  PID:5724
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}
  2⤵
  PID:5788
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}
  2⤵
  PID:5776
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5772
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}
  2⤵
  PID:5832
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}
  2⤵
  PID:5864
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:5320
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}
  2⤵
  PID:5984
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:5168
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:2340
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:5888
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}
  2⤵
  PID:2400
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:6104
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}
  2⤵
  PID:2268
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:2092
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}
  2⤵
  PID:4020
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome"
  2⤵
  PID:3060
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:5944
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}
  2⤵
  PID:636
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}
  2⤵
  PID:4340
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:5388
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:5672
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:5216
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update"
  2⤵
  PID:5432
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}
  2⤵
  PID:2456
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView"
  2⤵
  PID:5248
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5472
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:5548
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:2840
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:3040
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}
  2⤵
  PID:5304
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:2812
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}
  2⤵
  PID:708
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}
  2⤵
  PID:5560
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173
  2⤵
  PID:1424
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}
  2⤵
  PID:5732
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860
  2⤵
  PID:1436
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}
  2⤵
  PID:5788
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}
  2⤵
  PID:5780
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655
  2⤵
  PID:5848
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743
  2⤵
  PID:5868
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:5284
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063
  2⤵
  PID:4404
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
  2⤵
  PID:5836
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573
  2⤵
  PID:5948
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
  2⤵
  PID:700
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}
  2⤵
  PID:6060
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
  2⤵
  PID:6044
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
  2⤵
  PID:6032
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e}
  2⤵
  PID:5964
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
  2⤵
  PID:6020
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5625bb48-295c-4113-bc92-d6a69b19b04c}
  2⤵
  PID:980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2568
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome"
  2⤵
  PID:5188
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
  2⤵
  PID:4340
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}
  2⤵
  PID:5668
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36}
  2⤵
  PID:3212
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
  2⤵
  PID:5240
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{79D068F5-40E4-3614-A683-E351DF40BEBD}
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
  2⤵
  PID:5300
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7}
  2⤵
  PID:5448
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update"
  2⤵
  PID:3880
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}
  2⤵
  PID:3876
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView"
  2⤵
  PID:2128
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
  2⤵
  PID:5296
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
  2⤵
  PID:3204
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
  2⤵
  PID:2680
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
  2⤵
  PID:1048
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757
  2⤵
  PID:5652
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173
  2⤵
  PID:5656
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860
  2⤵
  PID:5544
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655
  2⤵
  PID:1424
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743
  2⤵
  PID:5812
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063
  2⤵
  PID:5824
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573
  2⤵
  PID:5820
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}
  2⤵
  PID:5988
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
  2⤵
  PID:4892
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e}
  2⤵
  PID:5976
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5625bb48-295c-4113-bc92-d6a69b19b04c}
  2⤵
  PID:5940
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5912
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}
  2⤵
  PID:6012
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36}
  2⤵
  PID:5892
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{79D068F5-40E4-3614-A683-E351DF40BEBD}
  2⤵
  PID:5984
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7}
  2⤵
  PID:3036
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}
  2⤵
  PID:5888
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}
  2⤵
  PID:6068
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}
  2⤵
  PID:3572
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}
  2⤵
  PID:3716
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4}
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}
  2⤵
  PID:2092
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d87ae0f4-64a6-4b94-859a-530b9c313c27}
  2⤵
  PID:4592
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}
  2⤵
  PID:636
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef5af41f-d68c-48f7-bfb0-5055718601fc}
  2⤵
  PID:5920
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}
  2⤵
  PID:1928
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
  2⤵
  PID:5256
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757
  2⤵
  PID:5484
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173
  2⤵
  PID:1464
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860
  2⤵
  PID:5208
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655
  2⤵
  PID:5240
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743
  2⤵
  PID:5360
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063
  2⤵
  PID:5344
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573
  2⤵
  PID:5280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1252
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}
  2⤵
  PID:2336
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}
  2⤵
  PID:4260
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:3452
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}
  2⤵
  PID:5124
- C:\Windows\system32\reg.exe
  reg query HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ad1e8d8f-5345-5c99-ba30-e3ad4eed1960
  2⤵
  PID:5500
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}
  2⤵
  PID:2924
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4}
  2⤵
  PID:1864
- C:\Windows\system32\reg.exe
  reg query HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}
  2⤵
  PID:3440
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d87ae0f4-64a6-4b94-859a-530b9c313c27}
  2⤵
  PID:4808
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef5af41f-d68c-48f7-bfb0-5055718601fc}
  2⤵
  PID:116
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}
  2⤵
  PID:840
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
  2⤵
  PID:1540
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757
  2⤵
  PID:5680
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173
  2⤵
  PID:5684
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860
  2⤵
  PID:5536
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655
  2⤵
  PID:5716
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743
  2⤵
  PID:5812
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5708
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063
  2⤵
  PID:5800
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573
  2⤵
  PID:5428
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}
  2⤵
  PID:5264
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5200
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  2⤵
  - Modifies registry key
  PID:5904
- C:\Windows\system32\reg.exe
  reg query HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ad1e8d8f-5345-5c99-ba30-e3ad4eed1960
  2⤵
  PID:2876
- C:\Windows\system32\reg.exe
  reg query HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe
  2⤵
  PID:5868

C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe
"C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe" --hidden
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --field-trial-handle=2344,i,11731772100959911841,10287437334821177259,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2348,i,16057633896076833027,7226316967093023888,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --app-path="C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2344,i,11731772100959911841,10287437334821177259,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2348,i,16057633896076833027,7226316967093023888,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2384 /prefetch:1
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe
  "C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\Notoq Game Center.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\@notoq/desktop" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2344,i,11731772100959911841,10287437334821177259,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2348,i,16057633896076833027,7226316967093023888,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

current.blockmap

Path C:\Users\Admin\AppData\Local\@notoqdesktop-updater\pending\current.blockmap
Size 114KB
SHA256 0ad899868739a4a9232c416d782981e403152aa58cfbd2fd14b2e1d2142aacfb
MD5 e0c5e0d63f10371e605771f2ddfd1d5c
SHA1 94040e979d96299c9803986807562060aa8f4008
SHA512 483dc924cf374b6e4189d2541b40cd037534e320c8ad4ce3588d0ec3d17e6893621432edb32fc6c5f54f650433be84ed89ff5525688eacaec929474ea7157a62
SSDEEP 3072:EIvY/dHplLyIH9moJjJGtd7riW2mWTMyjI+SBi:E0Y/dHvW0MMFGv+W2nljI+l
TLSH
T199B312C41B62C52A537C16D6A24FCD8EE7C89017A196489D0390FE84B95DF4B8CB8F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c03c91dd74498cc33a32d616fb3050ad954ed4f57e671e2e9651aedb7b128ff3
MD5 d30f23b777856a4a772cbe961f7b3343
SHA1 7b4f11fe65abb9620e0dbfeee619097a4648e70d
SHA512 64fa5e6ca5021734b620f79ded479d44ce30d4bd58ae9cdbee49fe1b251d6bd779a3b62708afafe90c37491259efc348d7fb2cb774d74668671c6295dca793d3
TLSH
T1E4415C303221B8D84D436F1315286ED5A3EF478AAFA89F5CB569231DCD2A45BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 aed53f572f1c6f20b80b7800c44222c869eba72eefa2d90d1d7f8685415ef1df
MD5 2e71a63146cd9b290c83fc7c0f45fc96
SHA1 6691b12c3c89f1958691f29e55040c26fd297df0
SHA512 8e7599d3d81c3fb25b3518cdd824147935a0c1500de259b1b8264fd9b3a353174de2e5bd05737eec8ca147ca1f7c819522ef3f78bf39fd4f597e2fce58242730
SSDEEP 384:S6++V991II7sFkKgC1Jk+o4ENY13o6gf9aamEi+y7dEd319dS:/THfKL0CEN7Ff9hi+UdEdc
TLSH
T15272086E311F2697D4A123B8D02A47EFE8F08D8FD34457DD16549E3B0ADEB6580B81E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 9f2052bfb23a4ce60922457c2547627e7a3175acfbdcd166a151944caeed1cd2
MD5 e4152813c96d1abce88c2eda992a039a
SHA1 26e8226eda63f3d08d0852de997ba107211047c0
SHA512 371bbf2a41fe57a873cac7fd07a96738d25650d31cdcaccec869a29cc365e501eee4ff04e8b08d638d7343a61d27d8f48fff2b436902d0db9a76fdb860ee416f
SSDEEP 384:Ssf+FK9i+Ui7K5Sy6VJk1o9oejTVK6seY2cE/uv3KoNhH/hEKcj2m:Pf4Iby6UWoejTVNP7UK45EKC
TLSH
T1EB72A4AE610F26C3C4862378D10B055FE4F29ECD531A07D9BA5A9F3B4EACA5E543C188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 5de4279a8db0c12883c404e9749001839d0a489ddf1d908bf11c7db278ddc143
MD5 c574eb23fcdc3d0d26052b1f39b9e3e4
SHA1 47f50dfc29e4bc5ad2e48cad9a2274a218c8e2c1
SHA512 0153564fbfad161c25ce2ae556e71132c490493cce78e9be5332d58afd5747d7427a40828ffe009802281369c1dc2cad7bdb7091fa9ddcac2533c65b7b666f8a
SSDEEP 384:aDsf+Ft91tcX8gYu7ppqWFARNY1PntRLazof7Bnk5vPE47ot0m:a4fqtMZdoWFARNUtkzE7u17ot0m
TLSH
T1BC82076D221F22D1D09227B4D42A0FABFAF08DCED3C906CC97585A3F89E975950A90DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\Notoq Game Center\dxcompiler.dll
Size 24.4MB
SHA256 f0eecdc9bd3bd048b888b19c1be803867dc5592e9b0745914ef48781a3956d32
MD5 216959e543bffdc463bdf22504e2558c
SHA1 4cd5407f4f09be3b01def31ce829e165bf7b463b
SHA512 d733b224a3c79090e50b093162756d768c8c9de798fdd22e7e9a78ba69f97aedda9f048ea45d79a5bf58fb9169f4a486a4e0596a15993fb42fde5a4a1f91cc39
SSDEEP 196608:zKkG+l2tvb3nmgD131GYN7aPtAH+R4gQiUiV1gFould/5YmO0r:z5G+lkvb3nV1GYIP+H1gQoV1Ioul3Yl
TLSH
T1B7473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cffogjmp.0gw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cffogjmp.0gw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gc-bt-4996-1784573573965-1luz3g14nml.ps1

