c75d567ce82216bc17204d16d33d7dbf7798dd18e558b643b7c07b83448606c8

Analysis

max time kernel
151s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HypnoHotline.exe
Size 88.7MB
Sample260808-emsplszdpc
SHA256 c75d567ce82216bc17204d16d33d7dbf7798dd18e558b643b7c07b83448606c8
MD5 b54f5a8aaf247763a99ef787b2f6d5e5
SHA1 d321e1a46302db063a37d5770e53846910ee9552
SHA512 a52bea2bcdcf22e26b9ad5c99b93558f213ad6eb154422f2a08ed004f99fffab253ee7d4a3a7c686b399e8dcb5bbd26c71874a3bbc835a8e41df687937b88067
SSDEEP 1572864:L+lIcbNOoXYM8lPkKfG+bScDUvwNawUR1pHII35gGNKudHDQbWHAlCR7c/NYzc7:ClVbQoXur9DvSJ5gGPR8bWgl81c7
TLSH
T112183333BE4B8362F7C577395F60C7BCA83E1967C184499544C604BA318AE9FE88947B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3348	powershell.exe
5352	powershell.exe
4208	powershell.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hypno Hotline.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hypno Hotline.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hypno Hotline.lnk	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
1180	Hypno Hotline.exe
4284	Hypno Hotline.exe
4156	Hypno Hotline.exe
5388	Hypno Hotline.exe
5404	Hypno Hotline.exe
5532	Hypno Hotline.exe
2996	Hypno Hotline.exe
1124	Hypno Hotline.exe
5412	Hypno Hotline.exe
2592	Hypno Hotline.exe
2348	Hypno Hotline.exe
3684	Hypno Hotline.exe
3756	Hypno Hotline.exe

Loads dropped DLL 30 IoCs

pid	Process
4384	HypnoHotline.exe
4384	HypnoHotline.exe
4384	HypnoHotline.exe
4284	Hypno Hotline.exe
5388	Hypno Hotline.exe
4284	Hypno Hotline.exe
4284	Hypno Hotline.exe
4284	Hypno Hotline.exe
4284	Hypno Hotline.exe
4148	HypnoHotline.exe
4148	HypnoHotline.exe
5164	HypnoHotline.exe
5164	HypnoHotline.exe
4148	HypnoHotline.exe
5164	HypnoHotline.exe
5164	HypnoHotline.exe
5532	Hypno Hotline.exe
5532	Hypno Hotline.exe
5532	Hypno Hotline.exe
5532	Hypno Hotline.exe
5532	Hypno Hotline.exe
4148	HypnoHotline.exe
1124	Hypno Hotline.exe
2592	Hypno Hotline.exe
2592	Hypno Hotline.exe
2592	Hypno Hotline.exe
2592	Hypno Hotline.exe
2592	Hypno Hotline.exe
3684	Hypno Hotline.exe
3756	Hypno Hotline.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Hypno Hotline = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HypnoHotline.exe --hidden"	Hypno Hotline.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\HypnoHotline = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HypnoHotline.exe\" --hidden"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Hypno Hotline = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HypnoHotline.exe --hidden"	Hypno Hotline.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\HypnoHotline = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HypnoHotline.exe\" --hidden"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Hypno Hotline = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HypnoHotline.exe --hidden"	Hypno Hotline.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\HypnoHotline = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HypnoHotline.exe\" --hidden"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HypnoHotline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HypnoHotline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HypnoHotline.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
3048	reg.exe
2724	reg.exe
6056	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4208	powershell.exe
4208	powershell.exe
4208	powershell.exe
3348	powershell.exe
3348	powershell.exe
3348	powershell.exe
5352	powershell.exe
5352	powershell.exe
5352	powershell.exe
3756	Hypno Hotline.exe
3756	Hypno Hotline.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4384	HypnoHotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeSecurityPrivilege	4148	HypnoHotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeSecurityPrivilege	5164	HypnoHotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeSecurityPrivilege	4148	HypnoHotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeSecurityPrivilege	5164	HypnoHotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	1180	Hypno Hotline.exe
Token: SeShutdownPrivilege	5404	Hypno Hotline.exe
Token: SeCreatePagefilePrivilege	5404	Hypno Hotline.exe
Token: SeShutdownPrivilege	1180	Hypno Hotline.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
1180	Hypno Hotline.exe
1180	Hypno Hotline.exe
1180	Hypno Hotline.exe
1180	Hypno Hotline.exe
1180	Hypno Hotline.exe
1180	Hypno Hotline.exe
1180	Hypno Hotline.exe
5404	Hypno Hotline.exe
5404	Hypno Hotline.exe
5404	Hypno Hotline.exe
5404	Hypno Hotline.exe
5404	Hypno Hotline.exe
1180	Hypno Hotline.exe
5412	Hypno Hotline.exe
5412	Hypno Hotline.exe
5412	Hypno Hotline.exe
5412	Hypno Hotline.exe
5412	Hypno Hotline.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
1180	Hypno Hotline.exe
1180	Hypno Hotline.exe
1180	Hypno Hotline.exe
5404	Hypno Hotline.exe
5404	Hypno Hotline.exe
5404	Hypno Hotline.exe
5404	Hypno Hotline.exe
5412	Hypno Hotline.exe
5412	Hypno Hotline.exe
5412	Hypno Hotline.exe
5412	Hypno Hotline.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 1180	4384	HypnoHotline.exe	91
PID 1180 wrote to memory of 4284	1180	Hypno Hotline.exe	92
PID 1180 wrote to memory of 4284	1180	Hypno Hotline.exe	92
PID 1180 wrote to memory of 6056	1180	Hypno Hotline.exe	93
PID 1180 wrote to memory of 4208	1180	Hypno Hotline.exe	94
PID 1180 wrote to memory of 4156	1180	Hypno Hotline.exe	96
PID 1180 wrote to memory of 5388	1180	Hypno Hotline.exe	98
PID 5164 wrote to memory of 5404	5164	HypnoHotline.exe	105
PID 5404 wrote to memory of 3048	5404	Hypno Hotline.exe	106
PID 5404 wrote to memory of 3348	5404	Hypno Hotline.exe	107
PID 5404 wrote to memory of 5532	5404	Hypno Hotline.exe	110
PID 5404 wrote to memory of 2996	5404	Hypno Hotline.exe	111
PID 5404 wrote to memory of 5532	5404	Hypno Hotline.exe	110
PID 5404 wrote to memory of 1124	5404	Hypno Hotline.exe	112
PID 4148 wrote to memory of 5412	4148	HypnoHotline.exe	113
PID 5412 wrote to memory of 2724	5412	Hypno Hotline.exe	114
PID 5412 wrote to memory of 5352	5412	Hypno Hotline.exe	115
PID 5412 wrote to memory of 2592	5412	Hypno Hotline.exe	116
PID 5412 wrote to memory of 2592	5412	Hypno Hotline.exe	116
PID 5412 wrote to memory of 2348	5412	Hypno Hotline.exe	119
PID 5412 wrote to memory of 3684	5412	Hypno Hotline.exe	120
PID 1180 wrote to memory of 3756	1180	Hypno Hotline.exe	121

C:\Users\Admin\AppData\Local\Temp\HypnoHotline.exe
"C:\Users\Admin\AppData\Local\Temp\HypnoHotline.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
    "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1692,i,4246116286247023017,5978729176773663460,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4284
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v HypnoHotline /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\HypnoHotline.exe\" --hidden" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:6056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Hypno Hotline.lnk\"); $s.TargetPath = \"C:\\Users\\Admin\\AppData\\Local\\Temp\\HypnoHotline.exe\"; $s.Arguments = '--hidden'; $s.WorkingDirectory = \"C:\\Users\\Admin\\AppData\\Local\\Temp\"; $s.WindowStyle = 7; $s.Description = 'Hypno Hotline background listener'; $s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
    "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --field-trial-handle=1692,i,4246116286247023017,5978729176773663460,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
    "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --app-user-model-id="electron.app.Hypno Hotline" --app-path="C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1692,i,4246116286247023017,5978729176773663460,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5388
- - C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
    "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1692,i,4246116286247023017,5978729176773663460,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:10
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3756

