hxxps://cdn[.]discordapp[.]com/attachments/1223902630489620520/1536232685758976061/shadowvale_8[.]2[.]0[.]zip?ex=6a7aa7ae&is=6a79562e&hm=64b200d711bffd7866f4b9f33b7007ccf2a97a54513ef67af0e5d332457e6f42&

Analysis

user interaction
yes
max time kernel
169s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1223902630489620520/1536232685758976061/shadowvale_8.2.0.zip?ex=6a7aa7ae&is=6a79562e&hm=64b200d711bffd7866f4b9f33b7007ccf2a97a54513ef67af0e5d332457e6f42&
Sample260810-fgca4seb63

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
301	4024	OWinstaller.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	OWinstaller.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
64	CurseForge Windows - Installer.exe
4024	OWinstaller.exe
5668	ow-electron-setup.exe

Loads dropped DLL 16 IoCs

pid	Process
64	CurseForge Windows - Installer.exe
64	CurseForge Windows - Installer.exe
64	CurseForge Windows - Installer.exe
64	CurseForge Windows - Installer.exe
64	CurseForge Windows - Installer.exe
4024	OWinstaller.exe
4024	OWinstaller.exe
4024	OWinstaller.exe
4024	OWinstaller.exe
4024	OWinstaller.exe
5668	ow-electron-setup.exe
5668	ow-electron-setup.exe
5668	ow-electron-setup.exe
5668	ow-electron-setup.exe
5668	ow-electron-setup.exe
5668	ow-electron-setup.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OWinstaller.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
5732	powershell.exe
2360	powershell.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe

Drops file in Program Files directory 63 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_189915780\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_189915780\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_984377387\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_761252662\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_984377387\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_984377387\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_761252662\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_189915780\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-nl.hyb	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5688	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CurseForge Windows - Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ow-electron-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4400	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DxDiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DxDiag.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308110254999874"	chrome.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\System32\\dxdiagn.dll"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	DxDiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{A841511A-F399-40EF-B8D4-801F219B01E7}	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	DxDiag.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1996	chrome.exe
1996	chrome.exe
4024	OWinstaller.exe
4024	OWinstaller.exe
4644	DxDiag.exe
4644	DxDiag.exe
1996	chrome.exe
1996	chrome.exe
3036	chrome.exe
3036	chrome.exe
5132	msedgewebview2.exe
5132	msedgewebview2.exe
5688	powershell.exe
5688	powershell.exe
5688	powershell.exe
2360	powershell.exe
2360	powershell.exe
2360	powershell.exe
5668	ow-electron-setup.exe
5668	ow-electron-setup.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
4584	msedgewebview2.exe
4584	msedgewebview2.exe
4584	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeDebugPrivilege	4024	OWinstaller.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe
1996	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4024	OWinstaller.exe
4644	DxDiag.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 4548	1996	chrome.exe	86
PID 1996 wrote to memory of 3700	1996	chrome.exe	88
PID 1996 wrote to memory of 4400	1996	chrome.exe	87
PID 1996 wrote to memory of 3700	1996	chrome.exe	88
PID 1996 wrote to memory of 3512	1996	chrome.exe	90
PID 1996 wrote to memory of 3512	1996	chrome.exe	90
PID 1996 wrote to memory of 1056	1996	chrome.exe	91
PID 1996 wrote to memory of 4368	1996	chrome.exe	92
PID 1996 wrote to memory of 1056	1996	chrome.exe	91
PID 1996 wrote to memory of 4368	1996	chrome.exe	92
PID 1996 wrote to memory of 2940	1996	chrome.exe	93
PID 1996 wrote to memory of 2940	1996	chrome.exe	93
PID 1996 wrote to memory of 1240	1996	chrome.exe	94
PID 1996 wrote to memory of 2220	1996	chrome.exe	97
PID 1996 wrote to memory of 4376	1996	chrome.exe	98
PID 1996 wrote to memory of 4376	1996	chrome.exe	98
PID 1996 wrote to memory of 4528	1996	chrome.exe	99
PID 1996 wrote to memory of 4528	1996	chrome.exe	99
PID 1996 wrote to memory of 1800	1996	chrome.exe	101
PID 1996 wrote to memory of 1800	1996	chrome.exe	101
PID 1996 wrote to memory of 1932	1996	chrome.exe	102
PID 1996 wrote to memory of 1932	1996	chrome.exe	102
PID 1996 wrote to memory of 1148	1996	chrome.exe	103
PID 1996 wrote to memory of 1148	1996	chrome.exe	103
PID 1996 wrote to memory of 1280	1996	chrome.exe	104
PID 1996 wrote to memory of 64	1996	chrome.exe	105
PID 64 wrote to memory of 4024	64	CurseForge Windows - Installer.exe	107
PID 4024 wrote to memory of 4644	4024	OWinstaller.exe	109
PID 1996 wrote to memory of 4660	1996	chrome.exe	110
PID 1996 wrote to memory of 1272	1996	chrome.exe	111
PID 1996 wrote to memory of 1476	1996	chrome.exe	112
PID 4024 wrote to memory of 4584	4024	OWinstaller.exe	113
PID 4584 wrote to memory of 3648	4584	msedgewebview2.exe	114
PID 4584 wrote to memory of 4768	4584	msedgewebview2.exe	115
PID 4584 wrote to memory of 4768	4584	msedgewebview2.exe	115
PID 4584 wrote to memory of 4768	4584	msedgewebview2.exe	115
PID 4584 wrote to memory of 5112	4584	msedgewebview2.exe	116
PID 4584 wrote to memory of 984	4584	msedgewebview2.exe	117
PID 4584 wrote to memory of 984	4584	msedgewebview2.exe	117
PID 4584 wrote to memory of 5352	4584	msedgewebview2.exe	118
PID 4584 wrote to memory of 5352	4584	msedgewebview2.exe	118
PID 4584 wrote to memory of 5352	4584	msedgewebview2.exe	118
PID 4584 wrote to memory of 5880	4584	msedgewebview2.exe	119
PID 4584 wrote to memory of 5880	4584	msedgewebview2.exe	119
PID 4584 wrote to memory of 5880	4584	msedgewebview2.exe	119
PID 4584 wrote to memory of 5980	4584	msedgewebview2.exe	120
PID 4584 wrote to memory of 5980	4584	msedgewebview2.exe	120
PID 4584 wrote to memory of 5980	4584	msedgewebview2.exe	120
PID 4584 wrote to memory of 5432	4584	msedgewebview2.exe	131
PID 4584 wrote to memory of 5432	4584	msedgewebview2.exe	131
PID 4584 wrote to memory of 5640	4584	msedgewebview2.exe	132
PID 4584 wrote to memory of 5640	4584	msedgewebview2.exe	132
PID 1996 wrote to memory of 3036	1996	chrome.exe	133
PID 4584 wrote to memory of 3660	4584	msedgewebview2.exe	134
PID 4584 wrote to memory of 3660	4584	msedgewebview2.exe	134
PID 4584 wrote to memory of 5132	4584	msedgewebview2.exe	135
PID 4024 wrote to memory of 5668	4024	OWinstaller.exe	136
PID 5668 wrote to memory of 5688	5668	ow-electron-setup.exe	137
PID 5668 wrote to memory of 2360	5668	ow-electron-setup.exe	139
PID 4584 wrote to memory of 2528	4584	msedgewebview2.exe	141
PID 4584 wrote to memory of 2528	4584	msedgewebview2.exe	141
PID 5668 wrote to memory of 5732	5668	ow-electron-setup.exe	142

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1223902630489620520/1536232685758976061/shadowvale_8.2.0.zip?ex=6a7aa7ae&is=6a79562e&hm=64b200d711bffd7866f4b9f33b7007ccf2a97a54513ef67af0e5d332457e6f42&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb6d14c728,0x7ffb6d14c734,0x7ffb6d14c740
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,396019462959507956,6706410773175050332,524288 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,6057172412045633410,1547445121316655263,262144 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,12646146536292138764,3264239563250034943,524288 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,5068805471336728589,9009223953996101715,2097152 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,9689992874714803527,6559733226797844871,2097152 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,2438895274411947322,9901447175405762046,2097152 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:2
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,14786361268449664495,11735836946332235705,524288 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5280,i,11826034553438437440,5748131165463971750,524288 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5692,i,17044284981270616590,6414771943737201627,2097152 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5888,i,8167239743904943018,8068315887891109304,2097152 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5464,i,195603013196265044,14917841764503888172,2097152 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6464,i,17224387075274523323,7351851380949471919,2097152 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3372,i,611289669889166229,9904501851651991906,2097152 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,7322407621018917308,16977379735306968885,524288 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:1280
- C:\Users\Admin\Downloads\CurseForge Windows - Installer.exe
  "C:\Users\Admin\Downloads\CurseForge Windows - Installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe" Sel=0&Extension=cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm&Name=CurseForge%20Windows&UtmTerm=eyJkb21haW4iOiJjZi13ZWIifQ%3D%3D&Referer=www.curseforge.com&Browser=chrome -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm -AllowWindowsInsider --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --silent-setup --app-name="Curseforge" --auto-close -exepath C:\Users\Admin\Downloads\CurseForge Windows - Installer.exe
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Windows\System32\DxDiag.exe
      "C:\Windows\System32\DxDiag.exe" /xC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.xml
      4⤵
      Drops file in System32 directory
      Checks SCSI registry key(s)
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4644
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --high-dpi-support=1 --mojo-named-platform-channel-pipe=4024.3044.1428621883665206950
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4584
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x120,0x7ffb51b7b078,0x7ffb51b7b084,0x7ffb51b7b090
        5⤵
        
        PID:3648
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,13583401686657593427,7088809596530601132,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
        5⤵
        
        PID:4768
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,13583401686657593427,7088809596530601132,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
        5⤵
        
        PID:5112
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2064,i,13583401686657593427,7088809596530601132,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
        5⤵
        
        PID:984
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3692,i,13583401686657593427,7088809596530601132,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
        5⤵
        
        PID:5352
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3932,i,13583401686657593427,7088809596530601132,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
        5⤵
        
        PID:5880
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4320,i,13583401686657593427,7088809596530601132,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
        5⤵
        
        PID:5980
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1048,i,13583401686657593427,7088809596530601132,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4972,i,13583401686657593427,7088809596530601132,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
        5⤵
        