Path C:\Users\Admin\AppData\Local\Temp\gc-bt-4996-1784573573965-1luz3g14nml.ps1
Size 3KB
SHA256 d1853829d740ae6a3f6134439db899a31747fe8ff3de0ee41ef2167f90a569ee
MD5 e92fce30b7c69ecc25fa61a3f8ca72cf
SHA1 2440fd73d1389c1e038b73da1d5825f943c60e2b
SHA512 91ca2649c3250c13bfadd8e78f4b269bd0001a3b9f65aa46ff9714fc1910526976f9541a53f4462795046a8dc50255a09b22ed5ccb5447d23724720d1307f854
TLSH
T1E5619BE2E5F1A83602E732BB0DEF06C1FE74A6D60486085474CC8551FFA596B426F7E2
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\LICENSES.chromium.html
Size 19.4MB
SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
MD5 f18ed9a25df7c7951cb7f936ca9feeea
SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
TLSH
T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 80d1ff5d7689071edae78164eacf92e4924689936d8cd818340377318b0a5da6
MD5 aaf703b6b18fb9aaedc7f9096728a241
SHA1 84e6437212b30f4be80d48a7e8576527306a5459
SHA512 ee4701f80b8d3a125f894effc92832d5dcd2cc56cf015afd60606a5ba28d3a7b9817f907b8c9c4c40cf81740c79cb65adb8e1d58b76e88febe4931eddd043c78
SSDEEP 49152:Rkg42lel5GuCT7w5LHBXz81IQbx6i1N2SByUSo8hqaLujbLDQdQcLNZ:RWlEuSwRHB/aaLujPm
TLSH
T1D3E59E02F6D251EDD029C03497ABE213F271780A4F205AEF17A05A253F66FD86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\libEGL.dll
Size 467KB
SHA256 380900fd2c24f14d602e5bf6d43c86f9c69362ac911d44f9609971a62735dbd7
MD5 28bf6bd56c12532526fbb1c914c0e1b5
SHA1 38f2c595d271a1d6281c5f49ff6aa7c3ec5f58bd
SHA512 a9518d1207b03b416428705034d88e8e831b2aab1405dfe128ae49e86d32cb8f7d34c896909f9d24b3073eb9d5c64f10c76d595dfb69f860dde953784a331ca4
SSDEEP 12288:w6/vCrog5QZ9yJNe8DcQir3YB9ANZMBg:w6/vCrovjLA94Mm
TLSH
T1A6A48D15B3E948A9E07BC1388A538643EB75B4520B61F6DF02A0D2793F77BE45A7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\libGLESv2.dll
Size 7.6MB
SHA256 d6a0d6700956b66e4b0d75f6cc102a9e0dfd7d923c5fba1ab227aa3cb0ba3b0b
MD5 e62d384a041358e5c15183e1663f2c65
SHA1 6395e53b2d148c902c4efc757b365cbbfdadab64
SHA512 b51f18eaeee4ba49fe27dab5f075e946839974351fb5caea237f4f7a28e7bb7f95c826fcd87decf315171473d19d49530ebdc5166d64b9e078e31261c84561bd
SSDEEP 49152:WZLjoLYM0JCVIM5OImUoJbmQO+76qJ6AJKibKnTaUueVYAO6a/wBWUx0IXvJ/k8m:gsLYR7J19mO6c8LSPkOSR6hLpsH8s
TLSH
T1C8867B03F69681D9C05DD2B88B57A223FA74B8450724B6CF2BA447152F6ABF0EB3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\af.pak
Size 605KB
SHA256 d990f4ced39e31a1149d2a1842ce2504706885e6ab05957ee2f338c77d94c16b
MD5 38fc876717fd2811593b8e1f5932685d
SHA1 3dcb3222e420713d6d731ff6bab7783dcd75c16d
SHA512 b98358fbb30f988b67edca4e7d608665ba10ba2b9c3230bee6adc9c040f974464b9e26eb72bf9a45b58d677419d8a2ed7f99d84cc1c22eefe496ec634bfa1c74
SSDEEP 12288:l+Ifrr9xi2tfxgtRGt+TkTnPxxNtEKY+53GmNAn4H2JyneNASgnALzcGfozvhpIX:ZvZtfutRGt+Tk7PxxNtEKY+53pAn4H2b
TLSH
T1EED41B0AEB91173D05B07696FB0945B7FB9CA26CC770B2BADDA982310566DFC10BD0D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\am.pak
Size 983KB
SHA256 8d3d5dfc64acfbb0c35036d74561d09ddf3b22058eeed0f8d26a2e9c0703248e
MD5 ca12f04a04bc27a3a5fe78789091ce51
SHA1 eefa0606bcf3aa65edc124978f731336c60811f9
SHA512 07fca45e2c99ab93eda0346550f083c0e0fc7abc50d9610869ed9f558cec399a0b88434b4d8cb5a838acdec7e8b3e7a2a6c9b1171050293647977b15fdbdf109
SSDEEP 24576:Ueb6TG1orqThTCKHyK6ax0hHfjnNWNT5zaAfX8j5xi8bVdwZtPBE:lI
TLSH
T18425AA547DF9F7570F8E8A1994320E4EA594AE4692803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\ar.pak
Size 1.1MB
SHA256 01f11a2c50a25b12aa99e36d6f38b334179d6efbf073ac47dec7819f88dce668
MD5 c6b9a7a859a6dc06f741fa83eda18adb
SHA1 1ca13eadae5d2c1a380954f03c1a6230709bde1c
SHA512 55a93541276b5f5fedf2e36feeca463dd1333e8011bacaeb7bf5d46e99e0c431c43e7e5b778a63820f5e70603b9e9344d946f4a8ff10c0cba91d2d3b5212bf6d
SSDEEP 12288:XbXxwb2BGop7mFo2GE5Hwjdfg7P3v4Uzbgkb2QSVMNj1Eio7DAi:7K1Ev
TLSH
T1CA357BE21B2984720B56DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\bg.pak
Size 1.1MB
SHA256 2789212aac5f2133ed23c1f84623bc64eb4cfbd93aef7af751d1221e27a21daa
MD5 ea6519b0214acdfe80b9ceb590ea4dce
SHA1 49d14345b6baa6939055d7f50bf0984791481706
SHA512 28a1ddd55b55e792db5a114fd305ec3631579a3e8e5507a629144769bd25c4e2de6ef9e969ddb037f7945330be02e4951a5ba8a27881fc5e413c2a33c436b84f
SSDEEP 24576:0KWulJLYAgCzQkEC2U5Vb6IqSsl373ZWmKf3p2KuUfVDrzQE74uOVnQxRfkn4wxI:0KWulJLYAmFU5Vb6IqSsl373ZWmS3p0g
TLSH
T1863535A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\bn.pak
Size 1.4MB
SHA256 e72b72977b40fb10472fe1a3fcffcda8b434bf52e2bb2da2935faa80da224812
MD5 ae6da45169b7a3fd99da8218c92a1e2b
SHA1 2552cffa1f63012b2fa7ef6209869f3eeae207c7
SHA512 8328e598f9c30636d60547a1d31e909b46ab6f92b3c210274c95886294af7ef20552718a536ee55c0a58d7947d2932061fea8e3113b8b331b4ca084501f51c4b
SSDEEP 3072:Y2M24emMNfpp1pomjwuquXCg/V7hq2XOUU9qygEfK8tRs3F+IBEBbaUqQsjkwgw0:Y2q+Nfcm00yg/V7hJF+IBEBbjwg/H
TLSH
T10165EF209C6E81B6A8C5CDC9434C6370C523AE9B9B65F74DDC17A24538ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\ca.pak
Size 683KB
SHA256 4289d89e86d0394bc545d63b375fa050f3823ef99ebc6831e8b1a28d3a17fda0
MD5 177812190302c5b4154c2f385455ba55
SHA1 ef43fae863ce81b5458d560804e092b133646b44
SHA512 64b23af24d642a7f73009e4920bd203f5d949e46819e043249fb50ad76076874fc02b1f2f34e0726ece12e83801825d53d4a4d8064f02f57bc673113d7efcfc0
SSDEEP 12288:9m3D1+7hjzlCiG78lpGa8D5PsF4N3Mw2juwwPR9zejm0t3l7C7ThALDq9wTLX/f9:gcQf0LApMZIM0wbJhXsQ
TLSH
T112E4F8239FC93B7704D2330EFB46C253A48CA9847A16D254F4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\cs.pak
Size 709KB
SHA256 8386f70e830a565d0674014ae4ad385a61eb43d7e7b99d4d373d14388dfd32ce
MD5 fd8b34402d5e02dd82babb5a3ec5eb46
SHA1 c191efa261b84f6514227b6c41edceea7930b189
SHA512 2edfb6eb3d647a7f62d2a09cba95d6762691de9c4c73c1ad0817f9b262cee9bc20180745e64a3043a4d399cfa95fd212f2e0dd996ef3f5c212e7296989d0e26c
SSDEEP 6144:mzj1kQPV+WB/p5jDk8EmuVSG15ADF4+AP/uzBYcZ8OlJSBs98Qv:m2QNV/p5jADVz15AD+kzBYcZ8OlJS+
TLSH
T1C6F4391EEEA36425584002487FBE4128BD5EC3140B6EE5AB7CCF9D912579B7E8EF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\da.pak
Size 637KB
SHA256 ff687bb6dc79bb638bca4f6a9226544a783209645922d323cf777b169690b25a
MD5 3402cf97870da2b1aec77fa74062f874
SHA1 758610d4624471ac55e9f4ac59abb07ad60fb309
SHA512 dc2bc7b982cde34e0678021a00ee92d4c21b7c91c64a33c0118f74d40eecaaf7ce5418c6986c78b4af88138cdd2949c006acf20ce7b2530a7d3747bb782d98bb