C:\Users\Admin\AppData\Local\Temp\HypnoHotline.exe
"C:\Users\Admin\AppData\Local\Temp\HypnoHotline.exe" --hidden
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe" --hidden
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v HypnoHotline /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\HypnoHotline.exe\" --hidden" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Hypno Hotline.lnk\"); $s.TargetPath = \"C:\\Users\\Admin\\AppData\\Local\\Temp\\HypnoHotline.exe\"; $s.Arguments = '--hidden'; $s.WorkingDirectory = \"C:\\Users\\Admin\\AppData\\Local\\Temp\"; $s.WindowStyle = 7; $s.Description = 'Hypno Hotline background listener'; $s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    PID:5352
- - C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
    "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1780,i,4552871298390142174,2686396122738486347,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2592
- - C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
    "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --field-trial-handle=1780,i,4552871298390142174,2686396122738486347,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
    "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --app-user-model-id="electron.app.Hypno Hotline" --app-path="C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1780,i,4552871298390142174,2686396122738486347,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3684

C:\Users\Admin\AppData\Local\Temp\HypnoHotline.exe
C:\Users\Admin\AppData\Local\Temp\HypnoHotline.exe
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
  "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v HypnoHotline /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\HypnoHotline.exe\" --hidden" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Hypno Hotline.lnk\"); $s.TargetPath = \"C:\\Users\\Admin\\AppData\\Local\\Temp\\HypnoHotline.exe\"; $s.Arguments = '--hidden'; $s.WorkingDirectory = \"C:\\Users\\Admin\\AppData\\Local\\Temp\"; $s.WindowStyle = 7; $s.Description = 'Hypno Hotline background listener'; $s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
    "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2204,i,15363064088770266546,4233780315867044115,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5532
- - C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
    "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --field-trial-handle=2204,i,15363064088770266546,4233780315867044115,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe
    "C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\Hypno Hotline.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --app-user-model-id="electron.app.Hypno Hotline" --app-path="C:\Users\Admin\AppData\Local\Temp\3HZdKxbFGwAgZMIo4ggDeONL78e\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2204,i,15363064088770266546,4233780315867044115,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_bjtjmz5v.mpc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bjtjmz5v.mpc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\LICENSES.chromium.html
Size 14.5MB
SHA256 c54df6af4da6dbe8199869b48d1a7c8c457bd96441d944377b83e173af2bb2f7
MD5 61d40de61cb10894d29d83cb9b1b9cc4
SHA1 b0cf36717416009dbfb5b89affd9a88e5c94624e
SHA512 92dbcefd624742c2d26db51cbe246a86088b044cf15469d3f606d49d7e0e0514f69a79ffd72741feeb7a565de089d86fedfb4b0a17e450957d73b03437d3dd0f
SSDEEP 24576:wBS3jZ6foujZ6X1jZ6vCjK6DLUwROuTgmf3Kjr6ZjK6xjr6mjK6ajK64jK6QjR6+:wSyeFma8mE
TLSH
T1BBE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\chrome_100_percent.pak
Size 143KB
SHA256 34353e0c595236b0e3d256618aa31afe270d6238ee3c251ab8e294203a7e34c5
MD5 4c51169d4633ad96f8ddbf39537c5d1b
SHA1 1abbc66e254960fb3013df03b28a56eefb986dde
SHA512 844147962bfe3282a9abe786775d9604f1e04bbaf36300700de0e4c9aeb4e007999e6024189f9ae95bd834a93c137d5bc26b911c51db4864719c3bc93251d2a0
SSDEEP 3072:Yz8gCGIQRTw1CLjQBHUP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:Yz86I2ThjQB05K18Gb0OV8ld0GecQ3Er
TLSH
T1DFE3D1E7B3F0EE7DCB9756F752164071EDB346290691024B464AE8762A36788CCD87C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\chrome_200_percent.pak
Size 212KB
SHA256 ff54bda9cb24c2ce5825ec8d5c5b3217c2738b43c2882bc3d63638250dee37bf
MD5 e1949c364853c5a3a5499eba16fc1a6b
SHA1 c72c097a54c864eb0474938ea2446d06188860db
SHA512 381e3b634615903f07d5f24378fcac9778bf2d27a2c1c81ce721300672053c9baedacd4740b89423bbdbbb6d30c76a79bfdccd36d0b170079123993c65d4cfc6
SSDEEP 6144:dDQYasN6svyAEW7cyjQB0ugx5GMRejnbdZnVE6Yoppx4:yfsN6svyA1tjK0a6edhVELoXx4
TLSH
T15524F1D7B3B49D7DC9670AB3521601F1FCF215395AB6420F068FAC357A66BC988C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
MD5 1a7544f942a9a9de9354e7a0f9060e3a
SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
TLSH
T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 9da80727db8bb2760ece1aa5dc2a2ce9920e1794bed6de0ae63ec21924349a8a
MD5 3210f5bd846b76504195274663731607
SHA1 ca0fddee7b3efc98028f39266ee5f0f3ebfc9b37
SHA512 7b7feca1aa7a73d98edd2690d83537717baea9c3cf1bf8fa75f18ec4882c4d33b1b6c57290cb28a14272aec3581efe341884ef6c16c9d0239c3012547cc0aaab
SSDEEP 49152:HsZovSNDmM5IGHeo9a12wL+bQmBhj0usks6jENRyD9HefWgbjhpLjIEb4t4a5Y3B:sDOGHeo90usks6jENRyD9HefWgbjhpLV
TLSH
T198E5AD07F6D6109DD029C070979F9213F671344A8B2065EF26D08A243FABFD86E7E769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
MD5 ba9e45bfca3621e4086e6a1870f8cc41
SHA1 8d1b2d42707812608907f8000041c16e7755532a
SHA512 07ac486039098753d77b53ce0638a172c583620d6feae0447da9b8931fe9e0f8b108ca7c8282b6596bdcfb252b3600bdfe7cb01c96b3564605084a932dc7298b
SSDEEP 196608:fwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YEs:fswkpHiXUxY/iJ53IWhlVjEeIHs
TLSH
T199B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\libEGL.dll
Size 481KB
SHA256 a6d315c7ea7c240f6c82afa57b39b96191a62d3f5a0d25982e8567395ecb4694
MD5 0923b2b6f9a88791d7e42a229fdf84bd
SHA1 d3719daa82b4b95e2f1735548c71d77dc8651a72