        PID:5640
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4984,i,13583401686657593427,7088809596530601132,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
        5⤵
        
        PID:3660
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5012,i,13583401686657593427,7088809596530601132,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4992,i,13583401686657593427,7088809596530601132,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
        5⤵
        
        PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\ow-electron-setup.exe
      "C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\ow-electron-setup.exe" /S --force-run /d="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5668
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
        5⤵
        Hide Artifacts: Ignore Process Interrupts
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5688
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2360
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\CurseForge Windows', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,2448915391093886493,14708591984753065658,524288 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,13971734606134832104,13302840172229688256,524288 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,5299414703879900565,789203130727461814,524288 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4796,i,7481093319181631445,17317285018653065832,262144 --field-trial-handle=2004,i,12362638769166433844,3339234772437681476,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4584_189915780\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4584_189915780\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4584_1906974133\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4584_761252662\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4584_984377387\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 efcb16065767c0535b2fd62750f4c8e17ffa6e530179ceea8d082841e36cb3d3
MD5 129b2efffcabb263532a3d237ab7b622
SHA1 8c140355d6d2d9abbd5152b33415efed799c62db
SHA512 e360deaf8f95a9426eb474d33b921dd7345b4c94e248da95834c4d0ac8d3e120fa91dd6b9e09a4d4f40d3a68e2432e11de54c2562e40c2246eac10339929374c
TLSH
T11CE02BE9CC21AC770DFD1B6860100645E74003563F90C90F3A3ED1088FB5A3A456A82C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c651a83c8185f74727bcd0a82c0b1a2803c9ce35c9c1b03347992c5e902f7ec5
MD5 bbd42383ad0fe16301dc179c74d9a9d2
SHA1 5249cde0e94ea328f93e8223759aa46f5c52bc09
SHA512 51a7048b55330f06cc47fb04c1115a1a24d8618dd867935ce82a43d51109663e2bd67a9a13b84cfbf01ddfd96965a70162ecb9ae0b23902e285bbd46cd0004a2
TLSH
T1EC210158B09CA90DDBFCA3B394F50D64B7201D6A52524E0FDA507DA7E0236B91C718D8
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 5a2498a8f406182108138a9b4b8b0242b5f21a667b74930e2c64dcbab60d899a
MD5 eea29434f8a67cc11f46b54c23783830
SHA1 7d3a71dc9bf8b7cd0b05fc9c4490c1a998e35ce0
SHA512 d536909eafb3d951d5b24aa09017a493fe575a2d0fc77c83b3cbf9e0445feafff61f6ba2374cb01044c877bea43628119742811d053341e5a027111b5366e931
SSDEEP 384:DZQbZ9lYGUtxe+LgZaIB1LvYyKBIgqNkN1ypAMoKW4PneKVJZgOMhBUv6SJs4Kci:KbZg9
TLSH
T172425CF787E4C63DC91152F4A7142E1ECE2A092852693C2FC5D9EF5BA3F24B2E14065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eebb8d6dfe5a89b04695f4a69648491234180813ec2653df154cffcfd9533403
MD5 85005ed622f499c5ba745e78bb29a7e1
SHA1 f8d78248fef17ca68eab073e7590391c8b2e9e02
SHA512 4973721cab798acdc6c82a19e586c0b9de9105795129fbe4e42991326ccb8ee9ead548ab94ff485f6d40b27cab9bf2355cc1eec6e4e911b46719c483219f4537
SSDEEP 192:2RPcBzkIt9gn9Pm/v7chAPRp2qFBW9BHsb+WNnEL4XE2HZFQRGBHVyIsnAUge:2RPmz3AwXw8XlerwQ725bhe
TLSH
T11C52D62EEA54297B4DDAD21AF9267B57E7F5103224942EC4E6FC892C14E76CC321B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9a130d14e2ed20a7c6820b806805b1acce74ab49a0ace75043d356331c78ef3a
MD5 60924214ec106eb6b50a5cac5a6b6d9b
SHA1 85ec4b3598d2a980a319e1cc1789c4fe3c98ad3d
SHA512 b738d3b383416a84f005cded82deb9c90400b3b4fd4896a405831c6caa1e7c31feca9b2128d3ca16c98523729eeac0605d99fc8ec42b820050896d3d53b5e33e
SSDEEP 192:2RPcBzkFt9gn9Pmgv7chQPRp6qZhYkypOW9BHsb+WN6LpsEL4XE2AZFQRGaHVyI4:2RPmzOAw8w8X5krwq72IAhE
TLSH
T12652D61FEA54297B5DEAD229F815BB57E7F5102224A42EC4E6FCC92C14E76CC321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 380c8b708262d4a5bb1c939d2d58502f16106df54af2424e9423f032d741c762
MD5 e76a485c6382a6ec2d7d93a8f6e16be5
SHA1 41b28fb33fd0dce3127044a2d5a45f5cc30f7628
SHA512 7420e193a2b6c89135f13c7c06e4846b70c673be4859a35749c3a1f26080315281b9ed74f0e4fbed658f793cf85d880ba0b325d0400147fc7f80db37927962e2
SSDEEP 192:2RPcBzkFt9gn9PmFv7chAPRp2qZhYkypOW9BHsb+WN6LpsEL4XE2HZFQRGBHVyIy:2RPmzOAw1w8Xlkrwq725bhe
TLSH
T1DB52D72EEA64297B4DEED22AF9157B17E7F5102224942ED4E6FCC92C14E76CC321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 18daf8a2edd16a8a23016b0ed61f75b3f50390bb3fddb1b9cfebf672d1762c61
MD5 3b4faedd29f8d0ca483c7f1c02b7ddde
SHA1 16469fa7decebbe36956f8973b5d7aada1acf0ba
SHA512 7a7a341bda188b3f1d9b23d1471abaf63078f84876862f52589d10069d80ae59313f2ae478e5c388c07ef6d343cea3500cba56f8e98e7fc77123fdb953dcfda6
SSDEEP 192:2RPcBzkFt9gn9PmVv7chAPRp2qZhYkypOW9BHsb+WN6LpsEL4XE2cZFQRGcHVyI4:2RPmzOAwlw8Xlkrwq728ShE
TLSH
T1B352E62EEA54297B5DEAD22AF9167B17E7F5102224942EC4E7FCC92C14E76CC321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7c589beb257283bf8f7c8d63fcabe970575b037954a4509b796dc7e6e45713fa
MD5 b83b751972f680ab56b6b042d93a933e
SHA1 cf875ee5eef7dfb8955760f7e85de1abb0a87d04
SHA512 8c3f540e77a0a3a3479580da2bc9b1619f2d1ef8ec2469f746a1b47428c0bef92665b645264a81e24cb840cb4c596e71692494c50bb6ce5446065c1be8e8a1c8
TLSH
T1D0B0128180025102C41212F82552348C7324DF20D61E170A43E4AD238C351A181140D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aca6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58aca6.TMP
Size 96B
SHA256 e935c9397928d75c8ff2cecbbe119b71ee5cd1d5c281f482712a9b94d4ab9265
MD5 84b061fd913d966d203c1faf7bf397db
SHA1 7d489029925e096e1d2813aa442a8e66dfd5322d
SHA512 26f27604fc7b16953a55f3b8f317e4a9162f3b8b30c388a640ece1be1ba37fe5ba5ed36dbe9b02ddcb9769d0db5870ba0ef47e941a67156bcc367d692b969da8
TLSH
T14AB00265C1466212C14203B069E595D97260DF27C603131A93F11A67ED66E6687256B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 4174c187e6460a266b404551b2d40aa3393cf69dd7bf57aac3176b30936e3832
MD5 4a0623a06112fcaded2b63ab555cdb33
SHA1 eb4bc831c5e5a94e273385781dc15cc9fe4488cd
SHA512 ce6cf19374c3e8ba6584213981075dcbaf0a8fadeda5f55300e64ef91a1590a23c891ea5986a3dd9f2ff45284f386516efaabdc3c40374bf7f8d25ee68336145
TLSH
T18EB024051004DC45CF0707F154C3C4C071131C4005C3F0C150D05074441535403104D3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2424fc40073ea6728298d0b32815459ffecb27d11db645ff3330de5e0a2a549f
MD5 8ad343dd02face2868b44af18aace45e
SHA1 6f126f435c9c805ee35800644887078953596f03
SHA512 e3f583974876b7f14623faace827fb65d4e799cf7a4fa30f93c7f680140a58475c32ab7c470ffcc4c198ba2eccbf743836527091e89d745cbedccbc4277a1896
SSDEEP 3072:SGFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:7FmUi21rSm8uUVNSlzY/
TLSH
T15DC31300B6E3F8F2EE5930447BEE2A145D6C4D818191C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a1d94268ec7a65ef90c1da1f3b53e98fb6c9032d5f7735697a87f22ce7819c1b
MD5 bb12d2e154204937482ed355bb70291e
SHA1 66d8b1efda5dc50506da3a9150de18fa847db188
SHA512 956de81a6ba77d955e5c591cd031710981cd80453fb780670c286ac715e4418d84b3676173d7ea3930a3b07d47ca25bc99ac07853499a8996b5c4b67caf3faac
SSDEEP 3072:SMFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:LFmUi21rSm8uUVNSlzY/
TLSH
T1C2C31210B9E7F8F2EE9D30447AEE2A159D680D818191C5015773AD419DEF3C72FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b7d56a94bfee97ec25ce13ef8622029d50a7500de55bfe345404bb8daad5c509
MD5 a1965c6dbe79e318684c4dc75b8856d0
SHA1 56e126da4989dcf383604230a48441650612e740
SHA512 b7543e5c93f5ca58cf6db55791818be593c356ef08ee407c301b2cac92f36cf85581d559ff5f1b12c87b3c9101045da8811609a68dfc02177d68e0d79dd6ac40
SSDEEP 3072:SHFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:eFmUi21rSm8uUVNSlzY/
TLSH
T1AAC31200B9E7F8F2EE9D30447AEE2A159D684D818191C90157739D419DEF3C72FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 75ea3a6785a9e176501ff64d76225e83f5061240f173d04b60779d63472c087b
MD5 7c25d65bb3bca8ea9c6464c891ad85f2
SHA1 7bf05b413b11095c356ab3bf19f3206b91dd47e4
SHA512 421142561f653ab068632c1324183ea8dd0211dcba3d3d9a40c567ab8d326bfd670467f210c31f3ab3430d0b93fb57552436fca514a2f51e3b7f9b16cbff7d0f
SSDEEP 3072:SbaFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:maFmUi21rSm8uUVNSlzY/
TLSH
T1A4C31210A9A7B8B3EE9D30447BDE2A148DAC09818291C9015673AD415DEF3C66FAAF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SettingsPageBasic.xml