SSDEEP 6144:GXjE15yr09M10AETh/OQzVY2/QD5Qn+XgRVBaFLxE/ene2wlzqJwZBIEbPKaSpuG:GXI+rAMG+FXeRIAAmjfsPP
TLSH
T153D44A4BDC9CB32F89A94725F311CDA7DB6D443CC684264F65D8953A09CFCA092BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\de.pak
Size 684KB
SHA256 941c4d0ac3de30cdb5922e4bf1423354eca1148aacd3dd71499af3bba1fcea8f
MD5 00f74a2f094628b8e03f262adc399f67
SHA1 beaa32e764ccf537a2975e07d870451c470640ca
SHA512 e93e20ea6e5d9d4e4213e6f40831ffe19b2c4920efe65c6ab1fd9a83e2f52d36d55f5546fcd4f8327ae5580d06e68bc65b0bca3d4aaf95e8fd6b2fbc0d769159
SSDEEP 12288:qfvoo3vT3K7UpVdg1aG3g9LKVLePU6ApCgW:qfvoo3vT3K7UpVdg1ayg9ehCgW
TLSH
T111E4F803ADDB625EC786B3617705CDB77B19E36FC346322A84DDD02B654B5B283AC422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\el.pak
Size 1.2MB
SHA256 3ee2e46a5a569e411ccf9d77ee4f356e1833bfccbaefcc5e71b7c1517206ab5f
MD5 b5b01fbf52e566a2042c2bf019a6fa1c
SHA1 d6764bc102d1819f48724be1d14e1f6d547d2724
SHA512 35c4d5668f9f5a1ccb25df0f36cefa9c3f3b134a0af4b9b460af5b073eb1257b131a272505b0f2823d9b0a4c21cd8ce76128fa6ec088de539980499d941c9f95
SSDEEP 24576:NRzn7HWFbrlE5Yp9Ck2twZuwxJXDsSSEumUaR67ex2MSPgL00O5B/FCyjlHvAdQ/:bfHWFbrlE5Yp9Ck2twZuwxJXDsSSEumu
TLSH
T12245CFEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\en-GB.pak
Size 552KB
SHA256 aac3b4904d021d58d053bdea2d8056a219ecda1e341d87cb70070aea2cee418f
MD5 121461689d08e6e0d1e0ad4e6c695f7e
SHA1 113ec35be3b54ebf9e2b064181475bb82dda2670
SHA512 69b0d1d401aafd2fac6ed86f3c51de4889ebda123c6cfbe6267e83cd9271dccf7db2627cfaf31bf5713efad48845662763106ef26da09803a1580fa04c7416c5
SSDEEP 6144:D1Zf+l9GJBIvNBlxIxhb5E43FzcieMaMP9zQ49lfaYHEJjXCYDcBcnR7K:D1ZfqsJavNBPIxhbQvMNQ49UhDc
TLSH
T13AC43D1FF784126A05A311A2BB0AA5A2FF23D07CB35112667CBD811C33B676583777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\en-US.pak
Size 558KB
SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
MD5 6249e6f03590c631a2a873b3e79058d4
SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
TLSH
T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\es-419.pak
Size 674KB
SHA256 3beaef48bc776d3ebcfb867786fc47f78af2dfd6503f460094db5183666ce34e
MD5 2de214419bd7d75a54d7c4d53b2b5816
SHA1 24be574b50ff8c5fa55019f9ff3a2b9cd48b12af
SHA512 d51419c4deaafd9a948c4a8a0be82e154ef5da2e12bf19da9442a99ec825ed3b6a59ba93605cef6fd0fb3de8f5f9626d771328683cff61cc83e4f89144bc7878
SSDEEP 6144:by/lPx7jO15hgStbdXisoO5yMYMgsoZNcNTkJkH5A4UnNyz7:bOl69tBXXwBmkJMApU7
TLSH
T197E40826BAC81F6310E3A348B743D753E4D89545B408D29BE8EB876522CCF8CC967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\es.pak
Size 670KB
SHA256 669099cdff7ace75d40fa7b2fcb731b9fa3946d7939cae5dc6d751cdc88519e4
MD5 db71b60a3daebcda75035e4158618253
SHA1 146c97db3081e41cf8930c622aba97862ea5b090
SHA512 5719b9419018f93a6b783493c6e9d1e0eb2fe8cb7b9ab573796ddfc1582a4103a546f74aeed04332d41d3a3e865d64d87ec849fc081b6339bb9c80a5bc6cc161
SSDEEP 6144:Cy7XAQQj1VPRuogNBM+7p4naYwFd8jw9MOJRev+JETiZ6PZC+t:CAQXRu9HGaYEd8jqxJkveyitg
TLSH
T1ADE4E726AACC0F6350E39349F743D753E8D49549B408D29BE8EB866621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\et.pak
Size 612KB
SHA256 ecc838878412cc9f28dda9efed2fc60b67315f5fdf64e912db33cee7571a5939
MD5 0485794b4810c277d1215c5fc9a69e3d
SHA1 c0e9b7feb062df79ec3a1c94115efa36bc14c72f
SHA512 c694c4d2badb1c22638e7ca652ba4d801b1cf1b9f63c3f492b651c2a41c03e5c6a2e41310d129f70dbf7278fc4b6b68227e5882b86ad9fab8c8cc31f5e21dd0f
SSDEEP 6144:STM5NSzkgUaqY93DL+cfFnyN0GnFajtRvfZdkUmPOTQyXgXmjVOlvuCCn1qyzXiu:STMOzVUN8jfF8nFajtXOl2CC1qwP
TLSH
T170D44C42A27D771B182412F9E737E923DC9ED3D8B4000D9668974A1971EEFCC38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\fa.pak
Size 1013KB
SHA256 c4db250c0d32645a93536b188378da51f1af9b06988aee9e930ae5ccd9c09790
MD5 f92c086417dc31636a9280e01ebe9af0
SHA1 88f818f0e539e4cf603bc8b0865082b4538f752f
SHA512 aec9e6fd2996142dd7cf087fc4db32c79a9d8f81adb9e08b27e59b31255ccba8b846a1a40230e20eaad5fc287cbb8bfac87c139fd68d6b37f79b7f5f3ae88718
SSDEEP 24576:gT0L8u313uyqoz+sn2isRmXnloTUoXtCfGk62Yhk826JfikW0MX4dOqlUrHkI026:e
TLSH
T13325B1957AAC9AB15747CA0341E33834C773EF12D349FE40ACA1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\fi.pak
Size 623KB
SHA256 18d904efd7d15a49ef3638c45a40b3aa604e5ec4b68e017ab3f568e6a8202fd4
MD5 3d5e89e58a263b94ac4f49e4e8c76adf
SHA1 1d4d5c23c74c7e98ad49aea4ff1e67424afe6245
SHA512 10a1b6134dcf59d01781e59f7733aa45d3c24e76182f1da6d25921a98600571be1a3b904430dc64707b6bcfd43238929be8df37576c86df10bbcb35dac5672f7
SSDEEP 6144:8c+vwr1RbX48u19cj80ar6NmSFrGkAgoFRjPVOEmHbeaq5pLx7wvpVv7IJprWaTK:AvObX4x19C1a8GtaRvpVDIJprWa/gL/
TLSH
T138D45D915215C32237C4D29E7DB0903AF5E5E3DC8C284D9AE843C7D849EE9887DB276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\fil.pak
Size 706KB
SHA256 4034bd7ef11f48d7d646aacb7006562f0f9caec888785a13c36e31b9724dd798
MD5 ffef924fde59f90f783517b96f700a48
SHA1 51be8b9ee59c13bd091105bc075c141a11e45a16
SHA512 fa32dd493d819bce89e1a02dca48f202e0e4b1bcc3470ea8071d1c242983bf6b8805a64acf588723f0e49fbdaf38cde322e6003e190fe2bd80bbe91ae168bf57
SSDEEP 6144:kBp5PvYzZfRuh6uNW9cqiKb8yzDQjGXa+Ea3o/VzV8H68v6/C2oVHA11EW:GpJvYzZUfNW9BnvG
TLSH
T103F4C616B7401748DBC352E56260682F6AE560B83F81786E0FFF268B7BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\fr.pak
Size 728KB
SHA256 ef6d63007598261e38b0aa356f54b517e4fba5d38ad606165785afac5a7d577d
MD5 841e40697a9e19dba9ad5e1c3afd3fca
SHA1 19015f78c3a8c9b4086e037139ab6bdc7d3f2980
SHA512 e0f78d888375e1b667e0bacd7cefc1dea74340d80993502289177a48c31beb5e65de60ed44abdd9361ed617b945be11dcae6a6664ab89703da7e84b418cfb45e
SSDEEP 12288:EFiMeZMNZLkW94S+bvZZiut6QuargVCcm8N+bezEh0y4VoZuYnYw8jw2wW3S1X4I:sJ0vcVeAmh
TLSH
T16BF4F75FBEC431CB19C60267FB12D6A3DD348248F215E344D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\gu.pak
Size 1.4MB
SHA256 b207f2046791aa8150015ca78f9f76f2f6509953a00c5e89b155bb40e3a26474
MD5 7daaf6a5370eb04dd0e1d1df08d35f15
SHA1 d861655e79aa6165e9101d7de18f940b5f9ae976
SHA512 051dfe0a1ca3c09dce67456d75bf595dc36d1ebcba5f5003a1effdfb679531cd29593ebe524612c54104bba0e8f442e3588da966f74ac1655cb3fbeae501c18f
SSDEEP 3072:KD8i2t5BaX1eq0o5KPjAwREJKVMjNiT7llj63rAulfcSi5NnWsWi+/GQoynAzl/q:M8DmFT15STsPffC+1KsP9
TLSH
T1BB6508D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\he.pak
Size 887KB
SHA256 33c380725d0ab1a858c594fff41a2363cb2a0ad3bc0ed7209aacdfd7a60c7c60