SHA512 4ba8001822cf9abbbf0852ab75389ed6d892504f699d85e015f20b3f28db1aa54f5b171b4da546f1318f8c6044abe06c56f7c27621d039cf706af5b615a67cab
SSDEEP 6144:/Krfdptu9AvnJUCu536qq6Z64Vc+ALNwYyn23:i7dpvnS506Z64VcJFg2
TLSH
T158A48D15B3D948A9E06AD1348A474642DB7678860B65FBDF03E093792F3BBF45B3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\libGLESv2.dll
Size 7.6MB
SHA256 71cc200c14725793888932d63142bda9ca6b4d2988c7e16d44387351c56d68a8
MD5 5056eb3e4a076afcc9bb8018e783746c
SHA1 7b9ea35aebed96e36c55b8f72d6137f280dae647
SHA512 223ba329b61a5a830d5cd0f8462d2d2d3a47b27e082bd694815f3f62b3715a8ec25cbbc069f09d3001dfb8c473019eab2ac3287e544f02ddb973ded4d647842d
SSDEEP 98304:FaeBlw64Uag0hVPrTg0gQo1JiYIjGJXKt7:YeBlfwCoqw
TLSH
T1A5867B03F39940DAC04DE2B8D7579626FA35B8850734B6CF269407292F67BE0EB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\af.pak
Size 542KB
SHA256 9af54cd820c9dff86e2e167251b464432b41f717702734c5fffff7159c13a7be
MD5 77c5a3a119980663270946318127e8da
SHA1 c0369df6da0a35e627a4b70bf40c7776fe7cf667
SHA512 b8d81992a27514ffa913f2340349de0b7a89e15d25701cd581ea4000f8afa866090152191d67f94b0c1a2fead78b348cdaffe4fe0b52cc77c7f65dc912bc3f5d
SSDEEP 12288:CNNjDlbBPtRGtxatGRlkNrQ6FGRlWFN4H2JynvjR2G5IEsEo0vhuIAgL2Yx+9WX/:6tlbVtRGtxat6lkNrQ6FqWFN4H2JynvL
TLSH
T115C41B0AEB80173D09A076D6FB0845F7BB9CA26CD770B2B6DDA9823105A6EFC117D1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\am.pak
Size 880KB
SHA256 9d601f825508365f3725a3ab68548caaf4b792f664914343c498981417792c03
MD5 d5f85471df621b5e66021d7550feccda
SHA1 5ddcf10ff9f62c2b51f0c4df927112094caf8447
SHA512 118151f12a82ad2711d6b575b4a5f2f191dffb7e030c167331264fe47bb9ae4e9c4f63b64769cbb8ef1127d6628e9c90d398c3fb3da1c00d89352c61940ff755
SSDEEP 24576:APMb8Ts1RqhTCNayCBxI1UujTBPwzdLXaw59bfiexVpq+XG/6NZwP1f:PY5c
TLSH
T11815BB547EF9F7170F8E8A1994320E4E9594AE4692813C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\ar.pak
Size 968KB
SHA256 9233e05e70e79c3b91a56a00eee0bf4289289ee9f9ef1ba9ce510a701c027061
MD5 71daff814ae59791915b5a2ed5e70e52
SHA1 6a81c008b3e4f66daa0de9757cb8dc9d7e11e074
SHA512 fb4702cbbb2101415c35ef6c65d57c22ad77aa212f951bbb99f13fc179390c9056c4ac24a4f0f33c829a44794f68707775151747cfee3279c1d9ee0580270ffe
SSDEEP 12288:Pbi8oRw1YBlWXDjLNq1up5IvPUtD9MktiSu5r2NZk/E7wbL9t:Ti8o/5bE6
TLSH
T1B5258AE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\bg.pak
Size 1004KB
SHA256 0b973e166258d659d3d42f65459aa75854f0719dccbb2c0917372cd53cf731af
MD5 ca450a4c832fd6636b3ff8e69ef17f24
SHA1 3459443e500bb64a3fd588f34e705221196d0678
SHA512 e8c7ba9dd71d877c0c41f3283691984d1bf635a1ad6ac2280ab00ce12e2cbb0e1542888bc1ce4a3b9668cc00c7c4cb30892860b5b8e0d28f0549bcb849cc4e8f
SSDEEP 24576:gesIRWfjMLYRzQkECvUDVb6eZoGdz373ZNj3ADKvmVDYv+74u2VG7Qp5kkptctJA:g/IRWfjMLY2YUDVb6eZoGdz373ZB3A6H
TLSH
T11E2515A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\bn.pak
Size 1.3MB
SHA256 da3e84c471b5f7fd116aa72930a08323efca20d51b6d7a1f4311b8ca83a29e4a
MD5 8a64f018c3f016cf95216bcc5258a66a
SHA1 802fbc4ea1fa4c45bea56585f7333f0ab98f1755
SHA512 6f0bfba04fc0ee7075d5967b8e0bbd5817ff5bfd65a20c4e16928bdcb3c0352b385b1fd83220d56bd279c8d8b623d0ee3a862df2692cbedaa6d4cd28989af4e5
SSDEEP 3072:5cD4d0r3Q2QcfOOeO/liYb32x/vSscJfJuzRxfzOyvWBbrPQ35PWkwzD:5+4dw3Q2Q4/eO/NgxfzOyvWBbw59wv
TLSH
T13455EF209C6E81B6A8C5CDC9434C6370C1236E9B9B61F74DDC17A25938ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\ca.pak
Size 611KB
SHA256 d6d6d1ae7401e232d7d585e8eb9f831bfda5b4a96d526eb03238e3fdbf3ad375
MD5 3eeb8ab099088e4bc103efb4994d3adf
SHA1 6077decc4c328efad8803188f225b3d2285c3790
SHA512 0e8cb0e94fb87f243ce0cefe3d496f8bf918abfcb3f20c0aefba4d1f7a36567c8e8c48fde13bd47b77057a58b17492aceb4c07fccc3d17f1d5c527d74de5f8c0
SSDEEP 12288:LE9WuZNu87ry0CieVoDQRU8r5PsFrN3Mw2juwHzejm0t3ltv7TfgywXLw/fnj9F/:LHuIxGqLNIFqXMND6N65oQEna
TLSH
T1B1D4F8239BC93B7704D3330AFB46C257B48CA9847B06D254F4AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\cs.pak
Size 630KB
SHA256 bef680833f0d26e2765310c41557c18cad117d74a937b4175f64d69d9b92a6c6
MD5 de9a63dc9525f324cd1531f89296e938
SHA1 8a661d907c7a224d47013223937c4329ea3eb52d
SHA512 13979130af915ec7e9e1907357e5f2d49b8ff459dcb38363fff47803c81ea2fc41441314a57337e0eb7991c3b628c8cdefb09ea6b0c0438ad12554fe2bdc9da3
SSDEEP 6144:aAeCSl4aEBtEJ5A8fOkAHe05vzmDKZ8OhLJSBHS8Q2:aAefQWJ5A8md5vzmDKZ8OZJSX
TLSH
T115D4491EEEA36435588002487FBE4128BD2E83140B6EA9BB6C8F9C95217577ECFF4D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\da.pak
Size 569KB
SHA256 5b56da9368799e3d750c0a54bc13b7c3b112265bd9ddf299e7f4905d1fa1f5fb
MD5 c4de734820c27644a51cd7a25b82f723
SHA1 6ce115a3a0fe59385dccf1fb714549f964099481
SHA512 d1e915b0186534267125820ee5ff54e1899a91e66374c9f0b28e25451e63d72c89ae9ecf8a77088814d2b9e1210e43dc1fcbd95bc42eb3b1ca195f17502c7486
SSDEEP 6144:NM6QiSGfRVGzV035dN+SDC/e5o5wlA+yJwaIobYrIa0q25Zj5msGRuld4BFQwJ:NMTinJr+SoKJs5ZjMsmX
TLSH
T100C45A4BCC9C732F89AA0764F7118DA7EB5D543CC684264F64D8943A09CFDA097BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\de.pak
Size 609KB
SHA256 c8866a7ce89c9c6ab4b89dc7bb076a2fc3f05a9736f4f69718afacbad684e443
MD5 9113b5942179f5e197c46ce87b34e6f9
SHA1 dc057a8bfccc7d4ee8bfb47e9ae4d178750df1a9
SHA512 83a5765c9a271e0ab778c921c34d96ca13b1808a26060cf6ee5209754ebfa2d75aa4128b08f66e764eed827dbe9b0b52537678a898d2507ba1bc3461effeb0c2
SSDEEP 12288:6pSm4pOs3K7Upyg3apQFA8M5bbMVUnVChM:/HOs3K7Upyg3aplv5HMyChM
TLSH
T14BD40703ADDF621EC78673607705CDB77B19E36BC346322688EDD12B654B5B283AD422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\el.pak
Size 1.1MB
SHA256 3981e2f0e074bc4791f1e3cd955a9eab2c38d2e2e142c64a9da0f95cb8ea4a35
MD5 1f21b04f11610e71a7b34b21b74246a8
SHA1 3e43cf003f84a69d30c5d021bb1d8616afa51ec3
SHA512 d0f126231f145e562550725fc57b006ef598e89b9ad5247f3a865465450ca100f9e8c43ff2ce1092021dedb6d03578c883f5e40a512a5bc3b438d1c851b0a286
SSDEEP 24576:N7RHCFbr4qsYh9Dk2trZu2IJXDsS65m1gpnV2sBsypQjGm09gVoyqIWYNQKOhOyj:RRHCFbr4qsYh9Dk2trZu2IJXDsS65m6V
TLSH
T11F35CFEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\en-GB.pak
Size 494KB
SHA256 2367ffecbd1f804842ca258eb0a64270d82e8b82dc3fb3e8412b458b7d2050da
MD5 4d096f26c01befe71c22cf51c00b86e4