Path C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml
Size 752B
SHA256 15d0c9875eb315d9d1cdb763ba8ec710772d6e6b37fe88cc35a609314462d945
MD5 89a57003cc3265e64726f621aec0b9d8
SHA1 cd8f56235dd68e64018b516e7f05c4d56f8e854c
SHA512 3408608d1c0b135770a21429db87dcea64b011d706859ceda7720be80134deba16fb15593296de34e152e4b84cda531aa3311b3c1a69cab010a18750c983bf39
TLSH
T10B018F193EC2FC2508B20926B53AB950EF30D61634354CE4F3F4231B29A7136185B369
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\chrome_100_percent.pak
Size 112KB
SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
MD5 e7bbddff3081eeecf7f56e76ce1d48e4
SHA1 eb83b418ad0e8f502f12a339cabc2fef8ec06cb4
SHA512 2caaa851d095d1a641b959cf092a2ce02328298aafdfadafc773eb0a0054054ae54c41574328694f6a37928203509a0c7e38f3beff1f4fd2ded00b5ed5531d85
SSDEEP 3072:z84PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:zRYWFUbGz8LI1TnjQBQCrC
TLSH
T13AB3D0D7B7B0AD7DDA474BB783560170FCB30B2D0682120A5A99E479653AF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_nyn5xk2d.ajn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nyn5xk2d.ajn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\LICENSES.chromium.html
Size 3.6MB
SHA256 7822e44b426109f6a5849e793dc064391e4e2e93143f6267ea05e6ec110ec686
MD5 574178d09f78331ad54e7e6cb3e60a74
SHA1 71c3d48dbaa6db5d4f569c304069205ac56bb835
SHA512 82380dc17084fbe72e8a5adc72a4e78276b776106dcc16cdba27d276fe3b31c550cfe98c11cdf17ac9c8c5ad64bb3691661b44da70407a897ec1c070322cf06b
SSDEEP 12288:Ln/nOeMexnwn3nSnmnNnNnzEZeNlgOQ9RBvj5lE+A/qz/PQiybbCgt9B9UOE6MaX:vCNmjZ6doAjZ6/q
TLSH
T12106942F7F48037706C64262BB8765CAF21E903F3B562A54304CD1681F6BA6583FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\chrome_200_percent.pak
Size 182KB
SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
MD5 1e1744b9410d29e7d1ed28c4f67d6317
SHA1 4f3fcf3db1f8a1eeefd5a4c2f3f2d2b34c094a82
SHA512 10fbcc89ae3251f4c163beea1dd3a53bca239486e1ed7a997e9b04d3a6193266cd96db4a1f8b753942429305ae9ee28b1e9d3fee7e2ddfee847a4db40c8cea93
SSDEEP 3072:dl4J8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:tGQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T13804F1D373B8AD3DDA570B73926610E0FD7A20291EB3110A5A9F98397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\dxcompiler.dll
Size 3.9MB
SHA256 a5bbee39cec6a7a9cd5451d9b5aab08a07649f339662cc8a78e49adc8e19f828
MD5 77dc02b8c7fceffb0ebc8b93afadef7a
SHA1 98c861097e7120266136625e0bd8ada14f0c89fd
SHA512 148f8c5d830e106475d5679f5f1965b37b6a83a2b0f37a39670c2498558b66eb2c9bd43c48ce0d774e546cd52ca0aec8bfcb47f5aa8ddd4447bce47fb789364d
SSDEEP 49152:AJkP/tj0MZwbwRaNHX+3arGuf+CU3CQGWYiVD582ihX6/8Ox7X/1KG2DUFXeRFrl:taOYQx74t+8
TLSH
T1BC161A12738690ACD05AC4B8C7678726CD6830D72F7A78FF85B452212B6BDFC5B39225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 561aa234457eb633cada7ae33efb525dea723f2316f2bd7dedbb37e9d8da2c9f
MD5 5d4f37035a9fcea0f9500a5f312829d2
SHA1 8791784ca26c0519cc58b4762bc7bf2ff5e22265
SHA512 71de0b350eab0c398794342f627ed56d7ecb5e2086954a0d76d50d27845e16df4044fbee4ed8183980ca5d1cb1487f72392ebf3e06feb8e20119aaeedbfb3456
SSDEEP 49152:UESTAZFzTxMIP2uEeLfptJrj0vVJA8ANdZGNxcO6IhgiS9Nol7WtaRRqSorwIaGn:UDaTFEYht8OnZGNxcO6IhgiS9Nol7Wt5
TLSH
T1F4E5AE03F6D650D9D029C57197AB9313F631380A4F2056EF2A804A253FA7FD86E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\icudtl.dat
Size 6.0MB
SHA256 18f23673abfdffb9115bf5ef392e84b474423fd12d83a545247207cbb2094a56
MD5 bdb0b8f6812ea34a1e93560ff79dbaf1
SHA1 0aeaff574854003f55f2555037356297d96b4802
SHA512 0c7a1320cef6ce799f86e6636585c8b61aa725688ed2cd4ff3eb18cb1cbbb6e960789c4754cb439746db6dcc44a3bcf2fd7217351b66ff22c401cc16fb6067bb
SSDEEP 49152:rmthPtkrebBQYWJ/wY6iRddlCHbb7KFnvz0yBy3YFnvz0yBy3eKjGOkIprr0Ph:rwPBQYOo+ddly3uOkG05
TLSH
T1F7566B07E6B78EC7E9F76E30D9F0A177A112BE8D2E238060A5093F336D372554554BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