MD5 5ef51e044f26108fc57f9a98c54aef8e
SHA1 1ef88df97d3c89035d7503355aec229248ebae5a
SHA512 1a270d5e545e5e85db116bbbae240c000970b1e684eefed061d7c51ec5cf8d2b8f6c2e349486a453113a937da2c69ba920b982c987dfa2025da81b08c795f013
SSDEEP 12288:lo+tHxhMPBBAoyTmXdUulrYyIQDAlCWq+/8mrguckANXkxeQCaj6Tyi6jcAf5OOa:lo+t864
TLSH
T19C1599C4B2E492255131AAC39FA4FA285FF3CAB53CA27512CB14526CAD774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\hi.pak
Size 1.5MB
SHA256 6e58e12bfc69547d03d61f23445bc996e1b09ed5e8599b00f553bf8d022a08b5
MD5 a92068a3af1464a4b02fd50f8a8e949e
SHA1 908e45081c10142a0486be6e5adc6991a2d4eace
SHA512 bf6413010c40ba838e494bfb86a4c23ffc6b9bb9e8a0b04bb00ef7d82a8262cb98cca3874e9012905243f3d1cae37232bf8705550d873b50f88997624d66a617
SSDEEP 3072:uAFAoSJLHQ8ZyjAHl556oN8cH1JEtPV/B90ZV1dWuGlqv3oJEdtDVejnPs4f4/B9:jF1SBHQ8wjAHlr88J+ja4RldbPk
TLSH
T1CF75F40CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\hr.pak
Size 682KB
SHA256 6990ba056fcd1cac97ed5b48024be4ab366846a9c517d43a181cbb0eefa095d1
MD5 18123099716cba1fffbacee72dfc1315
SHA1 67fae0cd4739e964b59460aa1c4d8b2e6cd9d707
SHA512 ee2f3f6d54def03a8562f4b944b341d2b7e5d98a6598e05aa6009c810003f92fb1d0d9539a6f078d70a0a985e3d41958824a3d8e27ebb2b67491f0b8c36ee355
SSDEEP 6144:7hS9VbVbml6edNJgUVaT5ja46TzKzbayoE6pOWOYwhdbYu:FS9Vb4IevPVoadJJnOpku
TLSH
T12DE43B7DBEF3570A0897B24AEFAA43447DBE08DCE56597B7684F522E0003F4C6AB4149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\hu.pak
Size 729KB
SHA256 b83fc60c6d3ce3a04338ea16ba4627d6dfdf81f4373fe4921ac01c7c9558bcb6
MD5 9b7c0f6446817764f33fee01e82db019
SHA1 40061f4276cdde875303b709fe783c2d52e2a60f
SHA512 ea1ca65c71b5a216865cebb7cfd82774f0f8184a09dc0943321c9d5d44d94ca8858e99c11ff66c58cf35f943ac75ce82b917594ab21f53e1049b26a047bf42db
SSDEEP 6144:dzgVHf66Wfsxn/3BLk5dnTpJ7yHlEx+XlH2sSaa0zA4ttAuSU5TT78bZ49JxTYhW:dcHjKsx/3ykJA9U5T38e7rROyr
TLSH
T144F44BB793B6944ABC6C178778643F55592E481BAB2B31FB2883846D34A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\id.pak
Size 603KB
SHA256 a6ccb8c77ecd0db5c9d8d3b809937e627fffb136737ffeba65a9c09e6469a243
MD5 dcbf88b94b3a13d9c6ff165f55d61a61
SHA1 16e08e3e951321229a492ce6665ebbd10d2eb9f7
SHA512 9c538a1246c0b57d6df4668f36d068c696d81123069ce9adf9c1167a35a53d9df332a77721143e745f1639f65c3ef691e9b1942e9b94886862db03b009934662
SSDEEP 6144:4wzPkpLIRUmd2k5b5OZhCNBL71y7W30ffpTFjlFKzmBHCY26kkC68jWOBZFm2iTP:UpLYb5FBLEiQTFjlFCmpCP685vC
TLSH
T1D1D4E7632ECD310C094842D5F2DEA91E7CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\it.pak
Size 660KB
SHA256 666f811313f9bfd0f582816ff5c9fd693da6a3b4ec0e1d6af7cbbc100d8d7bd6
MD5 09c2ecaff02b0191ec309149dcda0e57
SHA1 56d84e8c422cb2d27ce603e3ac5833f0c812c230
SHA512 62d6459806c4a45fb5d9865432393cc14b769601dd7bdd71b14b4d7344bc80e11a3271ff0c4417da2a3f0a28de5fcaf2f17f65e285b5d1df09aa26f1915a7465
SSDEEP 6144:qPiRYInKkErphf3ikJd52N5zVX2qlSfqBCfEs61ltM/whOea1xIkYMcrFqpzSj9c:qKRnIpSGu8d0gzP1nJGlNpc
TLSH
T1D3E41C3AA9D6252559876359E611F085FB6EFCCCFA41721CC99B031C22CFE80E1ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\ja.pak
Size 804KB
SHA256 de290ab75b4cf9f59e6c106b12fba39666d19a98d1fbe1cd8dc18628187b50b5
MD5 e48dd7f01b99f4d505bb753569af9fe6
SHA1 049745165fb62171218c1068f4f3249b52d21109
SHA512 72a16e8175331dd1d5d3ff5842d2e540d65d05c637e6c07a9dccad71e7f797ce3ed8e451c15f746ccfb9bc51dad24dc9774043cba47a1548343a21e8560862e2
SSDEEP 6144:Dqs4bG0qJBSe90Y+84EQH1oZJMxkZrQ2TMaDeabRAuGVHhsV9:mjGpJB7zstH1tkZrQ2TMqea3GVHQ
TLSH
T12D05307CE3C569369D6153A22C4E36E17506AC9BFCA23A3A443DC074BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\kn.pak
Size 1.6MB
SHA256 d154c50013245a268ba9b4b49639516ab0593922d893bdd551e4aa30ee6a3e2f
MD5 05078d08dbd65e9bc4e27a903ddd6462
SHA1 3ba2c33a01ed59102ca3cfc7d5655ea693d48bb3
SHA512 158017227b71a8701de418a0e02896a339b61c4a9416248c6684549068df241c0487ffbae170c3d5181b38b0a074c1e0eb2bbb2e4a784f53ea242d617c44b3be
SSDEEP 12288:12bz3zDwQNSWJjQgY2BQvwT7N7zSyMW4QHyGEV:udMl
TLSH
T15075CD18ADBA7D301BD5106B24EC643ECFF16BE29CA907C2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\ko.pak
Size 684KB
SHA256 37f167bdf1c7f0095e256dfdf1d5f40a92e29a350bc78a8fe048f364d5fdbd76
MD5 7f37bbd7cfe4f3f2b5ae99becb008a9f
SHA1 868deaa4c0acee03c81104322b42ed7bdcd1cbde
SHA512 ee91ee9e6bf638572fc06a23d6083259b8b3d1d6901bb7c652a2a4f77c52e0cdeb6d5f82b5187369a5fbf48075fa3171aabea7734a8e3e3fde61699612d79d62
SSDEEP 12288:U+FjguTbckmM1WNiPszcbifYj4ZGRyzDRIE1zHFQgC0lIJ/xESJGRG1KLhw1LqcG:U+FNWIQ983yyOt
TLSH
T1D0E4B5F23CDF63C91193CD82AAF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\lt.pak
Size 742KB
SHA256 0c755ce72d1b71e77d58ab014228458d8ce2b0c51a9b00769635c6609255c9f2
MD5 1cf07cb33fe89bc96f45994a0ad98a62
SHA1 b8a9c25eb8fcf9f606f851b61a3e97cb2bc0524d
SHA512 2d9382136b3444b8130317ac658c04ab275a20d0e684420709840029c3c50ef69ffe19e51f6ada312439d7d2fb4a8c8d127e0202987d55612e7923ab323dcdcc
SSDEEP 12288:GXBwFUg40MQ/u3qhD78baD0dRyN7UJiuoE6SSH:GXWrMkbKQ6J3oV
TLSH
T1ECF42C0069E3AEFB9A4467C981A4CA78DEFD50009727BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\lv.pak
Size 739KB
SHA256 911f922f6ab11d04c4913b04088619276994104979b2c5f132182953fabc24a9
MD5 797904d9b8cc446bfdc8823f8efd249d
SHA1 178b5ae7a875e50646cee8a9c34be60bf68f3ade
SHA512 854a126b5a7dc48513729d476c540608d557de3049868b2329e507451beb9a73d38a68a2517a41d9a85f2b1970087630b334323bb307af1a58d49052972f920d
SSDEEP 12288:HjFJa4VAWdx/N5g/1qrcxm29c4TloHD+oB:DFJa4VAWdx/N5g/1ucxm29clHCoB
TLSH
T132F43A959EC68FAA4D914DCA733AD133A8CCD700FE07E112DD798B3A550F52822B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\ml.pak
Size 1.6MB
SHA256 8beb5df27b5a1b88d0f441518a807b2c6acd99a81820cd0249710ea12bc179d0
MD5 1ee0b429a68d70f8e14d90fd5fb740f1
SHA1 704642c287bd4cbcaf472923062fe06c26a8b489
SHA512 c3961d0b06e8ac84b9d4c1a943b03049ae59f58028e0dfd99ac9e7b7b7735673c5ad936759f14dd218ba924f27170bae2093c602082ebd0f2eaf1e45a4293ce1
SSDEEP 24576:kQm/CzR/oZAuuxyYl+9y9XBkx/9tYFrKfijHeBRJzXtK+v2/idf3AaIH3F3u:PMp
TLSH
T102859D5BA036CD3B0FD102167B4E2FABCD5B9FD140AF668B5869B2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\mr.pak
Size 1.4MB
SHA256 1971da05e4868841c9d9f78be5e17ab09178af99b86a6c07df385015a0c9d9ef
MD5 626fbf6ed8eca2fa44e52ae9cfc8b856
SHA1 c4b8fb73e8dd22f1adc75a609fa15b917e98a049