SHA1 07324e380b574c15008b83b55026c86187377a11
SHA512 6c7e7cab7ed2ea14ab3bb521693ea8a73ea2986443ad29b22fd0a7bbba3e01830d101021dc14864902f809f94f49f47941a6aeabdeca6217f91a5316c4350de9
SSDEEP 6144:DfYaFQbKR4BeSVBzF6K5iMP9e7QJKTfaYcGXegjaC5bMDZFBcKRvD:DfYYS/JiM4QJK1N5oDb
TLSH
T1D3B42B1FF744126A069312A27F0AA562FF22D07CB35116663CBD902C33B676683776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\en-US.pak
Size 499KB
SHA256 2a2ebefac8c3569580434729ffd71598cf05ea36447b62a64d6f8aa26dac88e5
MD5 ced4e7989442a389cbe97280217cef61
SHA1 ad6bfd4c719183bbdc7f070086a8d9fd8885ad76
SHA512 cf87a9f955646c88644a9815d1626f8f69e75180d6f3103a4af47d00172a6e473389980dbc322c82c0e00e1eacaf546106fdd7b7291cd7c01cbd1441d153afd0
SSDEEP 6144:qCCHh5sdyMuTsSBNMP9e+Qtt3faY7jsyo0X5v+juangH8/gFwB:qCCHAAM4NMvQtte+5GjIwB
TLSH
T144B44C1FF7441229069352A27F0995B2FF36D06CA35112563CBD812C33B7B6A83B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\es-419.pak
Size 601KB
SHA256 025e72a5a74d4cf787fccb4b527cf8ad266eaf9153a3541fcb6d57d9ae2cd783
MD5 4fd8c6b2672e24a3746e98d2c2a1cfbe
SHA1 61839318513e4b2f7e58667a08ba4f5476f6810d
SHA512 5a11f29d8652093268ebe196889809a963dd18ca6ca3b0dcc03825148c91372dfd2fb9eebd0ddfaa93d2ac05e2a655ca030fa69fc2d0b260b8743906846528f0
SSDEEP 6144:ApVJWM4Vp+TspYH7LoZEAn5GeTr5ABRmQTCx:AXVU0h65GexAKx
TLSH
T137D4F926BAC81F5310E3A388B743D753E4D89545B408C29BE8EB876562CCF8CC967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\es.pak
Size 600KB
SHA256 b29dbd50a396424770eda58a5c124ecd185e219274a2cb3b1922e85e632bc811
MD5 fd8edf7c9b0d6378792da2b8e280156f
SHA1 551c7dee1866249571efecb5245d912c8729bc85
SHA512 bbeefdeb0cabbc37695b544cfd58dce7bab7bb9a1aba82ed0b61fbbae055902863c3b9282996bc581d74cb9b00a63fd197d3824f0dfa6d0345f6f72c06106c0b
SSDEEP 6144:1ztc72Lsp1wbEg8gMEb+mRxzOHpp8j15JxAJgqvpnyE6PZOsx:1zQMbEgA4xzip8j15oJdvtps
TLSH
T131D4F626AACC0F6310E3A389B743D753E8989545B508D25BD8EF876612CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\et.pak
Size 546KB
SHA256 28eb00d9adc3efe9f2bd62337e3efc7e402ecc8740aab9f7036299ca995eeb02
MD5 1605617a232d76ef2610ad198b21f87e
SHA1 8d30eff566475aaa57e70c1c27b54b4cc90d9eac
SHA512 4fb1375da154360182e76b6fd28c6a903958a81f84c466945c1f003abdaaeb8ee4a50914bcd118d5ff5728ddcafce66a26eb5ec2de08627fba0f8235515efa0c
SSDEEP 6144:P1chQp5Hj9AggB+Me/zy10rmFZ1ZoMqluTaOTQrSPDi4oog2qV5jtqbMiiCKMPaW:PmQp5HA/e/3mFZPymjg2qV5Rq8W
TLSH
T131C44C42A27D771B182412F9E737A923DC9EE7D8B4000D9668970A1971FEFCC38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\fa.pak
Size 899KB
SHA256 abda7417aca41a7df7525f434d70f7ba1d39efa6b4744383cc0537fcc295859e
MD5 c804cf28a9bed28ba5d60f51f8a62016
SHA1 f73a1da25c4b374e045c28ab35da7e976c7b88df
SHA512 88db928b09234e4f22cca2dad1293db9ce8426a3c316e234368cf900d1d2a628c30289d01f1be20991e03706444b1c31e3e1b860efba7cb94d41b41c67f806ff
SSDEEP 24576:db2S8u313uyqoT+sLqTRmXXloTUOmdAQifaQ2XxFtJGk62YhHoiiOYMX4OOIUDIG:915zj
TLSH
T1AD15C3956AAC9AB15747CA0341E33834C773EF12D34DFE40ACA1076609A5B139F5EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\fi.pak
Size 557KB
SHA256 7403af71e1372a8e17f579d9db6fdea9cd8561305540d4cbed72f94d384088e1
MD5 876440409cbc70a594c6a9b89ca3892e
SHA1 cfa7c37bc0c865bb0257cf6954b379f258d5bb90
SHA512 713e63082202470a59723ae1c1e7335ddcda678a709d5d7175681ea4a3661fb363ea53230565fece97ffeeaad453d5dd5bae29f713e55af5643cbd05c89a768b
SSDEEP 12288:tewG0I4/1946Njoaz59l0nU3RIzp/WaIs2YM:tex0V59l7I8l
TLSH
T18CC46C915219C22237C8D29E7DB0903EF5E5E39CCC284D9AE843C7D849EA9C87D7176E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\fil.pak
Size 631KB
SHA256 adcdc41e7427894f9bdaff0107a4fe4379e51a00cb7030ec5b70b2a919e6a5cd
MD5 30aede3219939692ec66e0286af87e43
SHA1 5397955b16eb650e450862b2143efcc0b8008993
SHA512 01e491821fe2eef8e04dc0e20b9a64137db9eb7c2019dd06a011fdd022a4790fcea17d440ab7f63676b3526f9ef3766800ceb226d214a54637154c0513b99420
SSDEEP 6144:qF9uPGiB4vkefsydDQ+3i1qtj3h3Yvi59xwvltK1oVoA7CuK:BPJS8g5kvW
TLSH
T132D4B61577402748DBC352E55360A82FA6E560BC3F82386E0FBF269B7BA7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\fr.pak
Size 650KB
SHA256 135daac08d70337891cad5449a0972641f8499a09388f91ea292d2c61c37906a
MD5 e1ae3cb88ce9cd4901c540f82e7d836d
SHA1 bab5f1bf9c678d0b3e9beafdb183549685549a6d
SHA512 0ee897c28ee5d7554b5e3105f63858af895416a7d4287fd7959236eb376f616f33e429e7e65baeecdf337a1000efdc656cc2b2add63c67cf0d838f6f7efd50c1
SSDEEP 12288:LaXuNMjZLTqHO5CZKZUh6QuafVUezBkx3P2ZFMYnY4gv7r3TBcEavjDzNiR8zxsf:Laew6VF/l5xS
TLSH
T1C9E4E66FADC431CB19C613A7FB12D6A3DD348248F215E340D89F4295129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 e81f79a67e5a75219c34a35b5fcead351c2c588205a171fd25e2813054526623
MD5 6589fd3c261e1059919dd72f0cecc667
SHA1 39c14f01ff8287b34612c80505eb76c0f7042bb1
SHA512 58ec9a86d6dc398de8b8296a9f39928e81bed8d9ad7489b31254fef2aaf16620f93b8295aac2fe5df02679e05e5577c5466fa7fefdfd8ac8ffe4be82fad3b31c
SSDEEP 3072:7C42wq8yg7ie3CFDbxuPjAwREJKVMjNiT7llj63rAulfeSi5NnWsWi//GQoy7cxT:7W31U0BT1s+oB5qpYCo1Bsyk
TLSH
T1D35518D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\he.pak
Size 789KB
SHA256 f1e820af68b7eb21eb08f22e7e238b89e93bb5e61d8d1a682024f1cfb533809c
MD5 99faaa9ffcbd48a14cff67fa87ebc9b8
SHA1 d72a8aa50bf1b0ee7d83105478d38139b7265931
SHA512 0a989dc686367e1abe703863d6109ff71a389aadfef9b81da38f45b3a9f331430f0ab8ecda282c2865db9134496d249028645713fa120863518ca1cd6fd616c6
SSDEEP 12288:F1UoKpSehwDVRkSTz5srHUv+6AlUWq+/gY36weA7mXkkeQCajJ5ACJP6qWz+i5ke:Fnl75b63
TLSH
T1890599C4B2D452255131AAC39FA8FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\hi.pak
Size 1.3MB
SHA256 315c93ac0fc2d3372d4cf43c036dac0a91ab901027169f26437249e324593e6b
MD5 5d033c9d67ba22c5b385ec7db182121e
SHA1 024bfc1a983f82a39dcba0c71bf85e2d9b53bb1d
SHA512 624f116c0e19cffab4c1ab863bc814a405dc225062e4cfe43c1c5214f262dc9f158d10993748c2dd3347f7f07a7bfba95e1b3a962a176c58fd28d5ab856dd5d8
SSDEEP 3072:SuqP+VnRlirNMzFandbipC0hV/B90ZV1d3uGlYvU5vJEOTByntDPtDrpf2n1s4ff:SuqmVn3YckspWa5pMdAhuv
TLSH
T12155060CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\hr.pak
Size 608KB