integrity.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\integrity.dll
Size 13KB
SHA256 2f2de70b5b9a5562aaaff1a4ed3551f929ea2de99f84b527146865d8c9ecd341
MD5 6a8ea8b66f91c01c09264b0d3fd94aff
SHA1 7471ea73934234a01974464fd12708009d611d9b
SHA512 aa8bf888dac79fa6a365533154c9a99f0975bb9f9544fa1c57a39a9ea19dfb3e42fa8027f4269c109fdfbaecafc77679edb04c2f510468a52e0ca536944db892
SSDEEP 192:riwLVt4NyEIYiYF80dmL4pUQaULc8pq8RuZuuB+dT6Wj2bLHFrzS:rZLP4NyEIYi2mL4/y8Riiv2zFrG
TLSH
T16F523CA389905C01DC1B6E70B8C9A936FEB666915AC1C7C7325DC1269B853833FED1F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\libEGL.dll
Size 502KB
SHA256 08b93b57f9a163cdcd04453f96f47c156237c2ec4a5ec2bd9d8d7d5c253e2c7e
MD5 9ad914a77b3fe343e6fd1838c3b5e760
SHA1 bf4dc2ba3c39d8188f2b20659a9242bde6692cc4
SHA512 cbd2def8718881908e1809857fd425e34de8c2334fb5fb07bb7db246aaa7cd0454040f0cbbfe09c5f054989f72cbef9583f03f438800d8a790fc73314d726925
SSDEEP 6144:CtqwvC8uRreZw/wqbZyu5sIAeoZPw1ODZ6R3/8cWqR/H2plHoSud3q:kqwvC8SrZ9NEIsPwa6R3/8cWqtIHoSuq
TLSH
T1B5B49E15F3E945A8E06AC4348B534603DA7278560B65FAEF03E092793F37BE45B3A325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\libGLESv2.dll
Size 3.6MB
SHA256 9cb92d31a2fe7f48dad720694092eac1ccc9e9ec8aa26ab8e15b8f8ec7e8288d
MD5 676fdd91b5650c86c98ae1897ef29cf0
SHA1 d7d74908d441cda7346cf74ade50d6dcddf56958
SHA512 0da56ef85410e795384c1140b32ba72a16ab3670faa2c3cf693f888d1a66b7cb38521575d50ec789fa8ba47a8b7c825f5bfeb94cd59809939f2fa7c6d8dee097
SSDEEP 49152:Oa+rYKnJEmIm46i/JXHykTYCDLJGSGG9GyEMcDitAG1bxMUlQIFJ6H+LvSLtp0OQ:ky6Usk0wBxMkD+YvkPzQ
TLSH
T1C8066B03F2A940D9C05DD2B8975BD237FA35B44A0734B5EF2A9017512B6ABE0BB3E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\af.pak
Size 568KB
SHA256 ca253121434ef430661c30672e1097e6d238e42821585b700776b56977c05d97
MD5 fc774f629eef0d028ef6c0d759b86176
SHA1 8a57809eb22b2d77a2b18ad1c12a17698c512e69
SHA512 ea2c29892c7313063512d4223884e5301ddd265c7299a93384ad1a7d98c950db52665063671242ddb6f2785dbb48d26439b423b12d41055484791414fea07b64
SSDEEP 12288:18abGwqRXxgtRGt+vW5RwONM8KuY3GB1sz4H2Jyn9N+saAQGmQo0v4JIAga26F+C:KaPqRXutRGt+vWDwONM8KuY32sz4H2J5
TLSH
T1F2C41B0BE781173D09B07696FA0845B7FB9CA26CC770B2BADDA982310966DFC11BD1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\am.pak
Size 921KB
SHA256 1f126a64a58ece296209d24c36ae416e3187996765027b1198ee01dead17394c
MD5 e523ed0f5b61632b6bcecdba23754417
SHA1 e146bf586f4b0d05732ada8ef1db69d750ef5d24
SHA512 444e540b31e713e0c3c354cb8b6d7e1b6a2953fe7290210ba26f05241c31b6d0f49ed818ddc438754403e7ce0fb06af4e9be6c46e101da6cf96bef6082d58d4a
SSDEEP 24576:tC4KpTe1jEQhTCMpyGvxVdDSjyc8TzeIXGf5530iABV6zZUPhW:NS5l
TLSH
T1F215AB547EF9F7570F8E8A19A4320E4E9594AE4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\ar.pak
Size 1016KB
SHA256 cf46d1687d01d8ba58512ea7082aedbaa14ff0e748eae295fbcdae464b271b77
MD5 9236822ebebe58d5931cb3abfa59d05e
SHA1 a28c445ee0f9ba804f448d37ca7da3720d664f28
SHA512 368fca3153f7130b3fa76e373a1574a0db440a027697651c8ae075804c78d9d50a6d98c0b7d4edd13094d1da6c332a00ab943893b3006b507e491a489b457e65
SSDEEP 12288:8yq5GPb4BBjLVHTLG2awjy8u+7v4UDodMqkMZS158qNjpPEKLLlYy:8yvm5zE6
TLSH
T107258BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\bg.pak
Size 1.0MB
SHA256 f2a46c4ee04330ef49f6acc62c26ed7ec57dfe124aa386e08c5b582832c4000e
MD5 934193d485de19986de7e0277c139cd3
SHA1 387b3699cfbfa62fbdeeb4f6d9b127df0eb7e719
SHA512 d3516bb252832db4573d38ae9d6ab63db4a5988f49f92fbcdf191a12d9be078600dda750330fe66286a89dcf614864191f60a97999e66e317eedb0fea75bb8e9
SSDEEP 24576:qDcOWNy/LYJzQkECtUrVb6tbGdx373ZTm1z3GjK4UfVDsMX74u2VZsxI5e468KtL:XOWNy/LYO6UrVb6tbGdx373ZTmZ3G7Ul
TLSH
T1283524A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\bn.pak
Size 1.3MB
SHA256 b4ada9665be5c9d9fe4254bff291978dfb50c2b22a7149faf9b9c3f470f0d32f
MD5 22f36ee63dd0e66da673a95e85352e1c
SHA1 65ea5cfaadabe5ed611a20f77d816b1f51aeea1d
SHA512 98b7661cf382ab9feedd09c074b8fa458e061633b250e0dff3ae5417fa7ee43f950f3952aecad8dc6d4dc8ece3d7f4428f4440acf03b525850476517ddd53efb
SSDEEP 3072:xlE7CdT2+xplSGuIpdJ5259J9gJfifHRbkWvLypUBbqVQL55BkwuHX:xeCdT2+xpsLIp3UkWvLypUBbb5UwM
TLSH
T1E755EF209C6E81B6A8C5CDC9434C6370C523AE9B9B61F74DDC17A14938ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\ca.pak
Size 640KB
SHA256 252c097b90fc3ba9096c519a6ab2e91b441f11cce65c7c47777542959dbf6c34
MD5 10db08caf10e1b1bf0570cf1b765278c
SHA1 914c5c8e9eb7cc7e718c16036025199c6dafd0bb
SHA512 e62302f4240f5eb5c56ec3f6ffa7846a562c02628812e70880f86818a061ab5b29197fa677c72f78bad9e0118f8de1e3ff13c223ccc6e54a2356dddb50caf343
SSDEEP 12288:YTW25sL27hjGlCiGh3UQU8K5PsFYN3Mw2juwHzejm0t3l7b7T5+vHcwTLT/fnWyN:YT5sio4L622l8MN2M0K5MYwUy
TLSH
T163D408239FC93B7704D2330EFB46C217A48CA9847B16D254F4AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\cs.pak
Size 663KB
SHA256 5e9385505f9507d4a57f7a5960ceb35b5fba92c662b53bda4e4dc0d63245059a
MD5 b5daa2520a4bf24cb6b5298aa518f444
SHA1 6255446419fc78dc365267f254e7cbb5f5033b40
SHA512 000a7b9512ac05d027c43c80d397efc0b082305fcb52c499b587bd0584c54ae3794a4c74fefef9c7280f1cfaec4d21696178a5ba52815f992c9b5fe3df5e6899
SSDEEP 6144:CWEvFuhf4xp+EHbF2Pw00z35AtYJlA7Af5Bzp/GZ8OwwJSBW48Qz:9iohwrbF2HO35AtWD5Bzp/GZ8OLJSV
TLSH
T1BCE4391EEEA36435584002487FBE4128BD6E83140B6EB9AB7C8F9D91257577E8FF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\da.pak
Size 598KB
SHA256 054849037db8f9672ab80606dd7163f25b18710ee7f777e7eeaa68d24447aee6
MD5 f5e55fe7f2cde2968c0d2d0cac10dc36
SHA1 4c93a1eeced587dc5b01d7d8e3a063a5a2a7b4db
SHA512 3042ee29efef6d8c580758c623173c6fca5bb6a65779f928d6c1e635bccdd0f0c0528d1a2cda4409a1be1c25d6f0006cef3bd6982fafa0400c784890681494e0
SSDEEP 6144:sATJBS1qVIQRMNiVzVIv5MwHJBE/evTawlAnsJwOgobiq2SaE5dtfwcYsghHLd4E:sAIiAHVTe9q5dt4nsR8
TLSH
T1E8D45A4BDC9C732FC9A90725F3118DA7EB6D543CC684264F65D8943A09CBCA097BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\de.pak
Size 640KB
SHA256 404975e6b3af1f4e40be3905da1850c3e87e29bd03d0866185ff85c06861ba68
MD5 a63e224a1e24b61f3acf3bbdd212f563
SHA1 17e6e42e88509e1aca6ec87a0d5e936633bbb5be
SHA512 7db291bb6df49ad037916d31244636ce588f851b7e2d6e9b5c05bbf9199377a45f852ec979fcbe40b5810c0d8f2b1fcde924d7f8d1ff4bd33a3778dbbdf07a53
SSDEEP 12288:ZyDS5JG/3K7Up+guafzEmLO35aSUMUdChT:Z0S5c/3K7Up+gua7R650ChT
TLSH
T1AAD41803ADDF625ED68673617305CDB77B19E36BC342322788EDD12B614B5B283AD422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\el.pak
Size 1.1MB
SHA256 dc27d24e9afd24124abca6dca1a362462851267902fe6493ff3165a1c5aab69f
MD5 bd76528a8fc532885ecb7530f543e975
SHA1 a95e9ed8e3b7fd6a768f37465cd66b09404aa156
SHA512 b9d4a98768a56509ebb4a55f1c2a05300e32be939647a0b3acbb45083930d91967c68c5a0276d5f57400a6b8a410c8d0289ee403d127e7985db502675729a398
SSDEEP 24576:rqss46HWFbrlK5Yp9Ck2txZu8OJXDsSHCmu2Od7IO2USUBx3PyjkHvFz4VoyNJmJ:rqP/HWFbrlK5Yp9Ck2txZu8OJXDsSHCT
TLSH
T12845CFEFB4582DED8046950785D8F07C2BC66D6CE749CBD86229CB60BDF80719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\en-GB.pak
Size 518KB
SHA256 ee6fc979d1fff0c1a4d6bca929691733665c5df7e7a43cc54f1165ea14cffa67
MD5 c66a0ee9892bdb1f511a614d432b5b68
SHA1 0bade47c568201dfca6982d46d44a64e44de288e
SHA512 c83f45164b07932bfb17204ba3016ef4bc2c68817f7456d9a25f807d0ffeb4c1eeb1d3114bac5dd3907332765b20ae0790fe90d54399b6e0e4733adc40e708c7
SSDEEP 6144:mCJMs1KdSc4rcuF4yVEMP9pQRIBfaYHHDjko5b0DG1BcERQu:1J1IR4/EMLQRI7F5wDw
TLSH
T199B43C1FF785126A059352A2BB0AA562FF22D07CB35112663CBD801C33B6766C3777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\en-US.pak
Size 524KB
SHA256 bfa782c9efae2c9cd2c0214dae1bbb3c259d4d4c38d920b06677b9c4cf4f813d
MD5 bfbb69222dcc50ca860b6a80a3da4f4c
SHA1 51200c9bd18b0999ba38033662c5e319485e7420
SHA512 940a2855b5de5f1545abbfed5dad0cfe81e74e847a60f65b4a8df54860649502062ff8941c0fbb248c203fbe6b883ecae8b21e91215b07c1231129a914008a28
SSDEEP 6144:njtGVh0jMRG0PTMP9QQo94faYQ6TFB+5P2jdnngP8/s1wf:jEVhmOTMCQo9+C5Ojawf
TLSH
T160B44C1FF744122A05A352627F0995A2FF32D06CA35112663CBD812C3376B6AD3B77E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\es-419.pak
Size 631KB
SHA256 2b728123b590c5570a46ec2da7d4e620cb81559629f933ee5d71386fa142e02b
MD5 b0a63cb56453f3ec942195e1065e129a
SHA1 5016eab186612f33a7241f842cbcbe80ca709cce
SHA512 ea61a557d626f91c12e22dde790804dcdf6d407ea623369fcb4bd376d72152b71648263f02d2600fd77b2655d34382be95f32ede24057bafdb891ccec45a537c
SSDEEP 6144:rsK6lxhznjoJYLFLnQ2FYjnmo5vV305ieSr5AAoRGCl:m1BmpVu5ieUAfl
TLSH
T1F1D4F822BAC81F5310E3A388B743D757E4989545B408C29BE8EB876522CCF8CD977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\es.pak
Size 628KB
SHA256 4801312dd5d7e3d62db05b8fe326d982f3887c65ac9faa7621009853c0d3b0b1
MD5 60abb63b7d0a231c361bb03111499b89
SHA1 e6ec3f843f199b706fbe7c1d3a342c667bfc6e7f
SHA512 b61b34f108e264bb24fdaa5c638cfb5afc428a1f28edde8a1839b6af84c2d6889b460a0e73a9ec3d3dd0d3c4e1041aab8fac7413e64863a0bddb6339542207b6
SSDEEP 6144:b1YkJ88v4zeV/1uGbU5gtEa+5QhGcm3X8ji5JOvAJLlvJ58J36PZOW/:Ze8v6GbUy9hGjX8ji5AoJJvf8ho
TLSH
T14AD40822AACC1F6310E39349B743D753E8D89545B508D29BE8EB876621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\et.pak
Size 573KB
SHA256 488a91b53d17ca8b52e25f143197875aef7dd50e1bd51bad749f559c17f52aec
MD5 afe1f76bc67ea3886fd0d6ada960dc06
SHA1 363cb7d2713e4f286c3655df753108b8bc1dc5d0
SHA512 b5d178f2e27e751a173b2556199eaf7a3855dc537ddb76dc105e697faaec69cedac955202838b4288f562f154e55abf12a181a1bc1dc7a61a4d5d74d1200e97f
SSDEEP 6144:yc6YcUBG7nXh+f9jaH+KPe6yH07nFdGpNQvmdxIPOTQysogWUiofoflLXhS51Tqi:ybYGDR+MvPe0nFdGpUoPfljhS5Zqcr
TLSH
T1DCC44C42A27D771B182412F9E737E927DC9FE7D8B4000D9668974A1970EEF8C38B2B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\fa.pak
Size 946KB
SHA256 cfd05fb194e5c43c2c65e7803eca72fde4f5629e849cf2dbb8f6f62156485aba
MD5 71ac9af8d1deebd0f4ac15a2f2b81e12
SHA1 8c61c12860d220b0fdf2d0162ff95c53afac73a6
SHA512 cb9f4071da718edc0ae735ac087ae2329384ad34f11dcabe2af40ca19f8a7b83cc95160e3aa3ae88bd9a4f0dffe19eceb46e2a68903381d350a761ffafd02beb
SSDEEP 24576:BOoBOF5I8u313uyqoz+sb2vRmXnloTUoXtCfGk62Yh78ai/78MX4UOVU8Rkc02un:MdS5im
TLSH
T19625C1957AAC9AB15747CA0341E33834C773EF12D349FE40ACA1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\fi.pak
Size 584KB
SHA256 c04f5e2b7f30e8e350feefd6cc45f266dbeacf11837cc774c977bf76e9b403a7
MD5 4c9edf90a899707ff2ac97c81b5e61b1
SHA1 967ed2339e4a14147ed60d0875f16ea3d3cd480d
SHA512 fe80a1f6df3458e43bebe1f62203bf3f738055f4a13412c6ab0bc16da83b876b05c8aa89baa365a1ca7155296cfb3dbed4f143b89e4dacb98aaf50edbea1ab2b
SSDEEP 12288:ulx/dp19Tca5WaW5wJw+UURI8pvWamvaG:8x/25wJzId
TLSH
T1EBD45C915219C22237C4D29E7DB0903EF5E5E3DCCC284D9AE843C7D849EA9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\fil.pak
Size 662KB
SHA256 48884f90e800b0b0803ddaa0bbebbea1292bf8e1bb5ee8f035a79371bef7ac2b
MD5 4fcaec162908f63d6da009e18ad83539
SHA1 953d1748d721717dd7ad7f535764a73bc6a4d616
SHA512 0ca395473ef66ad1142c5f6088ce90a534f7eb45fc9e9e5acc32eab5f371571679b2bd6538f09c5223a82558371cd247182f4b64624cc507b09f2815daae1c19
SSDEEP 6144:4IC7/okacr/Er9FFfNy4DQ+ZyIWltRFhsAcJ56SGvla9boV8A1cOO:Hi/aO/ELn5yvO
TLSH
T10BE4C61577402748DBC352E55360A82F6AE560B83F827C6E0FBF269B7BA7CD5D270182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\fr.pak
Size 682KB
SHA256 e311ebdf49828d313760453a01ad1335bac955b4b8b291accf038714c91ebc03
MD5 73896c5acfb23715348065cfeaaa95ca
SHA1 a5faac8ea692e1dbe6dc667fea32a1a6ad8f845e
SHA512 4de8e3bd5bc4fadf655536b5285e4f5f570236d3c60d1e52259bd1d7568415f9c57816a97633d439eb36e22ffcdfd46913465dc827ea74ea3ae1e2b3b0ec7855
SSDEEP 12288:Abw5DvTZLAqb5dZb2Z7R6QuaSVYLyH81ezQI9kiZuYnY88jw2wTxJDzLmdxSm40m:3o6VmZf55M
TLSH
T1D2E4E66FBAC431CB19C60277FB16D663DD348248F215E340D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 11e4ab3cfa421ea0d4d0971b038a6e7a254094fa6dfe9b8f65fd1572f36bcabb
MD5 d76f8c03323625db4edfee35784da1be
SHA1 af7cdb843bd30ca234d81cd9c593c87709aec30c
SHA512 3af2d086b5abb988b2c67037870c1d2a9cf68ace232d99cda47b93d2639adafed3bc39300ac5635d7028004c2d3a327179be90568e27a1a1a6c7869f5d76359d
SSDEEP 3072:/sKn1zW++jFtt1Ib9tPjAwREJKVMjNiT7llj63rAulfcSi5NnWsWi+/GQoy7vBzu:/sCNWxCbjs7z5qCVCi1ssLw
TLSH
T1BD5518D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\he.pak
Size 829KB
SHA256 30409b7264418b9b9852b2419669bb8da6f489b58d4eeb1007b39d5cc978621d
MD5 2fe5716790acc2234910947f2501f387
SHA1 062c54e342088acd61a8cdafc6a2264235c54c94
SHA512 57ffdc66c062819d8a5e2edc82d04e626b1ca00e5528f796e46e170c29f69ec89a771d157799ed732fce31f97bc2f6001b559471cfa84f8ad0d1f932fa4bbe6a
SSDEEP 12288:wGrhOF2GrTmoBrAfDuBAlGWq+/1J3GIGAACXlXeQCaj35RXbN60jsXk5mOmmrrB9:l5j62
TLSH
T1BB0599C4B2E452255131AAC39FA5FA286FF3CAB53CA27512CB14526CAC774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\hi.pak
Size 1.4MB
SHA256 59ae1278d1b58da7c0a11e5a23bf69ea31c674aebbc24fcd537a84769efe9d69
MD5 116a4f944f08e6005b792d89d3f0bf96
SHA1 b507dc68a7f86abe2db57dedf3b04a8ca7534acb
SHA512 f3547fbc2e28a34f7ed849f05280fc1ad13c0e81cae85e06a89068bf8b1c1b10901fc067b3c066d89640f40e82236878e365d039d531d5ab4cad3b8535626d41
SSDEEP 3072:eUe+UDOnh+DI6ESjQrcewaV/B90ZV1d3uGlqvN3dgNJEdtDVeDn1s4f4/BtROy4N:8+jh+QSjQt/+U5pAndKtu
TLSH
T11165050CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\hr.pak
Size 639KB
SHA256 36d9939cd9d89baae124fc930cc050e386df2b8fd0eda0fb48882a2929b94a76
MD5 8ca2b00eb3f0a1aba023d6bd80b0df03
SHA1 925a49d5c63dfe2a5a4f235bb31007f060751ab3
SHA512 df5406e2cbbed3f612554c2a13c71211c0d8883f69b96f0116b5044ec8d8ea8b39bce572f158d2eed52fefee9ea8dda684987019f78830d2b2deaafcb379cdd1
SSDEEP 6144:krVaCiySH1RnvXOKDOYE/5wQCOR7PrzpJ:kxZu1RnvXfM5+O9pJ
TLSH
T119D42A7DBEF3570A0897B34AEFAA434479BD08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\hu.pak
Size 684KB
SHA256 501569c5e74285231b41d067e0ea28972ef0ab7b269886485cf1b42cd78cbd1d
MD5 b898f99d79360f2bf2ce506c324c25a1
SHA1 8805034141ac3b138688d00bb8ffaec7a5033f68
SHA512 bf55f3b15964e346e9b6be757de03fa0c610d568428d443a55135c8a823e71ae3c7bb99ef40e429950e601ce96ad8fa2b68d7fb482c785a10c5dd8e52b76ae23
SSDEEP 6144:MddbPxudyTpVHiLlw5kgWA4ZtOu8U5UTt8gZ494rYhCi/UtmuFNer2EnjD+54RIf:MdVPELAjU5UJ8LRa5Tys
TLSH
T18FE44BB79376905ABC6C179778643F15592E481BAF2B32FB2883846D24A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\id.pak
Size 565KB
SHA256 09d4dd7cbe4eb1b7730a80a3a3cd0606139f4b9647b0a04b49314638680b0a31
MD5 7bbdc528c668aa0994417aac9301a718
SHA1 71a6c00c115c5c6ea01d8f6258f141e5a35c70c9
SHA512 52e742e249f12fa3185c961e91c39a290b8ffcfd4260d9b502b90608ebdbbfeb834a43b150a415af76e84a0527c7473da122c6e857ab12b4e0c87319f64d9c6d
SSDEEP 6144:4pNXRs8aNQQ83ZA9tK4AfjzTFjlFtXmBmiFp/Q25R61lKOBCTmWiTv8oyHu:w/vaNI3ZWj8TFjlFlmAi75R61T4u
TLSH
T1F4C4E8632ECD310C094842D5F2DDAA1E7CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\it.pak
Size 619KB
SHA256 901a28a4cd0b1d545f0c2e4aa54914029adc03801859761db30c81947de63f92
MD5 5643e0b3864700801fc4a1c59a1244d5
SHA1 2c7529e034bf04589ed52a4bafc5123d7f424910
SHA512 bc60b4df1f943df74a93046eae531ad8a2eb7c0186a8df9c5e9b4a09b3a3466f8b3e8f0246fcf53bf819e3744599519182bd9a3e52d87e683fa260b007002766
SSDEEP 6144:ct7Hl4tBXWx8miX97+2N9rYS/qBRRs61wtl/RT9TbOKkg3gCYrqdqpzSj9f3wBYE:0sGMXZZ/K8YM1CWkb5PkSlxVr
TLSH
T1F6D41B3AA5D6212519976359E611B085FB6EFCDCFA41721CC99B031C22CFE80F2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\ja.pak
Size 754KB
SHA256 8250b4783dcc389fa96fdf79e8188e439ffe5fc01325f32ab8c322c4d27f20a4
MD5 830a7cba279a3deb42af3e23775cbc4b
SHA1 7102caba0d73d48af569d6c9877fa3955fb778b6
SHA512 e0277e4dc6a1f603a0ffb40e7e01dace0f49604eef6aa6d4fe554592f7366af490b84c6d7b823ab61fea55d335437f69ba04502537a3d90fc704a741b6633b2d
SSDEEP 6144:mnhlmdGBTZTDm1CQRdMfdV+Z8Q2E0uRUNbN5ziIy5GzV3:qraGBBDTyO+Z8Q2E0sUj5zVy5U
TLSH
T18EF44F7CE3C969369D6152A22C0E36E17506AC5FFCA23A3A443DC074BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\kn.pak
Size 1.5MB
SHA256 847c5e6abcddf120b4dbc34e28dcd1c2e93f94ab1d6f016d0c1504a58cfd5b93
MD5 4183e32193ba8bd36bc421490dfd0959
SHA1 c3c1ea138dbe32969f10f3d25556f381ec1e3688
SHA512 06b0fb8ac6c844b3efa6a26c0af5e295d0074ec78902bb7c1767191440176a60367e4deb7ff527284c12b5de22fe84e943967e37a6baafdee798d7dc2b642017
SSDEEP 12288:BiHflzAE1TS7ZhbUqZMS1M7P5JVHM+4EryjEi:BsKQ5nMl
TLSH
T19A75CD18ADBA7D301BD5106B24EC643ECFF16BE29CA907C2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\ko.pak
Size 640KB
SHA256 b8ecd18ce8601686ef64129c77f5307d0c60656d27eede7a23b4f3947647b302
MD5 577ffa9acdca15ad31b1bcb16814d4cc
SHA1 799416720afe209f47355542cbd6ca607a965df8