SHA512 83534bcd0014c7431599e49da7f1c18fbdf4176085bc170c78acf31965fe375dcd1a0d2814d4374cd7509a4bd5c07859e811262bd637ef341ba822aa8a3887f6
SSDEEP 6144:VIU8ZtwrTSAld7dSCyiWUIsN00UH5rCS0mOygEb:ewrWS5TGXH5rCS0m/gEb
TLSH
T1C565D24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\ms.pak
Size 636KB
SHA256 b60c552a9ced5d0e1f4ed408f65a04068acad7d80db7cf88528fbebbcd337e23
MD5 a31481e751f6bb180968b2381d793d05
SHA1 a8b197bfe937469497c53e7df3796d11111b6024
SHA512 5793f68de93a896b689fb52ea82e2102c7d89550236dd108758745d22e68db055c577634dc41f1e2cf80bf4954d4167a84607dd282daf98210882a996685044f
SSDEEP 6144:njqCnjw23rq9CrUOP1dXvkSLxEHuqwa528WN3wcDiGPUlw+CV9hD:njq6jwQUGX4HuqwaSZKlwp
TLSH
T113D4B5579EDE3118085843D9D2DEA91B3CDD3332B705AF2B4DA08FB0166E7A53316B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\nb.pak
Size 608KB
SHA256 cb50908b03c77263297e63ff75d4d3c58fb0cb491c69a8964239e787c762f52d
MD5 d1ee1aee9d6944eb8ed7a658333cc91e
SHA1 1faad08736d478e7d25a144dc906147781e6de5e
SHA512 66d6741740d59d442fadd734ec4285cdb15c6559b448bad513bd9aa08062487acaa36cc0c88c289d37e64c89ffa05cedaa70f4473046b20bd6d3f850e5fc0c09
SSDEEP 12288:4FzGCp19tcd2Ql+hB/Op7fmPYiGkJcKb8B0Uim2r33:4FhX9tcWhn3GkJcq8B/gr
TLSH
T1C4D40883EE46B72EF6A44394F519865B9B7D942CCE98199B54C8C23E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\nl.pak
Size 634KB
SHA256 b6a6cecceeb0097d5fd9628c684d53339f7871948655740e0f625bfedbf526ae
MD5 712c3de8c9c0f50e580ac82074d7ee76
SHA1 9c69e08019dc195037c0d83fa0b21c8e6227a5df
SHA512 011b60ec55581ee7cf7f20715d31c46e923462fa6604e9c13c6b0920e986a54b6b262fc7c09b454791dcb96ad9c0cd27a12103659465c8ce040af17724c1c5cb
SSDEEP 12288:EUodlCCMZnLplbJWQuseUBW/gISKdaFFygn9qHgG48J:8QtlbJWQuseU+SKdavyg9qHgG4U
TLSH
T1B9D4F917AC8E253E59C0A349FA098FBBBF2E832CC26CE67D94DDD5340443F6851AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\pl.pak
Size 708KB
SHA256 dee5b710ca72425cd4d1236ce260f8d68b41bfdfceaeb2f98c8e89217b24208f
MD5 7a5ab308647d031a3cfa1311dfaa3ad3
SHA1 b7893bcb9951b554234f9b3fb60441617aae3661
SHA512 a5a25d3971f16ac49a20d8506a0a05de7253308cd5befdddfa232d9bbae9b5356e5c5ee02b69ce740440ab332c55f1b99c33bf327882e6b84377f294dfc7d673
SSDEEP 12288:cOQ2r1eDw9OjK4mZefQfuzSJabZ2bn6jP6CUdwe3m+UwDMSmG1Qh8PNRNGoliJSd:XJ5hwmX62DM81Qhnm
TLSH
T189F45B0E56E98A4E8CA008E6F6E70B7CBCDDC818F108D35FE45F4526719B19EC9BD584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\pt-BR.pak
Size 664KB
SHA256 8773b618385adfb3c03bac5109ea381ae2042b18a03d6929b1f9406f13dc627f
MD5 a491c62b1da15dc5d7fca9b61484bf88
SHA1 0d8b0965c97de26dabf8a37bfe0306d954fe3e93
SHA512 99c6544b70d12ccdc09a855381404c0bc8289fc4996e00051053db810f46b533e4e4f57f05651603d5fb63f9c7b4d545e03c7144ec12d1de93a9bb9c2e0086b4
SSDEEP 6144:1Mz1t1wlEJOsWYuhvNBXBLPwVoNvyFE5EVL0oNtsRGU1pV:WRwlFsWAozEvDsR11n
TLSH
T1CEE41B2E6ECA136605226350B74EEB43E5890645FE06CA87DCEF4F05A3DDE40D933BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\pt-PT.pak
Size 668KB
SHA256 266e49a497c6bf9e48502c7eb01aea1fa90260b6fb1609165ff50307a3d81b59
MD5 70557f8ad0981e4545ada8988c6053af
SHA1 43569e4fff4f1ec4f23e3592ab299c474ef40289
SHA512 e8df0f34431dc4fc4c0610208e93ab63c13d70e9bdd7c9153a63268a68b0d3c1d1043c7951ab6c4b007901022b695d8ea48321d5c0dd0e66a63e6b718400c24d
SSDEEP 6144:bqTin/hF2VNusBieJVJJxhTIjPNsWfwgYnbioBcSRhI:byi/72unYnbDcSRq
TLSH
T1B1E4192D6EDA132605135341770ADB03EAC85695F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\ro.pak
Size 693KB
SHA256 16b11fb73ea0c5d0336de453d3e2abd2de69b3e6c66dcd72bae318666525bb18
MD5 9b2ffd81518422f5377295885d980161
SHA1 23e2177172bb965b5faf4e4667ef000d5a60051f
SHA512 2426e87b53dd8c4d26d34aa4ff685449edbb2547c1f1ccb17e4ebb53e4372896748ec05bb89ccd7880cece4e176467b3e2c18c53694e93ee2e99e96a7ebd9525
SSDEEP 6144:1e0qK3JQ0EghDYnnfwT9o0PBciVgzD+NrF1tcAGLtOVmdO547HW2wsQo/Mr/j:1erKOVDnngo0PBhgD+VB3mw5OWsd/uj
TLSH
T1BFE42C23A1C41A972E5152B2F73924D3E88E105DF641E2CDA4EEC97910CDDDB852EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\ru.pak
Size 1.1MB
SHA256 cf7ec388e57755475515f2a4a6b312459ae2efa693c80bedc28458df9616e638
MD5 11f75d057ddfbc2c0b7e87759f04bffa
SHA1 edd171350a17aa81e672996f4fe5ea42fd70f579
SHA512 00e56bd4d4d5c7502e6ea766f70a24d6060b76097db233ca45f303171b35df4cc4758b2756af45b06de63d40f3ad788d509d689a464eb4aef19b91cfc9d3e4e2
SSDEEP 12288:xYap51G5mfQeRo4Yegsp2zJ9sF+oa+UlZHO6HzW/ZqSv4sqCz6kE0LR3Q8Nirh2b:xY27G5z/oBB
TLSH
T14F458760669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35219A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\sk.pak
Size 720KB
SHA256 8c14d528efad4c75e09ce70719b0b3d1162954b4de4013112e014e2ac6a84d3d
MD5 729a2d39f83ad855dc5c57c00bd9b72a
SHA1 091f1e778ad60f70d3ef91b572feb36c561d1571
SHA512 032a14be8980feda7b7957f7a6167af6126c7a2b28b233eb2862ff38867df3a9f342721867d589cf7f9f525c8b7d4c45dfbd51d424284a6431fe7e00bde9b23f
SSDEEP 12288:HqSr8kmKWjowk74V2AI9+bi3NWTnjzYIng9pTjsxt9we:tdLN4VG+fYzktae
TLSH
T1FAF44D3FDFE7181E8E8D0148EFE57110FDBE8650864EB0A6944E374724E26ED8AB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\sl.pak
Size 690KB
SHA256 1550f8df161a3484a6c7af9bc5321fae524e10d6853467afcb8749054a73e601
MD5 f9983e0770e42bd3c3efd4731795efa1
SHA1 62423b22e235b64f4c0a543aa89e122437249605
SHA512 269d4877cf58ae67e713acb40acd58e98349832e8f036e2d4cce42598b52cff013eef0019fa19e65ce4e23e7478ccca77944410cc71764b3fc80518211d0b1e9
SSDEEP 12288:slQdT2FT8cB2BynElanWHDoiNi/fzoDKql/af:9duTNElaWHDhi/fzoDq
TLSH
T10DE42B397EA74E0F0C9AA2CFFEA606007FDC044CD256E6A1EC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\sr.pak
Size 1.0MB
SHA256 a76930f2c72e49dc3a2c9be7e7bce0f9da0c93de03b6e275521fa86da0d2d39c
MD5 a44e04518c70dff31799dd47379bba04
SHA1 8c4830e17cf5d7d33d5296e030c2ca4eedf274ed
SHA512 09b0193ab1c803bf2e66a998079728bb17d4daa1cd7b0a8197dff35cf59bb4d415c697dd836347c9a32ca3b16d2f37b66770c4474ae84d9a5167f9f58c74ac14
SSDEEP 12288:vwnK1PVzj34noZMFI83SS0dR3Ckdi4B/J1rpb6hKPCHxYX037XKue9/k/z:3pZjY7aC+a
TLSH
T1933556A19B9E64DB0501F41BD808BE493DAF41FE3FAB975211601DBD34E10B847BA39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\sv.pak
Size 615KB
SHA256 118cbf34d040c8946669f889393364070e88d3f0263f1b66ab4638b1f8f3c291
MD5 3cde379026d02f6b6f4a676366fe32c1
SHA1 0c797a8b977027782aabb886e72570b7f4989146
SHA512 9a9714acd3681f4e0afc5446ce6bca69fb0231101ef2c99a50bff1ed0292ccad3bb0ec73d7c8d950756382c225940457ec3b9bc51b688e1d7e443a37a528a664