SHA256 1a32574d37cf72b747709605e17e14ce1202bcfc282728254f20e976d75b5cf0
MD5 a5e8e14d86c44461868171e2db2ac2d3
SHA1 0796264620a81275a15d5aab8667a7e24ec945e9
SHA512 7c02da2695e71c6255c3be9aa7f2fb320466ab57f5297d34c2faf7e0fb20483685fd771e5e1a85bac107098f4bb5e8484a8d0d7d7a984d2511b078955ec067ec
SSDEEP 6144:PPibWO/pf43TCnVwP9KSjNzK5gGBOIMerzrK:PPib5VCSVwPZg5zO3iK
TLSH
T180D42A7DBEF2570A0897B34AEFA643447DBE08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\hu.pak
Size 653KB
SHA256 abefd371851d9bc9d14dce50dd068482e30154795aaf44d86d5182baca1eaf4f
MD5 b0f0f7c41373f21c8608b1a7d761d297
SHA1 beb40230614d294a22a081c0dfe049100f3c0f32
SHA512 bd07729c34c7b156c1cf06ce273d9586df248451647c5274cff5a3a168398325aa4c60fd1329d7d758c8694166524b70fedcb855abc611f9772a27496e19a2e1
SSDEEP 6144:MXsHB/yPRnB1L6Hk7QsKWA4jtSubU5STT8BZ49Z9cdYh/ipwKfei2SnjDS54Rmnn:q4BENAkU5S/85gsS5TAE
TLSH
T125E44C7793769059BCAC17C378643F16892E481BAF2B36F72887846D34A178D4D83C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\id.pak
Size 539KB
SHA256 0cf89ae8052f01a4b891d151985e3e18d50e52bcacee3a790b248ba9953c3a4b
MD5 cfa14259325cb3929df6a6e22d0240aa
SHA1 73564ae7c7b47a805d5191500d327766d5b2f9da
SHA512 087ad2358c64a63dc6bcffcba12d2b462b475b0c94df43a3ac78948d943fe79f1fc1f47a2193bb35f3e1507f2aefcc8ca69536b030a38378911215af957121c2
SSDEEP 6144:QWr3mUfm6fQaJappNKRssrMutoD9Nf+ITFjlFsTmBzsC/AYX57660ROB6hmjiT8b:BbFlOpjK1rMhBtTFjlF4mVsu5766Z42
TLSH
T1BFC4F8636ECD300C4A4803D5B2CDAA1E7CCD233BAF05B76E8E748F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\it.pak
Size 592KB
SHA256 2d29f3ca302d2ec4ae8d69a33d028999b3f3aceb61105d6a3752e6f7b9771447
MD5 d612e35ee48b1eaeb890b9bbdc90d0e3
SHA1 a3ad8a99b611b14ebc807aabaa17ce8388ab43e6
SHA512 a36afefa5d3cc330f014d208a75dfdb149eb4f6113d8526a3fead53aa8678a5963f2a1ba6c1418346f69f7c95aa83e1aea5ff507ec12d7b92528b82cd6f3dcf1
SSDEEP 6144:0iQeGXfcqxJeygMc4Rmi99luZO2NRzXSIqBRRs61wtSe/RT9Tb+Akr+HTOr6yqpD:0ihGPcNygXpNZZlP8VVsJFHDZ51Slo7
TLSH
T187D41C3AA5D6211559976359E611B085FBAEFCCCFF417218C99B031C22CFE80F2ADA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\ja.pak
Size 721KB
SHA256 ecf6fa046adbe72d0f426552882e2d996ba3719b3b34004210a58fe4f9f03e9f
MD5 c033acc007575978100b3f400f19a898
SHA1 8be280fa01d638f91578375a9f96208f39ba77e7
SHA512 1a8bd0daeded35c6a2ebabb87702cb631539c276d2e9ce6d37446f573333a2083828581184cd4eeb28ee0e317a9b7afea16974ec0a8e037620da8d1db54a84a1
SSDEEP 6144:beMdfUgShuerIKDhOcQ5Th2yx7PZ4Q2nwSobbj5z2FNKgbVV:q2fU/MCIBcQt9PZ4Q2nwDD5zaNKW
TLSH
T1D1F43F7CE3C569369D6153A22C4E76E17506AC9FFCA23A3A442DC070BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\kn.pak
Size 1.4MB
SHA256 676520981ece4915fc9985166ee8d9e2397686f5ab07fbd37548f3c4bc16cf3e
MD5 5370cfff4ade31fb9e90cef616c7e4fb
SHA1 2b4506c72a73dfa61f7103ec4326029c37ad98c7
SHA512 4adeb4f596b3416d2f0af4067dacafc77052c32685aa56d9a675e02a5e5894e7e60f442017a1d27addd6dd9b2aab5787feae825ad245ff6dc0c35620a80b929d
SSDEEP 12288:COuXaxJC7ttz5t8t/0dr3luBppe7I5HtMa4e8yzIx:mXaxJC7eN5NMP
TLSH
T15965CD186DBA7D301BD5106B24EC643ECFF16BE29CAA07C2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\ko.pak
Size 610KB
SHA256 0a9220b66f57332a6db684f1f34661c7d774f9cae4df6709b8b06bb063894a17
MD5 4b0fe54ae894908ea37f7771ab731adb
SHA1 b43e606a427ca741c6ec4b6b9a6adb4a39dad55b
SHA512 10a217ed508f2637586d87cd448a7a8a29140134fd9bf478a678f3523b4bef7dde00d849529ce87f495a82785a41094d8286f05b5baee230f4ff0213f5f98b4f
SSDEEP 12288:QLtG0+IgNTifYj4ZGRy7YvDcx8HKRh66sIn+xWSiG0G1zLhwat7st8Sn5hrJ3vu5:gtGBlS5o3Pguz
TLSH
T1BBD4D6F238DB63CD1193CD82AEF4FA198382D976F7530294ED44CE449E645C74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\lt.pak
Size 659KB
SHA256 cc1140a723e8a58d227b7f1a890805ac61c53b955711e19e0b41cc0a432d0483
MD5 1651bfbcd330b4168453cfb68f8e9e93
SHA1 42a3a017298398a1c72f69de0054fecfdd545910
SHA512 6fb775a02d0a76a118086c01b3e117c7effa191d4ee468ff426d60e98557c59b99c1ec1586dce93cdbec3db06883e80b13bc8bfe6dd7601a7ea1af2c95e73fac
SSDEEP 12288:G/gySLMPs0g4+I8WV8ll5m7mAyLmK6S5M:5TMF81l5FACmR
TLSH
T1A9E43C0069E3AEFB9A4467C982A48AB8DEFD50005737BC61EC69C79BC43BF452560F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\lv.pak
Size 657KB
SHA256 6ca0c36e14d0fd11da8c000c8ebd5cafff4c86faac1ba8242b89c56e42ac9dd4
MD5 960e5190c4f16fe403fe1c9dccb5373d
SHA1 44d8432035b8e135cc463745c28482d2e4194d86
SHA512 b76ceb6a3599ddf69f023bd20fbdfded83485da0ebf4ca6064e7f06490baca6276ccaee2a80e7fcdc5438e772bfc773f558a14a961c4c29bd0e58336caf3f5e5
SSDEEP 6144:HO60Z99PW+P28aa7vAD/NrtVFTl49i5zH1pAKh/VbOs5RcnabgcVTsgo1R3pz2+N:HO6oPW+uaTokMzVXFIs54cVTsB3+x5g
TLSH
T175E42A959EC68FAA4D908DCB732AD122A8CCD740FE07E112DD7D4B3A550F52432B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\ml.pak
Size 1.5MB
SHA256 3c43edc7060b5860952a686897add542f78697c5c5c20bc663106d7d73c877eb
MD5 17c8fac183a02993f305ebce67698dc0
SHA1 792669a90679231f81e8e158289b7f8df0b71dee
SHA512 92b7dd5973c7a0ba18ea81704d2d9dc4bd00b68d3b274280721b26f51975e92e707eb61ec7762c905ab243ee75204b577f984592ff626175da2f86edbce2a63b
SSDEEP 24576:r+xO0+9y9XBkx/KfKfVB3+zXhw5zsfmJ3z5GaEa+S3A:p5Q
TLSH
T19C759D5BA036CD3B0FD102167B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\mr.pak
Size 1.2MB
SHA256 6724b057d002866a42b42a3ef50343f06a3610767c29e962fabfb49300b10c56
MD5 c3afc196e56286a147bd71a304da5746
SHA1 760a9042e5f83c557bcbf347038b57bed47047d7
SHA512 520f1bfc5125e35481fdc1ac2e5ae5369ac2de644f2f8b3b13776d7d042256caa294eda60d3c2454f64d7d25d35608c07da85e560daa9330bba1deca9ec8f5b6
SSDEEP 3072:85WQNNwzsx3rV+vZ81spN1i7vm8b4njUqT/iDU0sgWekxJwFEyGRg3R5QodgEqY7:8Dqe3rupNXiDUeOKZ8HlfXax5RmfUdz
TLSH
T10955C14DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\ms.pak
Size 566KB
SHA256 3173e02a2de0621533263f0364ca3ca633b0f1b9496826e4976b86deb306a45f
MD5 0db7be3ec6be6a2c0f0bd4d8ffc91e5f
SHA1 ba13b0c62febe6663b07469dbdd62b06d5c2bc5c
SHA512 71ff18c1f487a98b8a03201049b521e3ca1b3ef272dc8b8868f59fe4735cb88853a404ed9adf089acc39bec552e5d6f47bb9d976b0467118f55715d7fad9667c
SSDEEP 12288:FnAMg+kHkImlLkKx4qGFHuqwTqyU52l4P:CMg+vcKx4LFHuqwOd52l4P
TLSH