SHA512 01837e4a84bb4eef059bda5ffab9bc4bb7d3b349bdb3a11d7d01471f1d9afec817a26925255078c62dbe05b51a8aff4a652a93740a1ea8833d3471b7f3f535e3
SSDEEP 12288:47/T8gEgukiPM1WNiPszcbifYj4ZGRy0IeYs1ubLwLCMrI01xWSJGRG1zLhwEtFr:6/g6Im3R5o3uHuI
TLSH
T129D4C5F23CDB63C91193CD82AEF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\lt.pak
Size 694KB
SHA256 6d648211ff3a6801e049c9a3931afaf3007857b2872e55ae11e19849180d19da
MD5 bf8e3fb7d28a72a7064e593c065e2535
SHA1 127eaad62f1298643dc2b2558f24d18a24eb7355
SHA512 930027bacb01d41124167b326df40d61e7119d81046eb289ae5577cf5bc492762bcb80932dcb56e4a8103d63fbde11873b1477af627f159e709c9fcfa84771ba
SSDEEP 12288:zzffIIZg4oMwQSY0PrVKrY4bi5P7MIAAJP6StA:zzffIBM0Bbqi5oItJ4
TLSH
T182E42B0069E3AEFB9A4467C981A4CA78DEFD50009767BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\lv.pak
Size 692KB
SHA256 0c0663909339a1f4edf09355a67eea0fcfe821c78d4891604eee31695ce20b37
MD5 247ff0976e6756e17f3260b19ec59ff8
SHA1 a42f0145d6c7422bab290a7552155aa8b420e515
SHA512 3ec584b9b637a5554a5ee1e182851dd254f28d1767b582b1bcf81b0c4096a0ff74487f3153bebce2126e1de05c813cb0d1b2dac251d6fbf3a71abc486a6fcf8b
SSDEEP 6144:5mjmTu+M7F28kCybaFGkrNStVFxH9KGz8mQWQd5VbONT5rmNnaERchTyGisHcAz2:1R4CCywMd9zpQHINT5UchTyscSx5S
TLSH
T16DE42B959EC68FA94D904DCA733AD132A8CCD740FE07E112DD7D8B3A650F52822B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\ml.pak
Size 1.5MB
SHA256 2bc35d18af85b3c7004a6e1e02591f5db4430a2f334f5c4be3c0a0e04837d9ae
MD5 d2faced6115180461f01ec5b37780721
SHA1 04af518a359396406efe27062de502d72a0efee2
SHA512 cdfe605367e5a2ef4026d1a1805f932397b161c28e37673be06431494bcecf4757aa4677d9ea38659e40a0a4dabf482ac4598eaa430ce8ec59cf26e6525567a4
SSDEEP 24576:7zVM/oZAuuxyYl+9y9XBkx/em7KfyBR+zXcj+v2uiLl3751aaiAD3e:7zJ5g
TLSH
T1F5759D5BA036CD3B0FD102167B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\mr.pak
Size 1.3MB
SHA256 5dee369e9366bfcc4fc95aec6c58b915933efd72c718d56802e35e8af5a880a0
MD5 83769844b688def4c5a1f4ad810cdf03
SHA1 8280d04751f52d62397fa9eb0fd73811cb331344
SHA512 15b1bce67685c1a3e250f89c70a6e47c16cf1d78cc089c86bbc342aa047ec248db71a0ca0cdf00d1147341289b778ae280d0d29932f673bbc65d79736f28079a
SSDEEP 3072:zDvYSVM2ENIGC6dN5t1iIh8roTsElUrX3iWUVse0NF05HwF/yGRR3R5EodxEdY+7:zTfM36iWUPuH0P2Qt4P45tmbAy2
TLSH
T1A855C24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\ms.pak
Size 595KB
SHA256 5af99080b311e15a19f9988779a1cdd939a7fb9b98bf093fca324eeb58b39602
MD5 ec5e67d9e72519f3a1c7611ef1919a9a
SHA1 eadf0806da3c5020ded53cd0a0a2a16551aa0de5
SHA512 3c5101b115e548134ae8c1b915305b0cbf81b955a63859def2271796353d7a6f3441c01956fa3f6eca855c40febba666b6c11322a9dd6399918bede5fdafcf3f
SSDEEP 6144:l5PzpO9dhf94qE1XJHxze6L/rg42Huqwo9O78AVzZY5b4tVlqL3VDhh:ncjqz1Rx66Q/HuqwoWfY5GlqF
TLSH
T130D4B6469EDE3118085843D9D2DEA91B7CDD3332B705AF2B4DB08FB0126E7A53316B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\nb.pak
Size 572KB
SHA256 11e798ef612a1d22b90450c547998bf0b23ccc4ca5265f27f1924c8b09f22937
MD5 08d67d2d33fbac45ccd9d09f86f16d9a
SHA1 1537998d712de4d4936a00df571d979f56523ff7
SHA512 df267cbcaeba56aefd906005c11fe62ef1d697c2e0213bdce1fc24805cd20e384ea213da0c1255e156fdcab3ea59f4d2b200868a6d02e8ddf9f4c1ed878b95bf
SSDEEP 12288:Qzjx5QXbO2jOp7fI4R36v3qG5wmNBdls7FDu:uxmOes6v3qG5XNB7uA
TLSH
T121C40883EE46B72EF2A443A4F519855B9B7D942CCE98199B54CCC63E0CC7AF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\nl.pak
Size 594KB
SHA256 bf2a7d52d8c061b5f5543e7c4e20b4eac96e65e02a967752af873c3ec30034b2
MD5 628efc38e167f553e6ea4e46fe77c112
SHA1 44734e1804e10bf0a18675432904ce2689293064
SHA512 200ea89e0c466216af6be2d029c057c15b3afd5e48287fc978d551b14116f41712289fff86234e5dc5f7e33260723a5b4ed0a9d48672d0d496bb5f8d8935cd9d
SSDEEP 12288:KqKspUlbJWQusNUSX/gmfex95bt8ysigqHgGfDTF:KqGlbJWQusNUsfex95biysVqHgG7R
TLSH
T155D4F907AC4E653E59C0A349FA098FBBBF2ED22CC26CE67D94DDD5340443F6842AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\pl.pak
Size 663KB
SHA256 7a464e196878d304c7358e7ea457e5d2a17e3065ab02f29b8402803c401d747f
MD5 879a5773cc682f1d557eef24cf02c8d4
SHA1 eda4190bd8831926b8736d5f7d86d1c84228e52a
SHA512 1a2c9d120136eda736fcbc30a03aeee3ff5f23c794bbff63b384299deccb65a378cc6d2f126c625ae29fe968db842a2b39692f112f472baedbac7ba83e11c939
SSDEEP 12288:FvPTW96Z+wKppFwfQfuzSJabZLbEYPPcCUdTe3m4U0hMrma1Qh8j5Ra7FolEqtT:F3Ti6ZopPYfhM91Qhk5bB
TLSH
T192E45C0E5AE58A4E8CB008E6F2E70B7CACDDC808F109D35FE45F4526615B19ECABE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\pt-BR.pak
Size 621KB
SHA256 6cb59658b372d605c4dac61711b56abf5555ed69e7b9ab0916f9185af48e66ec
MD5 51094db887fd87bbc9162d5521e22973
SHA1 36e3c2e2516493c35dbe11ba18548eeb7e2dec99
SHA512 c5c15fdf857144105f2d544f70a454aa9322e4e451c377e184b543d99f20ff5daeadde54694ab1e77385893f9f728cec0402891bd98da86571d73893fa24e98e
SSDEEP 6144:0D/LLEOBh0NBXBLJZPlQcy2Q58ENAhzgesRUJmMs:0DjLEOBmY58EAXsRemv
TLSH
T194D42C2A6ECA136604225350774EDB47E5881745FE0ACA87DCFF4F06A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\pt-PT.pak
Size 625KB
SHA256 b727b377a6ccf25952189c59ef175c213dd1e29e896b6b5fdfacd024c711ac93
MD5 ccd1baf51f76cf4041c5946a3280c5d4
SHA1 98d8c6adab3d8bff3a4339898a8bbf68047d8c8d
SHA512 b6233a3eb262cb16b4cd61302dda8a74b129af80596528289f47e3efabce50fd4e06b8ee6e39dfb3426851f191ee62d79bef2ed97757fb2da02f0284b079e7f9
SSDEEP 6144:kKrHqVBc1X+oYpStieJVJJxhbGDLfbDGfDUh5snsusGMSRTd:klDe+oYbxh5sns6MSRJ
TLSH
T1D1D429286EDA136605135341770ADB03FAC86655F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\ro.pak
Size 648KB
SHA256 205ea8cc0b368426f06c533b636a2845e66e3f7932aa6a680645e79de15edff3
MD5 06edd53ab148c98097b5970386e2f9ef
SHA1 c1cc65de8cc69e82666f7fecbe510de7a9f8cda6
SHA512 9bc9a8b34bd6be4bbbe959757c23708aa109ca476727686c5cf4de295c596bd96ea4f226b2b93d04fe0f67b9011f14ecbd3648e967fa003b9b1b26e548575aa5
SSDEEP 12288:sVjgzMdy7hjolyvnBf4d2/j5sAZ5Bc2/ff:KgOs5X5y4
TLSH
T1B7E44D23A1C82A972D5152B2B73624D3E88D105DF641E28DA4DEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\ru.pak
Size 1.0MB
SHA256 54f1bc4ffc72547a655d4737d2c7260a71794dda56fbffd13e6e8cc313c5520c
MD5 b000132c3da11a23d9502e879e35244c
SHA1 19d441ddab87bd2ae421b31196ecd2c9c1c158ab
SHA512 b3d43c43701c569060d3f5a942102d07fe7f2c76e7856eb4769f5fccd56aae9907c69e1cedb391cd66fe437ac92105a4e5f3d4d949982a5adb6c8bf72708f57d
SSDEEP 12288:V5ThpwfQeRo4YwispqzJ9sF+oa+UWXv6HzW/oqSv9s2WTBENtgA8Nb6dwYHyO3j7:ffcBW5eohP
TLSH
T1B5358760669E64EE1101F01BDD08BE0D3CEB45FE3FAAA31619642D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\sk.pak
Size 675KB
SHA256 eb91fe27fd087433da4d21dc1c387a816bed0de3e6a140b4597caa90f4921fda
MD5 b4438d51809fe2f1ce9b6dae65644de8
SHA1 43c5adb90d117414c9b21fb122e268c67513ac4e
SHA512 b0c49d7cb43680358ce5692079d27bac6b3e6a21ccd23182252a17775652e9c9b4fee9e2833b28798749f4e9e97b8130e5791f737fdd66cd909b9712adecc462
SSDEEP 12288:oGoBq77+NUAyi5i2Tj5Bnyf9YQ6+8pTjsxt9ia:oY+NKix5cYM/twa
TLSH
T1FEE44D3FDFE7181E8E8D0148EFEA7110FD7E8650864EB4A6944E324714E26EDCAB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\sl.pak
Size 646KB
SHA256 52426fb8fc82d1ed28797ccb62b7fe14f123cddf011f5d5875b076cdb0c33695
MD5 ac0a75c5b39b5d01894e81fd0705b1b5
SHA1 0bb293f904c9450e26f88b47462fabdf75f03d3d
SHA512 4c002d8206040e0d76f4b7c26cdfc75e7a86cae6187d4361f8b20cf071994415bc1e8f613794b3233d631faf9cc9705549b846322430ac3e0be02380eacf404d
SSDEEP 12288:voOLftUNcWtpeWpcB2BLBPHL5lbH80WOq9Myi/fzeDJql/ad:wkftUNleWHPHL5lbH8ji/fzeDj
TLSH
T1E3E41B357AA75E0F0C9AB28FFEB606007FDC044CD252A6A2FC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\sr.pak
Size 993KB
SHA256 92dc15bac0e96ede33a7055994f3558605b3147b890ee0414314274216dbaf80
MD5 b1c9028a635ac87124f958cdf762f9e5
SHA1 342a883649a11645c90ba87713619de0ece94002
SHA512 0d5f64e224bd84873bf6d1fe004ec1c79680bb29e6eefcde0aee7460e2417a8555b9b3816ca190039165ee6cf98b1171983ae99ffb08203f95b5fe956c483cc6
SSDEEP 12288:aBNEoTHMyfD0+z3nIAhuSOd8CC0ili4MCkHvj5YEZ/XCnxKnZ37GbuEU/k/D:y+oTs5ucb5JC4o
TLSH
T1CA2556B19B9E64DB0901F41BD808BE493DAF41FE3FAB975211601DBD34E10B847B929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\locales\sv.pak
Size 577KB
SHA256 51f5cfc915aef54ffa11077d00021c99aac1c86f04076ba70f43608b11486199
MD5 fbc8be5878cf2eb9caa03249a2703960
SHA1 397a3975e8bfe33d4a569d1ec193ca1788f49b83
SHA512 80884b7f345add46c2d3949700cee62be1beb70e19c37cc6e1f37dff16b899dc483205ca487677f3cb7766eb736ecb1fc3d21480f2e66900e8df11268c03d3cf
SSDEEP 6144:iRdRvgh0hKL6Av+iIkQywo+nmHg2NxbINlujnLAVRFcz5RtGm0+SM49mFMuISOG9:UdRvgAO6W+DTj2E/5Mi/38N
TLSH
T123C42D438A10F526FBB2530DB609015F0AEDE15CE7E2958EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owutility.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\owutility.dll
Size 2.8MB
SHA256 3805f9319b582b2e122274339ae3ade3d9bb56718788e0d090999c8a99f4bc66
MD5 2da22161e4e0bba909d9f063f6c0840d
SHA1 64138dd5d27f2253a8cda40955ca1f802e46fa7e
SHA512 2b3ed947261878dcab4102d9485f91cc617ce0129e4f166ca3b9a8579f6ee09a37391d28336a5130a0222300e63152501e72192e5c28b00570a50d2578f6d269
SSDEEP 49152:k3xsLRsfYDodxgEX2sP5z1zbIi1r8jj9IbamVA9/5OMbyB7ugVphXAQkhsGg:kBNYDo/pPB1zbH82baV9hLK7uqkyV
TLSH
T120D59D5763A551E8C12BC17DC586A94BF7F3BC290B35A3DB41A1932E1F73AE12A39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\resources.pak
Size 3.4MB
SHA256 3b6b59c647368272bd6127235d7f17d5a07c02ac46b8a84c58a7f0a1eb3f090a
MD5 6746a1c1b16b94c9161623490bbb17ee
SHA1 bcdfa31269a645e2711c5aa895be9f39d16b5c70
SHA512 db33e20769b9cbb104a6b10ce0a87ed6d68ca212753b28bfb317444e31e3c5795f67e2a53e7fcdb94dcb6142e2f8a868431f076cb1e372596da73f9bccb11cfc
SSDEEP 49152:Fa8b51V7FzKsdXDhmOm+ONBKB83Y1hR8MugR+96l/hPjgv4VLcaH75MvI+vfWrwP:FaghKsd9LPJ13/R7lJPjhlf+vOrwr7
TLSH
T1FCF533A3B3D12C3FC49413B582D487356F6C56692642720709DCB125EE3A25E6F88BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\snapshot_blob.bin
Size 394KB
SHA256 eb484904e06c217beaafd2cd6847eb909225a5f0a4bf814cb1ec22653e6bd2e3
MD5 2475efe9ad373a9ffd0da6ff9853a9c9
SHA1 c63fdceef60f3409013df2af2802e681c71d982e
SHA512 9a5fc21e93df7df65ed051eed9c522b42dc5e11b58f5b370b7d699d4be1de8709e8a066e5ec6bfcafa2ebe069981bc5c3a1fb41b5874cce6c80c216600de98df
SSDEEP 3072:XU6QtROt+xeRvISYOoxs+Yi9qSkvpqE+IE3qfJjtN:X7t+OcTCvpDjz
TLSH
T13584A909B349CF36CE083A756CE887896526B18D6D96F31B7519772F38B35740E32A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\v8_context_snapshot.bin
Size 758KB
SHA256 1fa1cdd08423809344fe15fac2d9d1ec604cc3ea5af4b944d89a51b1e98c8665
MD5 00f69a4fa2169454a5601261a9c7245f
SHA1 b6d3d33b615fe050b7b2d009695a2a6e4e7c12a6
SHA512 abe8e379e1842d00c71a7c9cae3bd4d3a1d6ab4679f8c6d850dfee3f91affa23cbb4e0b35c035bf2832adb5f0cf5a8fe4fb21a7a377babf190fd6f11ce67e4c8
SSDEEP 6144:tU0ckYOkGt+OcqCvpWoNyuZaVaBgJjdOSkvh8mQu/INZV/peyWBOI:y1RNvMoNyerT8mQuANZhcOI
TLSH
T10EF48565F74ECF2ACA4537B86DE547463835B04A6F8BD21BB518233E38B65B00E3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\vk_swiftshader.dll
Size 3.3MB
SHA256 b105d29d7d5b029561a45b7fc48aacf30402544017e5336df6a549d70843e183
MD5 5c2edf1e2f8f4a3b9c1032f81ee4a113
SHA1 96f2c54f82321a1973ec6b81b8ad4f7b6e6cb773
SHA512 3aa9b0786fb8a31ee1a7ddc3ce78c3f83f77d476d7a66e90457a131526befc8bca4ec9337f8cce23b90ed0442b7d76e305be1f5f434f5493f131589fae3d197d
SSDEEP 49152:yf8J6ogB5C2csJiy2fY+sY2IKZ/s+OUvKW8yhj5PGhekCciy43Jvlj38HxiL2cWE:+8U5C2csJijqwuHErq
TLSH
T1F3F52813F18680D9E05DE5698B5EA233F632B8851B3276DF57A00F162E6AFE0633C715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\7z-out\vulkan-1.dll
Size 932KB
SHA256 31ec3d09127c5ba667a9ce7af7323b213d39c3d7c32c2d66e9892e21f6c42866
MD5 9fe2463ed6e920d9d9cf6e45b13479aa
SHA1 900bbd521024205396e3e61f7f719490435517d1
SHA512 832c0ee5a93788ce174ba0bbeebc6bea3c4f40af1ccecb42386b8362a124d85946ec6a1f4cfdf8aed49c2620e4274926b589e7360b0bb107aa879b9a8b95c523
SSDEEP 24576:VGVzDeAVM7N/L0H6tDVj3sF6Z5WGc4DYsHQDy6g3P0zAk79oOHAFN/:VGlDeAq7N/L0H6FVLsF6Z5WGc4DYsHQQ
TLSH
T113156D23965485A9D47AD034D9D28707C9B174822326B9CF02A81708BF6FFF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjB0C4.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommandLine.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\CommandLine.dll
Size 60KB
SHA256 569307401b949368527b128155b4e16b349803ec7d65c1052cc23c7b7a1336d8
MD5 210472e9e333d3329072c9ea3ef06326
SHA1 298c5473a79ab2c34d1ef05a75cbdd04905c822a
SHA512 c0f41486e8e7a8178322bd1fcd37fe645e4a23041e0aa84d3571b8031e2d1881029aeac1b4a554aa2f6a4f1b57d23a063872fcc72a04984fbaec2bfd12fd4b01
SSDEEP 1536:/Zj9JT17qpL/6ePMqBNzrstoJSkrjbgbwziM3hwW:/x9JT17WPMqBNWAkbwzibW
TLSH
T1C953292193EC472BD6FF0BB9B47462610BB5FF86B523E36E8D49A09A1853F4144613B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\Microsoft.Web.WebView2.Core.dll
Size 557KB
SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
MD5 b037ca44fd19b8eedb6d5b9de3e48469
SHA1 1f328389c62cf673b3de97e1869c139d2543494e
SHA512 fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
SSDEEP 12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv
TLSH
T15BC4402123FD8A1AE6F63BB5A57407709BFAFC967979D39D0598251C0D72B408AE0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.WinForms.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\Microsoft.Web.WebView2.WinForms.dll
Size 37KB
SHA256 e4f695b72f99024e3ee5d5f26a367e664f4e120bd5d90aa87a8bc0509c365ec8
MD5 c7000faa6c6040188c8cd8ef28b6deda
SHA1 07a23c50092e5c1fd9c9df87e26b65df25d37b24
SHA512 eaee01031477454823974546055965df8d75c5115b25ab07b15ca608a20e8c21154ebb8c707a74213ebad04c2bf34a5f5563306e6da502235372c60672144022
SSDEEP 768:sijOv/1uokD/iyUdcIJtYZDgcEST3p4Jjrjh2jJFSUyauTv1JKia5/Zi/WGQK4uC:jOvZyUjJtYZDgcEST3p4JjrjaJFSUyaf
TLSH
T170036C0083AC8527E6EFAF78B5B481610A7A7E837A61D75D1C85F0EA0DB37E05914377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\Newtonsoft.Json.dll
Size 692KB
SHA256 7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13
MD5 98cbb64f074dc600b23a2ee1a0f46448
SHA1 c5e5ec666eeb51ec15d69d27685fe50148893e34
SHA512 eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147
SSDEEP 12288:p9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3SH:p8m657w6ZBLmkitKqBCjC0PDgM5CH
TLSH
T1CEE44A0623F88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OWinstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe
Size 336KB
SHA256 c2e8e0a138ea4a2208c68a7ef5f2a6ddfe64a382df3a1b35adf821ddef733e90
MD5 c454ce8c2af5133007f63a5aa415ef17
SHA1 dff6fffa4004fe7ac1d7eaa70ffb00e43c7b7eae
SHA512 2a4afdccc0b6b3921aad5063cb9e7fb71f67ae7cb70c3fa38b654e5a1995b71ff3432cfe1edc91886a9a6b95ce97b66aa5eee753c4253464d3b05911a9bd4f74
SSDEEP 6144:LiXZ70YOCPQGLgNesAkAZNNldoMuK4oTzk9boAeoSYm9qXb5PBEcTX0dbq2CZUpe:LKZ7zTLgNehNmMuK4ovMeoS6Xb5PBEcg
TLSH
T1DA746A4527FA4628F5BF0B79BA7649218BB6BE836877E78D4D8068CD1933710C890773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 79ff74426fd895ef0320068b5809d0737d04e0b9a70d792711fb7b7c3d0cac46
MD5 7614f08eeab53e8c4b6d7023ebd72018
SHA1 b830b6c5acef40e9bfde15a4df42946d04af0043
SHA512 5c565bcae985a89a7a2fabaaea20cbd48c189aa596f2c0c5b2e29b0bf2558b09cca7854fd4e378e73b0de132c87fec365e2bd4f8db8122baf6fe382218d5f45c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 edfabade35149815b35eb09bffc7d166237919b5f15273c3e671236b6240d8c3
MD5 a79144f579f34a241e5ebebd41610c9a
SHA1 f5c892c3ca1e7d3bba0203042538b46fc8a4efc7
SHA512 854a641cf41697a5789e2ed3068376cd9f58935b7c34658f0dafa9c0dcc3c5ff5f2399a167e2df8a8d5fb8c6b0fc90efc4c8d11b2c578ce2910d5511d7f39924
TLSH
T13FD0122233010234C0106033164376080940C10B60458100642C865D2E088B00906641
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 8fc0f2998bbf837b201f0b54718e7ffe6f844afbd46e91d8b3685505df3f5731
MD5 c9120af07d99f9157bb655715a6799e4
SHA1 36c5737c49aa52b2b899ccac097fa834982cfbbe
SHA512 50e35780c7b698670fc8e4c0f77a19674019c6f74b35ee5897c0f6f6f595e83f83c9be6348ff37d08ac80d55005ef0e6040e68a689e7803c13e80469c233bed7
TLSH
T155A0026553D15442CE1056B160E50644369688190251C327409099E88D532CBAE61518
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 2f171a84a76c4c57efd6994157346401f224063b5f37f01959bb8a5387a32f1f
MD5 c0840f1d0e689e8030922fe8481b9f2b
SHA1 94722eefa1ae97db976d7462c4b54ca17b52b755
SHA512 7a4cb80444464160c56c5051e53d187a8fafdbcc48f62810c297fa8a8f9f66963279ef252ba70aaa7aaf8975fd9c1a82317a35834490eee11b279f56dac16d8a
TLSH
T16BB0112000200283C2200B30A8EA000832A8A88A0202E3B380A0A8FCAF832CA2E20B20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592c94.TMP