SSDEEP 6144:x8AxMqKuOIi48viS/ZQ8lUJIcpjwdux+xzL8lGswiLOVRFcz5RtGmqeqMWkSMXty:CAKqWIizD/q6cxyHipg9
TLSH
T1C7D41B038A20F526FB72530DB609115B0AEDE25CE7F2954EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\sw.pak
Size 651KB
SHA256 f4e0e2f5b49d9d767884074cc3ee8d0dd83a986f7c1d2de236885998d7a53460
MD5 c45ae1d02bba66df5e1720faa9b062e6
SHA1 0281a51663763ca1a5622a4d0e15dc361b04c80b
SHA512 abfb709e1229208f68e723448b9766bbb2aca6f0d21df9effa6cb6198a00f546475fb59d760e1a634543a085c1e3e02b8b26c3162dbedf1e87fe83b9daab57fb
SSDEEP 12288:/+4khPft7byxGH2qDOKd9zGI/d5NmedqNGjRdpiayX1jt3hFinSLThYFaKI3z9iJ:/WPfNBFYi281
TLSH
T111E4D6628C71D1195232618603DDFF332BDCED5C693B29935A46BF0F218F88C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\ta.pak
Size 1.6MB
SHA256 2c5f8aaf21c9a035f71d763cfa9a20886892fcde7cf71878168a9df0faa6d417
MD5 db51dae96bd76c432ed4c0328bae8378
SHA1 93ca9f691f6949015c3cf8983d5df0c93dd173a6
SHA512 359e9c9da19a15320c37523aa6c4b5f1ffb03f62ac56e1f9bfb5c26dc0b7cc2bed32f55bbdb0c776281bb77cd07bbe1c500be0cac08c69d9344ce536747ef936
SSDEEP 6144:i0JoYKj15Y0ykwuiGP2wqdtRAwtm1vYpiMyx:ZmY01aaiGXqPtm1vYpiMyx
TLSH
T11C850CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\te.pak
Size 1.5MB
SHA256 e9e85c763b92b5a98e74290c3ff07e7953269ab6228a4cc343745229819d7f8f
MD5 827e945321a758570fc55c9ef1576db8
SHA1 86e3214190e55c2902c77a7fd49d903154ca1dc5
SHA512 ee2c24d1dba914261dcece37cbfe03897d2ab44511f081ceb850197c985d0df7a0cfe1f0630dd5d345c72f4abeccd1bc96ff4bb7adbe4060c5de914fdd70763a
SSDEEP 12288:7z7MZKN/ywG6USF602/LDgIC8ymoQRT5qbDM52CMYRWOB6ym3p1FW1OhEaC/ly29:7tXscRq
TLSH
T1407592023A6AD310DBE60273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\th.pak
Size 1.3MB
SHA256 fa33c671ef03a11f1069cfb389df5c8f311daf145f7359ee78758c3a0709b209
MD5 e6f0bedeb524f56b79799df543693246
SHA1 c262dac2bbed4c6ebae79a71096fe4f725502f1b
SHA512 bec94d24ed790db2b7ade098604762d82cd711a8b6da3ba66af54880d45ecd1e05c533c060c9bf4e1e207fec72b5ff3340db8d20aa9c6eca9f7a169795b4585e
SSDEEP 12288:OTlu6kvYN9LyZYAhzYL6Lys6o6hCQskJUseOPsO5eXwpbDFDS6Sud2mKHlojghvS:O3CsR
TLSH
T10A554CB37247DDD479441B5B262A7789672DAE693F73F8E000C9215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\tr.pak
Size 663KB
SHA256 7a42e54611e2633c9c999f121abf2ffbda37746237e01ce29dc650510af08b0c
MD5 db63f89cb8ea6ab2cf7fbe93c3cc0411
SHA1 4a9947135f5bb705bff772b9772fb018b68e5811
SHA512 69657a495dfcc49a357378bea838cf3d09e5944a38d91d07e1cc85452cd19732aedb2f09a185826fc50370e6e0d0c4522508c5c5459e5558ff500ad788fe70d3
SSDEEP 12288:/YN49o1gVCk6Hz6sgwhqfZF4MwkN9epd4+R:/0x9gN9q4+R
TLSH
T1D1E4EA817CEF282C8BB9278BD6E94666F89F0766B331F4469B168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 39e272f1acb9c0b0bc791efa0347b92cb29e20cfbb5ae14f539628f10f45b0f1
MD5 6b422573ebc1769223710a6bd8fedf39
SHA1 0a14ebb6d3091cb3b0e9adc336e088eef87a81af
SHA512 fd7a6c02c62ba7b303f5509e947b761ed3a65af986ab8fe9b6dd5e18cb99074b96cd7bdcb81d486b4dfa909dd790f04c2da3a84880a6682813c584aa867e8eea
SSDEEP 12288:lc7n9OSlH+QKjbCI5wkO16UgBRrsSr+UznS7BNb7eBPSlFXKNnEUA6QzAz8Pi6N2:y79Sv8PG
TLSH
T19E45A9A1AAAD54DF0105F05BE94C7A0D7DA740FE7FA7471625A43DBF28F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\ur.pak
Size 997KB
SHA256 0c1cfa61d9a9be6338b0a160b43ff362a982003053ae5be3b3ec867e78374d7b
MD5 6cf3c36a589dd5dbfc00b19cd96ddae4
SHA1 2f35469dfa15eefcce47f35231b4c19b0ca5beec
SHA512 8eab2e970a05171d3acf514566bd5183155dd6bf59dd26d4a909deec18bd67d4bf9e375c85608233879ca8bcfeca93b5cf7daa8447dd53b151c465b5162b8f3f
SSDEEP 12288:KYuEnE4YoPL8P5yzqtdQeMnyyK32By98qsE8dGZOv5dQYr4KYjwadcJKwUlubcoF:duEnBLGcb
TLSH
T1F82500D2E6B896B35A21D92780D33C34CB735F13D34AF281E96246C54E9A0135F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\vi.pak
Size 789KB
SHA256 3594ddfb89758a3d87d51bf90e676a5dd6107a6becd96c8840df6739cf268af1
MD5 278b92d960d7b13690df141c5f39a3c3
SHA1 6f3200f7260ed32219b07d41cdf98450f9111d9a
SHA512 5aa31895c350d3e1ba85655b4c4223955d4dbddcd957a0aa855caf45e734ff13134372fa0299d852e50ce102e54e424259b8a141b0651e90946fb6b7f09d9c29
SSDEEP 24576:T1P/7+ce5VM0LMuoVbE7KHJlFtiZGfoq1ljP:SotiiT1ljP
TLSH
T1A705855216E1302680AC553EC6CD540D6FCAE42FF7C1CFE56FE429787A221A45F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\zh-CN.pak
Size 564KB
SHA256 c2c40bd2834ca62f99312d93eb47e04d22b4c8eb86197f98cc7865b52fc11baf
MD5 1740ff5fc59dc2b362897b96a92f484a
SHA1 26a4ecf2a5e27d6d7d711b697d5716818c23bee3
SHA512 640982cb276a48cd95b9f1f427491605605443d1585ece41ff1cf583b6342704905845ce0ec3708a58066baf64a6d4407c737e4816ab40a10a9302b276fe64ac
SSDEEP 6144:+CXLDDKc3wn97cDc+qvYnE7MpUcZXojddwTQZyRU4YoDMe2ZHtNKEglu:+r8mp+qQnBpUcZXo52Um1YoDMtHPH
TLSH
T197C47CA820F9BDEC004650E03729613D7C40764BF667AF35AED248ED1AA6FAD0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\locales\zh-TW.pak
Size 556KB
SHA256 8e831ed21bd21ce3610dc4b658aa337229c83dd6d7cef336923d69779d0365b1
MD5 6b9341f76a06591356648427e4df6f4e
SHA1 964cdc835647034e404c503a2d4b5d833a92fa33
SHA512 cf82a06b17c366f20ae80d828f2477974352a1baafef85014771791723cda71c75432b4c514df7715539ebabd288049bb2576ed97f212c9a5e4627ca7c96c556
SSDEEP 6144:o9uZDCn3n/DAYuVJoOk6a2iuooryf8w7HLD5O9B9aUmzTq:GuwEYlOPaoryEw7HGPH
TLSH
T1A1C46CB618FBDBEF0901F484B7CD512ABC8B382DDE773636FC851C982E7AA5409A1145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\resources.pak
Size 6.6MB
SHA256 21641d8da2c30451d782c217bd156cbed278ba78df350a2d19578804b5b156b4
MD5 b5327ffd50e004a90dec55867d33b6d4
SHA1 2a1c2828ea38f7e8aa2b21f7d0728ae27db33ced
SHA512 9f8c771ce7030c704be901e1fd80c21882d7772546ddc1a6aaa22b112a410a6c0a794b4da695a93af37ad881791410219e1e8cde96b9e942731f69627af1f14b
SSDEEP 196608:RUBR5sfMVDTz9u4bkriACmZnC3gEL34tVrW:WT6Y/zlkrDntEoVrW
TLSH
T1236633D277E2A80FCD90677945488F35599C6F2532E0B1A3889C6129ED9CB6C0AC4F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\resources\app-update.yml
Size 117B
SHA256 dde82c9c1353e74da522fe15b50349937dc4cd9bd29ff94e8a77a2f55ca055eb
MD5 79c5f8b3dbe1e0cbedd7e68b80ef0cba
SHA1 be727221d20dfb24cd0b9c3fc322298c688e50bf
SHA512 346a03495bda64668ba34faafeee4641fc770bdc29f29c2117ad373a1c3a5c73a303a732169273797bef5542acf6cad9db0085d2742cabb847f8da6b69bceceb
TLSH
T135B09B668652C011437559345855B530D5455751D9958455C4CB458CC113415952668D
MD5 SHA1 SHA512 TLSH