T156C4B6469EDE3118085943D9D2DAA91B7CDD3333B705AF2B4DA08FB0126E7E53316B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\nb.pak
Size 546KB
SHA256 fd4bd459b68a89869bc1c95a6f3d41064d88fc1c0c11e043e42a18223a88d4ea
MD5 ab6b35f9e3c96d2eb9dfd437f63a2dcf
SHA1 074ee34cbc193c32772b26b79b8b89ff5abf7282
SHA512 d8fe365537250c9e7810afc4422ab58b712623923cc86c5a9d8436ac42713e7c707b70c68f1063a3a560d061a74bd264ca1e04745f463e2b328dd8c9d58b7ae8
SSDEEP 12288:i1AJ3JukzF9doOp7f2OzlFaXe65WLsBGeL/Ugt:nZ9gOFaXe65gsBfTl
TLSH
T15FC40883EE46B72EF6A443A4F51986579B7D942CCD98199B94CCC22E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\nl.pak
Size 567KB
SHA256 72a15f01c50d161ee22f14ab4bcf6d9067aad0038bd514620ecbf03f1a3e5c6f
MD5 95e274c56adaef240dc10f3c26098524
SHA1 0e0ba085c443aac64875274b460bece84fc1748e
SHA512 5cc7d9e2dd09b3629ffa0432119b731d621ccaf94a1a08038c30c2777137c671ce07835adf9335b2369c630172662a34083c5b577b2813445b4c7913ce461671
SSDEEP 12288:fmulbJWQusaUgbgL5Cpf2V5btA7ywv9qHnGlmTy:uulbJWQusaUt5Cpf2V5bK7ywFqHnG82
TLSH
T1C7C4FA17A84E253E59C1B385FA094FBBBF2ED22CC26CE67D94DDD1340443FA8826D589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\pl.pak
Size 632KB
SHA256 16f6928022da4b865315d4b1b101e247f17e4bdccb334955bb4260999f392174
MD5 99785f98bbf5bf93b0846a69494bde24
SHA1 4ee4790ad42cea3ce7a3ae5bc129e588a4217357
SHA512 30fcc63b214faa81fc17b220bd1e7804fc453a5aca1752f9c05c09139275c46af9b3c5aa11317c850b29f0c550eceea10a53535aebe73e18a7d58eb71b8b2506
SSDEEP 12288:34zwazWoOBAIr4OfQfuzSJaVHCbAtPeCUd0e3mINUXhMvml1QhTC5LiwolcySy:ozxYVRhM81QhO5CH
TLSH
T175D45C0D56E58A4E4CB008E6F2E71B7CBCDCC808F209D35FE46F452A615B19ECABE594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\pt-BR.pak
Size 593KB
SHA256 2d15ba6ab0fd876e874a67b3a501d51c8906987d34e538b2ca2d103d632d54cd
MD5 c7832f622a662ad5930c50e1692c2720
SHA1 9008d8339c8e54b08ace1b6d0b41c6f18be577f7
SHA512 e17cc490a417c20d985b8bba54e57e4f5d8d847edc2a90df47613450d527e3650affec5140a8bea29e46cc541a3b25576d061d6a6c2f5d0c0d97e842a8caa089
SSDEEP 6144:gHFBCS7sW2dNBXBLXs7Zy+w5qEKV0GosRLJ4mR:gXCsG5qEFsR14W
TLSH
T121D41B2A6DC9136604226351B74EEB43E5880745FE0ACB87DCFF4B45A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\pt-PT.pak
Size 596KB
SHA256 8f64ab17821a2442723433eab30fa55f7efdf27b7c762c39aa6b68f214e743f2
MD5 a8bc4234d5e9490700d8e9cd47f9cb77
SHA1 131abbd6ee35b556dae2d8dfb225486a7cca981c
SHA512 7880a75f898c4e650739226fc4f01cb026b2a73e50f4f76294e072f48945e57dabfe0795ff28df5ba0a73f6b472933af5f3764f8a113b572c3cc33efefbe2e2d
SSDEEP 6144:PW7ryo+wW1HS4uieJVJJxhIVm3vqfz/D5znLuiiSRHw:PWKff1HGUD5znLSSRQ
TLSH
T194D41A286EDA136605135381770ADB43FAC85645F90ACB87C9EF0B4672CDF84C6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\ro.pak
Size 618KB
SHA256 b535dfab86f6b2b093f2ee617556daddb4be27772bb72ef85f9a3ddfb7cdcc01
MD5 5fa9da0dd9b832a692a6f65aa4494e08
SHA1 4917071bdf65edad99c3a66f58e97f1f55485e39
SHA512 268b7b35f2a115f7c59a3f44b68635df4ea70c12f86bfef1eb634029bf4ad94d69a876bf00a0bd90ea550c09687aab791fd126c01a15bda385fb5fcda68d8e4b
SSDEEP 6144:KxF13S8ifqRE07EXnUwP9Q5ToXK/gg81xR+ImGhH5LsC5pO7us2XI1/orxf:EifsExXnjQ5To6nSxMgH5LP5pkOY/+f
TLSH
T126D43C23A1C42A97299152B2B73624D3E88D105DF641D2CDA4EEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\ru.pak
Size 1021KB
SHA256 9b94d54d9f6eec8c33b6eeec7d73b0f927c19ca648af5cee688b0a544b43c2f9
MD5 8dc9f7197ffc07989fc3107ac2f81d97
SHA1 0f5bde3b920ed06b872d4e3bc922c81e18c29338
SHA512 c191aed6c9b1c0e4705f017e44e6f3732d6cc34e933c37f2041b24b233a2db5bdfe90aae0fe708f5ed808d304aa78883e8d732533f1340dfa605ebccce5fc3e3
SSDEEP 12288:5uqqfQeRo4YwyspxzJ9hF1WfaWNXp6HzW/oqSvusEzDmxsXe3YHWO3j/xTwXN2hh:5sC45MjDX
TLSH
T13C258660669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35219A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\sk.pak
Size 641KB
SHA256 e0babf276d1ed1048a0078d6aab2a2638a21046cbb9e9a6bb815e649dc9b9004
MD5 89398df4ea8e81b40c9641a4c1fe51ae
SHA1 f0162754d1cafe4d9b2477e0358ba39521cb9ff4
SHA512 86276ad0e8eda30914e4be210dc9f4b2c3b3c04e38058ab09cbe50a9c3ea2d94d5ead47de70e78a39ce28c91e78da7071f8bf425790f070e4acb5d6ec2840bee
SSDEEP 12288:F/2UhkFttAuiNiOhj50nAcYEAsfpTjsxt9/j:Fu5ziv5cYEqthj
TLSH
T13BE44D3FDFE6181E8E8D0148EFEA7110F97E8650864EB4A5940F374714E26EDCAB8E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\sl.pak
Size 614KB
SHA256 0491d3086b5f38cddf505d8944e30892fb9f39445aa49352e5883933ff408fbc
MD5 e1006f2c15042e296cfe5e2dd172ad7e
SHA1 c422bc665d819ec7461c6fc0b95ee19d844e35bd
SHA512 12c5a8af62c5fd4ad814e1df551687d76c7c005a5ef27ac390f883e8bbc2586d57248e77e54bce98f69ab3629f3429ea3fcba54ef875c4f2ad29d757d87bc537
SSDEEP 12288:CUg1pNcB2giyMXp5J/HH2WOq86/i/fzBJqc:5IpIMXp5J/HHni/fzBv
TLSH
T141D43C39BAA79E0F0C9AB2CBFEA206007FDC044CD256A661EC4F337D5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\sr.pak
Size 948KB
SHA256 c8858ea4ff643495f2f6ed989ede43f5a004b4b397f726fc776ff1ce1a9c0393
MD5 ff67f45e031d1a2567fa037741271738
SHA1 c2acc94aae19f824cd4656a5cdde843eadd8c2e4
SHA512 308edb72bb959b0738dfb104c33541cd7197f7633e2a373bc07ba168f2bc57304f0c614db790b71cfa6efe6e83c142d08614b7c9ef1ab8dbe753ed0bbea259a2
SSDEEP 12288:6oTpaw7BwLWIVy/S5daVRji4VZ0svV5YjuJXCkxQiT37TMcVU/k/1:bMo8Ja5TCda
TLSH
T1452557A19B9E64DB0901F41BD808BE493DAF41FE3FAB975211601DBD34E10B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\sv.pak
Size 551KB
SHA256 1dfad20ec1b9111dc812b2caf6bb47dd757d7e38bd6bdd7814d32b16d0f60bbd
MD5 26eedf5c246e633fabca5a298cbe8d52
SHA1 ac527a02c9fceb55db2640ce60904019037c8d2a
SHA512 3043678e92c44f4be82cb525820faae52d1c9a19df96f19ea3ed11a28ac78059a7d61878035dc30003c1377953c00226344d460471a066eeb7f958c2e7dfd0a5
SSDEEP 6144:hnrNgFVvOw9aUwRSN1xh2xIybl8NmLpvRFcz5RtGuA+SF4FkFMhYSOa35ilpGiT4:hnUT9T9hs45RiTkLl
TLSH
T192C42D038A10F526FB72134DB608115B0AEDE25CE7E2958EB8D9883DAD8BD5845FF347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\sw.pak
Size 581KB
SHA256 7306fa5c79d8c929d30672b4346b7599eb687b7d1ba0380dc89e300fe9991481
MD5 82a55d98f34903c3e54e5faa02201ed5
SHA1 31aa90305bac189db6cefc5f63b2058da974fe60