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe592c94.TMP
Size 48B
SHA256 cce996d123c75aa5a822c2a3c34550242d62b7d60fa89280fb1bda12cb70a160
MD5 3d95446ffe4f05a773beb0104379b966
SHA1 b87ccffc9fb946e4f0e19f7548bd8da23be683ab
SHA512 612d93665ec7f0ec8f8041a7bdae96f86dd2765f8113a15af07614cb00722a28523143d22e6842c176cf06003d82066df2dbb4ac337494cf82e7c4402e0022ab
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 995B
SHA256 026720d2065cc9ce443b2697f274634d55878d264418cae326a408d3642b853c
MD5 0135dc97df41090fbf685986b538ab5b
SHA1 64f9789db8a1916fbd03504874215858c4b74a31
SHA512 3593d5eccfb79134bf8b5d706088fe28b737ed5ef69a5e94d712ea754f9a2a701eedae8907cd974802dae8c1eef3043ca0011ef66124ae5f74454444ba8d170d
TLSH
T1081178BA83E407BE495112F41B35A927CD1D551B42283C668DF8AF8F63F15B0D20028F
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 354B
SHA256 9464d2571f056494e038681827891f6267decfc472212a2be5407946a8d3cdc6
MD5 67fb000a69757db1c5c70800ec50eee2
SHA1 df1d09ccaa0037fce7af32be324ba9900bec3f07
SHA512 54cc0b6ed0ee9791292c96da2dcd665d2fecb60b0909fc1641dacf71cfba3dba1d31e9fc311e6a551fc34571348e6440f57062242c6f5eb1beb47ad60c5c9ea4
TLSH
T1BFE026F7507AF4B7203C5AAA2D447C215B7EB134125198E9DBA3886CB0C81B76A0647A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5aab55.TMP