Submit Download

default_app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\resources\default_app.asar
Size 108KB
SHA256 06d4a28be095a80eff94dbd18edcfac5b5805e1b5538e0fb7cee7c7ae81db76a
MD5 b77337fb8603878f51166531d417cc81
SHA1 7633d1649735b8a3b223ff4a31940b3ac9ac4799
SHA512 85a307d774ddfb658956263919ed12cbdf64f4e6d8db7222fb827548c5345427193bfe273aa30ad537ad0b4ea40c1c66e88fa3f6d6fe4a81caf9c871dd2560b9
SSDEEP 3072:ZWHxvTvFRWrjXxs8xbKNkCeF1SBRbFdPQrZsH0L5uRD:ZWHd5R4XxRYmS7orZsH0L8
TLSH
T1B6B3E19112F60231D86B4AFE9FAF16267A39241732CDD0C4722D87609FE15D6A5E3BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\snapshot_blob.bin
Size 338KB
SHA256 3641cb8756cfee0bf77a226d176793ab6f5de2c3dc61544fbbdf50acf94ecb6a
MD5 4bd6fa24553ddebce3a8aff53a7484a3
SHA1 279c3f2f52bc88ce9112d55191de1c759d735f1a
SHA512 ed658274e4c1694ffef403783da4668f042e0de044dc00b69e6c85f7f3d9f5f7cb57ab0e9c23ac486aed62207be52b24fbf2bf118d1ed3936c10bfd6dde0f124
SSDEEP 3072:1uOiXK9Ot+xbRt2FJRDLdd6peM8yN/SyNsCvuVq/khbvXU/P0cA/9:1u5Xzt+HwtH64e/BNso/kpMP0Pl
TLSH
T1BD74EF12F749CA26C8B635745EF98B942E24B2CD9D89AF573020437DB4796640E2F38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\v8_context_snapshot.bin
Size 704KB
SHA256 290fd744c3499e6d9306f26d194e51b648a93ef3a25c4e25387413781ac4991b
MD5 d19d7f35be9df7deb08e4daf4a75e133
SHA1 a44edb27eb10281838156a9297181acfe064598e
SHA512 80937594bbfe26b808bdb6d24f333875a9b08737e96052412e81cb2dae7133205c50687fd9e90f101ba05ae59a8f3bfa448973f5076327a810a983e3d40b81d4
SSDEEP 12288:K15XrgAJ8ph2NdOeP8POqYUdEMH+jURWYS:K1pqP4H8POqYkEMH+AtS
TLSH
T180E49676FB0ACA26C8657A7D8DE74B063A34B2DD8EC6EB077011937CB4B86544D1E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\version
Size 6B
SHA256 70bb1e963485537ccac68aa84f3ec9e5e448e0eede6a7206ecf2b69632832fa7
MD5 b089303eb7f19981326541385fbf43bb
SHA1 c6c65c923a0268f25341f629f5af3c9d1f2ff449
SHA512 81436238d9077e0aef836a3b419c3261921b3aa3520f458054a8a941e37d78a14ba31bb8db16d9f8ecd9a2c777595486e7e1696dd7b27cb8820264bf94a18b2f
MD5 SHA1 SHA512

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 ae7e65a4462a2f8fdfcfa7444259a8d2625ebd3bd75c170128025fa70e1ca037
MD5 8834d95b94614dcbe837163a447b08c0
SHA1 44e34ac3c70f66f922aa80feb64f166742930688
SHA512 43db036181849cbbd58a1a1e5b2afa22281ced906cfd1c9794fe83eab0b1ec260c5bdb907412e4a232c4cb7b9b1779ae6e38076b4d089a61acc0e20b2544a490
SSDEEP 49152:pvMQibTIlI/EyGhcIDlpcSJ13DFDUgcD2Qn9agdGgkkDCqBK2WgPM+2HryKAoxw:pvMQCkgUrr+2yso8FX1+
TLSH
T11D464903F68681D9C06DD6798B5FA623F672F8800B2276DF56A00F192E65FE06B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\7z-out\vulkan-1.dll
Size 904KB
SHA256 ef8b7e499fc34f5057c498702694de37fa87289ea3d866717fd1c001d955883f
MD5 1e5544ce431425eca51f0bb4e940da57
SHA1 0fafac1cb6a72bc021fc7d8fb877fde8407efadc
SHA512 2270a3400a9eddc07eead69e6e6a056fc2190e162d0e26fccf97a616fb5e116db7c88f5c9be3c6819519d223233944f2589948300a58313f621dd3c71146ecd9
SSDEEP 24576:SGq7F7pknIiAXUMKzUjvg6Z5WzcxDYsHkDE6g3P0zAk76oOH0Y8:5GF9kIiZAjvg6Z5WzcxDYsHkDE6g3P0r
TLSH
T136157D23DA548B69D67AC074D8D18A0789F074851322BACF07B817147F6AFF42B7DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqAC59.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 08f82aec8d5b59bd4bc45b13ce3992a6bac23eb4ff139a712be9ffa6673bd646
MD5 b6fe4e975c62eadf14f0e14524b9f734
SHA1 d22e06519d96ed312ac3c6a5b30e18bc8e46b2f4
SHA512 79eb67f2b45c9f3dcefa21e46cd62574ac0fdfa8a17b2f9a75351b738464c948ac0bc26f7de86f073b3296eedc0140bf80992be6494b9910665c1b95c04caef5
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 07ea3286aa94b72fdc69c57dc5f2c0be0ca57353dee23230b77bb2191dac1c8a
MD5 ae2c60384cda04fcd01a6819eba7e7f0
SHA1 39bf0ae32a7e3049b8dda433a07872052ce6d350
SHA512 c1a260dc7b5ebce1c5f8cc0153e26c21b2b42eaea3cf5aaf5cd022a27f8558356ece7f40bd2a0e420f62e238ada5db869868b4dafb87a310bbee653e7f6c82d9
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\DawnGraphiteCache\index
Size 256KB
SHA256 dce8fda112feb63ceaf89bbf86cf6a2f9a32e6cc21c912fdcbd9f49e4e46ba20
MD5 5bdaa7d35ec94f17b75c6f2493c57d19
SHA1 795a6a6dfe4c262adacae1b90b8662122194fcfe
SHA512 2323f613a8dcaec752200f77a88458b799e33686059c20b9993ab6d807c19c8b20dde8a672689f143baa75793874cb0adc59b424fa75a1068a6cd186d5978ed6
SSDEEP 3:LsOllllklkXl8A1:LsUlP8A
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\DawnWebGPUCache\index
Size 256KB
SHA256 2d283afbc770f1ba70c7b4138e8138b399be28866dc04b2d79024458ecc7d34d
MD5 eff0708ea9595f4a0ea4f4456dd36df0
SHA1 1bb2a9182719fcd906d21c6533349548748a63cc
SHA512 085756a644874ec42d671f7af88213a96dba9dab05c5255806c79a5b0de6c96eb6e3f78b577b1104ff7dc4f526dd9268b33a9a9bdb4abba18f234d6236d62247
SSDEEP 3:LsOllllklkXl9e:LsUlP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\GPUCache\index
Size 256KB
SHA256 4e14787f7d1b75977679940a3d8803c07d13897d9e4bed998ec726d8edcb7a97
MD5 13f9fb18e0eba8ed29e749507c470c50
SHA1 1895a2cb1440db649bc3f5ecd3b95fb1f189e637
SHA512 006ab519b5cb5a36e78c7045b915ad834d1892c3ad571e92dd11569d95f8a11f93d64cf85201e0ae275e204f80298f04be305e1a925abca5395804d8bcade6f7
SSDEEP 3:LsOllllklkXlGXAX:LsUlPDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Local State
Size 490B
SHA256 3a19adca91ceab8ff5dcae793d208034bcb30ce9640355845c46470870794e23
MD5 1974352bbf16f2f9bfdd2db8c84fc0fa
SHA1 fe16283959b8d3ed964785def2995889863c0a4c
SHA512 c05520cc82d2e949ad61526c4cdd70614741fc21b80b79b6cf3b2477be0f84621446813fad6f3284a0cc7ebf7c9498451554027bc3687df6177a5b246fcf7bb7
TLSH
T197F0D4732D709EE436268B5840537A420E39D5BB0AC513053EF6220A43E6DAB520B934
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b098d104-8f44-4cbc-9634-7b8b1c17539a.tmp