SHA512 fb971f7d14c7ace97048c5ae0e85b4d6a663ee7791576d508ec64d9a9682cfab06f799b0aa724b43b01779a8e1bda3967efa2166d8f4410785a5710da3ebd425
SSDEEP 12288:DE2w78DxGs2qFs5bmedqkGjRdNl5ObQh49XhoLmGPgaFsybyjNUixmaB1Ypgqj66:D0Ein59WL
TLSH
T112C4D6629871D0191233618603DDFF732BDCED5C2A2B29935A46BF0F218F58C57ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\ta.pak
Size 1.5MB
SHA256 9f1288b32442c0130a606a392a40fa0be7c853e079d3ae956cf6d5fe06beeb61
MD5 637a7810c8090b28658bd7e9566b47d5
SHA1 fc58658f2304d6ab200c1c4f816a2e2af4bab21b
SHA512 e7be1a22fba53396ac6e90efa61905914b367efa8ce7f71fb76ade2d0d4e65f81e4176af7a3459e864a8f89fb8834dc7697b1d5162988f206e25fef984fa199b
SSDEEP 6144:PqeTlUUF5Hg+NxEtJAGbpEJ55qRtRddtm1vYpiMy3:P1lUUXEDAGyJ55q9tm1vYpiMy3
TLSH
T1C1650CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\te.pak
Size 1.4MB
SHA256 782e066b6f92b26b710841fee351f7bf925eb09387f322b67b655042f82db2b6
MD5 75441fee17b91785232ab4bd4001b4d0
SHA1 9703044c3ec206c34ca08b2b557b30477f7af73b
SHA512 d0a4bacf408df339fe93d83fa8abb33af527398a43d3a518bd7ec6d997db2bc45fb3dbdff5945c2ebe57e5388cf08b637579befc1fe3754982de51a23b8c41bd
SSDEEP 12288:UGmhinDULbb7McKNMy5z8PF602ngIC8ymoRRT5Bb8C52C5W1s6Uu3p1FPnf1ogCW:DZnDU2R5nacPf
TLSH
T1D76591023A6AD310DAE60273752CF66C49781B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\th.pak
Size 1.1MB
SHA256 ea5376065fe5b3f6cdc16fa6eb05c3f0fbad89249f281a16702295790d3a1164
MD5 14efc00e2ccd277aec1ecdc85556a58e
SHA1 f1cbe89eba4f17f5f2af24a0e554f4e079dbea9f
SHA512 475f283dad4de8bbd481420734b9a7809128cea60ee29a99e49d1c3fea1ea33c6662b5592c467adec0e938921b7e05a231999acb567ee68ad762eecc86bcbf50
SSDEEP 12288:Bp9Jv2bN9LyZYAVzYLXhOs9UlkJUsrPsO5eXe1M+SyvH1qsG5UAjdLL3f6j8lRU0:zR5Hsm
TLSH
T162453AB37247DDD479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\tr.pak
Size 592KB
SHA256 800a8d5e32d65009a28af6b53dbfad33468edf0ce28e8e268e97a15ab72ede61
MD5 025cc27b42ce15895b1429134b12e513
SHA1 3fb0b67d2576110749b5d1b49714b3bf2db9bcaa
SHA512 0c4b7c1fe33dad6ccf09e15a876381b5d1e830542d81f915a0497a9fc3bcfe3d4128b54b9a4f9a35a3b51c069d36e9be6696db58630ce493abf6926e6c8d9b4f
SSDEEP 12288:TXCqM2oZ8DHb17HzNsgNDPfZFWf69d6kS5MF4o:jC723HZX6kS504o
TLSH
T19AD4FA8178EF281C8BB9278FD6E90666F89F0766B331F5469B1A8636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\uk.pak
Size 1.0MB
SHA256 b175a0f1a457fc4b07843b72a92446d8d1807c7c8647a85277b5b3076002f1ec
MD5 906d807bf8db494495356138cbbed064
SHA1 09c05580be0fd8e55ff635969ff4edf29d0a9ecf
SHA512 184ca4ad47728897c53de9b10bda235e447986d811cdd463d7ca89ecdd1a8db8bbf6696dfe850be0465b758cdc033516221aa4e974928ede055c302fda8836d5
SSDEEP 12288:ntbfIIUINIH+wA8/sSr+1hZ3PStzNynImNPg5YlPAfe8LIyueLNiXEBqDK1a:tb6205Y8U
TLSH
T1BA25A8A1AA9D54DF0106F05BE94C7A0D7DA701FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\ur.pak
Size 892KB
SHA256 76a8887bbce0160a65aa8859bc084d9286a189e4aa15f2f8f3a0d8cb1fdca780
MD5 063502c8b001c15e80323c712d304192
SHA1 6159c3f8d3f1fb38229b04802aa0121900717b38
SHA512 15da9b3fbb5a236300325f9f5185b467189ef9b630eb7b2f8d1d16c4c021c7d47185610da60099dfc55e3f9776de4d01c04a38d56a2992ac2063a1a0ac72f69c
SSDEEP 12288:9ooPr8PMV54qtdQht9fyf91z5edYE8jGnOEirhQYrQEYjwadcJKwUDupco/9Njjw:7p5vGeY
TLSH
T16915FFD2E6BC96B24A21D92780D33C34CB635F13D34BF285E56246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\vi.pak
Size 703KB
SHA256 be9334cb1c39f49e26686e464448519a59b4785ed48d28774556a22ff5e4024b
MD5 65de54bbcdb5d9ad8858a381a448537d
SHA1 b8fd3a991dd5b725d743191dff8a15c3404d8825
SHA512 5011821eb5d447e00da6c3dd7f2fb7106e9248635967d84d09dd4f3b3c2bd867280194edb1f6cd3f216bbd2c9c49300a1d6488bf1fb38615cb07866df11e332a
SSDEEP 12288:Ug35+cqIMoEbtV9G6an40aT0F6eYbMdpV9v5a8imvcXj8lj6ziDHfbrv10:b+cqHVTa40jFDKG5a8JvcIljMiDTrv10
TLSH
T127E4851217E1302680AC553EC6CE540D6FCAE42FF7C1CFE56FE429747A221A45F25AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\zh-CN.pak
Size 504KB
SHA256 97c67c91e4986014c3acb6304fbc38371b896457ecb64bf232493cddeece0e1d
MD5 d01d32bf8afd0005634c906e906e1f5f
SHA1 b3ff37f9ef2841f709000a6e356ea499cd9368a8
SHA512 b10e7574a308736e08ab1c8cc74fb28f23db21478b6fd4c507837a7c518cf78750f79d258f664b93584873fe9263a20b983df8127901afdfbaf41d6413baaaa3
SSDEEP 6144:W2Af7T4J+ZqiCYQcS4fn+7XrsertBUt59gIAni3UYX2IQQNvzM7lk:LK7IcqiqcS8nirsertKt5SpikYTQOr
TLSH
T172B47DA911F9BDEC004650E03B29613D7C407207F66BAF75AED248DD2AA2FAD0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\locales\zh-TW.pak
Size 498KB
SHA256 76be4f089471f67a275dc5335441562c8a1ce7d924a1a3bc746d206792fd3faf
MD5 2899de744f93e96f0cf343bcc939c085
SHA1 bc67a8768f2ea502f0aa56c5cc1585f1463cd336
SHA512 677e074ee868b00e3e305903e5c14d84d72fbc8f011d1fc84be830ea1374eb00fab4e09caa398f0401d89340bacb91441349eb2d1e0069bb73d5a1bb66cc5303
SSDEEP 6144:jEzZFuu3VJRzrbra2JuZ0gSS5KnlVHvD0iSU62s9m5Tb:YeuVzTk0gSS54lVH+U3
TLSH
T119B46DA608FFDAEF0901F884B7CD523EBC9B386CDD777636FC8518D42E66A640A51046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\resources.pak
Size 5.8MB
SHA256 d1d9992e4e28a3a6add0a2652194685cae481a3ba846a89a030199a5d0bdc04f
MD5 285e571e01bfa2c1bb1ff8167247e37b
SHA1 20f26d3213cebd7cb0d397d662b784729f10387d
SHA512 f7cfbe6220db5620451e55b441c9b1194c9779d4ffb1c724279f2492bcdbd8d02c7b098901ae7c1e225b1c860f6af3301155cfefff1fbe0ba229e0ac5b381390
SSDEEP 98304:sn8Xa8NPOXD1VsZRwwQLIMPXjNbrjrwrw5TJB2zfQzQz8oaUUQz8hB0Pxtq+GrVd:PKmWXD1/wQZbnkrw7MfQQQFPc8X03VGL
TLSH
T19A5633B27B46089FF51C83BD00AAC2B1426CE9266554616F11CD7220BE36A2FDFD587F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\resources\icon.ico
Size 158KB
SHA256 c2e700a317422caea37d20dee0bf0b4e54788bb6a31d6851a1220731022fb8aa
MD5 7c06b993fdc32ca601143e4e4975e360
SHA1 128dcc0b112f03c2435cd19f1fc02e1a4ed6baa9
SHA512 a14b11642ec2d7f407a40008aba9b0501b40c83bba2e09a2397e48d82f1f4790e0c048794e161a18c4edb0520f2b215d3f878a6c3163c15df60b609beb7449c2
SSDEEP 3072:7+PFmEXbr2j+AQzAAYT6mPNQzjsr5AeXAC/O4qcykkszSjmoDGeUGKXuRdLXg2W:6PFmQbud5/PNQMrtFYk5zpoD8bX4dLZW
TLSH
T181F31271E8D975A9CDB590770F8204E2A83F003351A222DD52B5A8DC61F27B5FB0E6B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.png