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Network\TransportSecurity~RFe5aab55.TMP
Size 356B
SHA256 d4f2bec8e7c102dc02480543bb9847549b62dab7b73a8b74e6beca4f801ced9b
MD5 b68514af596ecba610532367203f2a3e
SHA1 1580447fc59c30f076e3c4049c1fbcd3d9421db9
SHA512 b877c18b9fb09f0a0e9636c55673762636327e2c0ff21056ac09b9c1ab2ddbd2c9b5f83452f933ae5185e9596db00ae48dd626438cbd5a320226ec7a2db7f92f
TLSH
T143E020F7407AE4B7207C4E7A2D457D011B7DB1350550A8E4D796C46C70C41B7571247B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 e1399690006a7b1c513c7e9b00424befbb03e396d4f76f20aba7b9832f52ebd9
MD5 cd27048a493a3cd5890886132eef2c8f
SHA1 3b29248fc2195bf47b109165a8daa2ff665659c0
SHA512 d41ef58b122867d27558b0ac30d41d835edec13043c6dbee546199e28cbab1d4dbbe12c156052a079126ba92d3a8ebcd5d7bc78b91c0c952553131a2845e62a9
SSDEEP 96:stwd05BGAnJ7b9CffDZ8i0vhEMkmem/7qx+WVHMSm+uecaY+Qji+gD9b+MOB:stU0nMfrZ8paEL/S+Wi8Y+ffb+MC
TLSH
T199D1B642AE2878774CCBF61D7A35BB02E2FA606225D40E98EBFC861C05E65DD130790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe597054.TMP