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\b098d104-8f44-4cbc-9634-7b8b1c17539a.tmp
Size 54B
SHA256 aeef9ae170498c52c919f9bf07ab46d45a0fa78a685e345be40207d29adf6ace
MD5 cd2a33ef74950d0c2e037a136cb4dced
SHA1 26292267c8082ed86dd3dc440701f75d50d509d9
SHA512 74eeda213c771928e7e5ea2d9968c275bc6ff1c77b08c0c531f4dfc04dee8d32f7f3ffc0f4dc1a32cc97357c0f54ba077a54b0c03839c4eaea796eee20b45a02
TLSH
T18C90029B242224755A5F1DA54006889A5C6515A0DA0B4B0600D03286897745C088305F
MD5 SHA1 SHA512 TLSH

Submit Download

gamecenter.json

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\gamecenter.json
Size 1KB
SHA256 32e6672083dad225ea8fbf1d2fec4d8803954f510b46ea64e2829e177d843bb4
MD5 22e2b442a1f834bc6f0900ac846b28d5
SHA1 06fa1ac6d3c89b780b26b5ca272d4dac7bc095ce
SHA512 25e2460477f0accc826fdf3f72e900c73d9c43070750f3faaec680858d16be48ffea481145a52a6570d98c85fdd839f3df93e6e75d0d1c52f9328d8f36c74396
TLSH
T171312524C8750C7712D5A17A5C7E6213B72488874D443A2CBA5F8A6C0F0D72F31B67E9
MD5 SHA1 SHA512 TLSH

Submit Download

legendary.exe

Path C:\Users\Admin\AppData\Roaming\@notoq\desktop\tools\legendary.exe
Size 8.1MB
SHA256 01ea22ea51749f46a0019657f64fc0d34429fb7cbf9b590c0848c0e0bd9c1f07
MD5 756371a5e646e52ec556fe5c869c5558
SHA1 11c5a92bc2dc56a07c807c7bca788ba3bc04936a
SHA512 f74f1b4e91fdbfa6f2a899158c6efffd85181f578f5b46f9b1e07497a9ca990accc5f27e3320e864aad2f003f74804facb78adf3b310fa38da0efbbef8d4617b
SSDEEP 196608:b5QaoaQQgSfeaICteEroXx7IP0oTcMsABqb6delGEwVS6g3u:9QaoaQQReaInEroXOMogFABqbwe4fVSu
TLSH
T18D8633157FA80DD1D275A4318454122AE47FB432C7E8B56F472C8B368FAB3A1FE6B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\de-DE\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1112-27-0x0000000004FD0000-0x00000000055F8000-memory.dmp

Download

memory/1112-54-0x0000000004990000-0x00000000049A0000-memory.dmp

Download

memory/1112-29-0x0000000004F40000-0x0000000004F62000-memory.dmp

Download

memory/1112-28-0x0000000004D40000-0x0000000004DC6000-memory.dmp

Download

memory/1112-36-0x0000000005820000-0x0000000005886000-memory.dmp

Download

memory/1112-26-0x0000000004990000-0x00000000049A0000-memory.dmp

Download

memory/1112-25-0x0000000004800000-0x0000000004836000-memory.dmp

Download

memory/1112-24-0x0000000004990000-0x00000000049A0000-memory.dmp

Download

memory/1112-39-0x0000000005AA0000-0x0000000005DF4000-memory.dmp

Download

memory/1112-40-0x00000000057A0000-0x00000000057B0000-memory.dmp

Download

memory/1112-41-0x0000000005F10000-0x0000000006014000-memory.dmp

Download

memory/1112-42-0x0000000005EA0000-0x0000000005EBE000-memory.dmp

Download

memory/1112-43-0x0000000006050000-0x000000000609C000-memory.dmp

Download

memory/1112-44-0x000000007F200000-0x000000007F210000-memory.dmp

Download

memory/1112-46-0x000000006FF70000-0x000000006FFBC000-memory.dmp

Download

memory/1112-55-0x0000000004990000-0x00000000049A0000-memory.dmp

Download

memory/1112-56-0x0000000006590000-0x00000000065AE000-memory.dmp

Download

memory/1112-64-0x0000000007550000-0x0000000007566000-memory.dmp

Download

memory/1112-45-0x0000000007170000-0x00000000071A2000-memory.dmp

Download

memory/1112-57-0x00000000071B0000-0x0000000007253000-memory.dmp

Download

memory/1112-58-0x0000000007950000-0x0000000007FCA000-memory.dmp

Download

memory/1112-59-0x0000000007300000-0x000000000731A000-memory.dmp

Download

memory/1112-60-0x0000000007370000-0x000000000737A000-memory.dmp

Download

memory/1112-63-0x00000000700D0000-0x0000000070424000-memory.dmp

Download

memory/1112-61-0x0000000007520000-0x000000000754A000-memory.dmp

Download

memory/1112-62-0x0000000007550000-0x0000000007574000-memory.dmp

Download

memory/1112-30-0x00000000057B0000-0x0000000005816000-memory.dmp

Download

memory/2060-921-0x000002A380000000-0x000002A38187E000-memory.dmp

Download

memory/2060-1096-0x000002A380000000-0x000002A38187E000-memory.dmp

Download

memory/2936-106-0x000000006FF70000-0x000000006FFBC000-memory.dmp

Download

memory/2936-97-0x0000000005F90000-0x00000000062E4000-memory.dmp

Download

memory/2936-114-0x00000000706F0000-0x0000000070A44000-memory.dmp

Download

memory/2936-115-0x0000000007B10000-0x0000000007B18000-memory.dmp

Download

memory/4828-81-0x000000006FF70000-0x000000006FFBC000-memory.dmp

Download

memory/4828-91-0x0000000007FC0000-0x0000000007FD1000-memory.dmp

Download

memory/4828-72-0x0000000003330000-0x0000000003340000-memory.dmp

Download

memory/4828-71-0x0000000003330000-0x0000000003340000-memory.dmp

Download

memory/4828-92-0x0000000008040000-0x000000000804A000-memory.dmp

Download

memory/4828-89-0x0000000007FE0000-0x000000000802A000-memory.dmp

Download

memory/4828-90-0x00000000080D0000-0x0000000008166000-memory.dmp

Download

memory/4848-958-0x000001FB49360000-0x000001FB4936A000-memory.dmp

Download

memory/4848-969-0x000001FB496B0000-0x000001FB496D6000-memory.dmp

Download

memory/4848-959-0x000001FB49370000-0x000001FB49378000-memory.dmp

Download

memory/4848-922-0x000001FB493E0000-0x000001FB49466000-memory.dmp

Download

memory/4848-923-0x000001FB30D00000-0x000001FB30D22000-memory.dmp

Download

memory/4848-931-0x000001FB30CC0000-0x000001FB30CD0000-memory.dmp

Download

memory/4848-1033-0x000001FB4AD20000-0x000001FB4AEE2000-memory.dmp

Download

memory/4848-933-0x000001FB497C0000-0x000001FB498C4000-memory.dmp

Download

memory/5268-1104-0x0000025667F90000-0x000002566980E000-memory.dmp

Download