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\resources\icon.png
Size 1.2MB
SHA256 12453b88409f367934b0a5680ed7aa197d17ab9991255b2bd67f939a3130b004
MD5 c1ff9de6c9f7956379776d6998613b3c
SHA1 f855249b3642fc8284b1b85794a9d53d6023c8d3
SHA512 43c8dbe43ca07a211cb8988ae447cc5db231564a31c81b5dc388280afcda113eea652fdb4310d2a259d9bea34683d6f9c2084a7c12ea30963fa90d32d5ae2d4a
SSDEEP 24576:rcj6BAMsdwiVlMrTJRjM5IGASzic5W7atLbAhmop/Kwj8wITxMPBDH:rcj6iMsuGlMfPjMCGNr564LbAkoUcITO
TLSH
T19D451214986744B312C2ACE465E54D03FE68D2EFE3480EAF91480C7D86CCD666AFA777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\snapshot_blob.bin
Size 328KB
SHA256 f0a6ce4b00a25b303d6de9094cd33cf915d9117e0ee0be05042d7835d47daeb7
MD5 67110f96279d74cfe0c5ad4b4915d101
SHA1 f70ef4a7120510c1a7384d93e084ec8ea65cb326
SHA512 2cfadca310fe0be37f04058435b3a3f4ab84f96e9f41041c261998d9bb7c3a6aa461e172dba9e0b0d5e0d6eab6a07e7bd18cabfbd9d96c5bd31a3493f0ef8b44
SSDEEP 3072:i6mbRKqQbt+xmR19fnOrJkGKnpNd4sOkMjg7Je3:dmbRLSt+y3YwdZOv8K
TLSH
T16B64BC46B70ACB36CA882271CDF9AB8A3A74B1CD9FC6421B7549437F387163C092579D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\v8_context_snapshot.bin
Size 695KB
SHA256 6370b1fba2ff33f9f279e9d308450bc8e06987bc6c0647d926ce70e8b5e76dd4
MD5 7a10a1a95219111303de82baff73f491
SHA1 5d8135015d40ee6a0fe7385fb5931ede67ece742
SHA512 6d7a0d67d7c634b9ab19b337bd24980c4a78248290d38b5af56805a5c2494a8af05d8035f170a4c593639a8c11e7374289ae1989f05eaded8a379440e004dcc7
SSDEEP 6144:Cc1tbR7t+y3pwdZOXk/V2uL/xlTGOEy+aG2g9iOaybaO:d1t8gk/V5xNGeGNOybaO
TLSH
T14AE49496F70EDF27CBCC45B5DEF59A473CB4F08EAF8B811B210817BD6035A680A25259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 d61ad23a0a6d3247db5bccc1e13d00be89ee6804cce17cf9dcb156705441fba4
MD5 3c52c8865a1483fbeed9f692d6297fae
SHA1 379ca6a447c9a48a2e4ec0fbc138303b080e3c35
SHA512 56ebc5d4c14c9a6d4e1e1bef16aae7584ca32291c22fcbbd9922ceaa571b31c876164cb53158bf7dc5a3724624e35eb79e70a06606d1d170916cf34da7cabb28
SSDEEP 49152:UEhLYagK1ubn6vRClpqPO/NeitQj6LSnYClUmJY3I8fhtWgq12bGlQZ4jOQUPVdk:U+LDgKwtk2kJe4V
TLSH
T142463903F28680E9F05DD679875BA622F671BC811B62B6DF52A01F192E37FE06739701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\7z-out\vulkan-1.dll
Size 886KB
SHA256 3871c971466dc0c38e69a857a1d572b5d94e12f54b12415335cb83638680d508
MD5 b549b5b7829fabe2746c79b2790207ea
SHA1 42f8efb093dee829b20ffc87eec48dab63bfbbfa
SHA512 abbf36926443eb355bf68d85f4cc01b6ee29c476206d4c74ff2f52ab9d33593b0f86824ab3a09490999059c392a4119a50f41e1db617883a2bb7770255f276c3
SSDEEP 24576:SIaCHa0jpNtRZLAXb2F8Kx6Z5WSDYsHS6g3P0zAk7m7:da+/jpDRdAXE16Z5WSDYsHS6g3P0zAkK
TLSH
T1FA154B22E6948969D47AD034C9C28707C9B174922326B9CF02A81714BF6FFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk290B.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Network\Network Persistent State
Size 305B
SHA256 0987cd866192e435de40e790a7c96905c699b0c319f3b0b3a7169a343e4bf3d2
MD5 55455579c1e7bb36e4f90b5c47ef3e3e
SHA1 3cb930452861f05bfedf87eb38f7bd1d61898213
SHA512 fe8f2856ed1fc0c778757a6906c0b7fd83bd08827f7c09b4bf22762ae7c0044a084cff6381907a381a498ff8423818e8d0bb11334967beaee7f330c6d42a88aa
TLSH
T1AAE07D52C2D498BD074183F51E286923C3BE045952281C97C5E87B5E43A1879450084E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/3756-1515-0x000001F499C80000-0x000001F499C81000-memory.dmp

Download

memory/3756-1504-0x000001F499C80000-0x000001F499C81000-memory.dmp

Download

memory/3756-1506-0x000001F499C80000-0x000001F499C81000-memory.dmp

Download

memory/3756-1513-0x000001F499C80000-0x000001F499C81000-memory.dmp

Download

memory/3756-1512-0x000001F499C80000-0x000001F499C81000-memory.dmp

Download

memory/3756-1514-0x000001F499C80000-0x000001F499C81000-memory.dmp

Download

memory/3756-1511-0x000001F499C80000-0x000001F499C81000-memory.dmp

Download

memory/3756-1510-0x000001F499C80000-0x000001F499C81000-memory.dmp

Download

memory/4208-445-0x00000156C2420000-0x00000156C2442000-memory.dmp

Download