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Preferences~RFe597054.TMP
Size 6KB
SHA256 31003c484151836071018d3493fc4a2e190a7e3f0cbb26956d8bc9db6a9cc8b4
MD5 8e9abce721bf0dfc6164aa188199b5a6
SHA1 1b4b94ab8f4846d34581576411c5ea4019d30049
SHA512 9c32e8260f6027abf8427d8a8e538b3634d1845e23ccccf565b5f468e0107221e0aa2434ebb1752c3d293ededec331a1bb375f8c45028a3c9f7be466ffe06304
SSDEEP 96:stwd05BGAnJ7b96ffDZ8i0vhEMkmem/7qx+WVHMSm+uecaY+Qji+g4b+MEB:stU0nIfrZ8paEL/S+Wi8Y+fub+M8
TLSH
T1D9D1B8429F2878774CCBE21DBE35BB02D2FA606225D40E98EBFD955C04D65DC130B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 8c170eefb136bd71e5dd954c4f1c52744d09f5b67713c911482d69aeb5c45181
MD5 b3982c434d67e88a139d2fdae440ac29
SHA1 648790cc372ee4c4246e31879d29831791c02164
SHA512 16ee4f9b155d8596e1b3acd7d571fc42916f4907f0944392e0ee2d92387a1af3d33df018e03329b5490fc53e244f6dd8ab022cb7d02c9df5b65e879e756c0656
TLSH
T1C23185B3E4AC3E3268C9E68971423F571D35906A81205E1491DE5B0802F769C963FD32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 c552ed9ff4bdb54b4b8c6e0e4c28408ad86d7c7c8ea3508870059dda11e16e1a
MD5 1ccf91ec6d4269c83d8f877ea8216358
SHA1 6cf116c4ff319f2becb58c7d6362c7aa352548dc
SHA512 a4fb486d24b95e76a7dfa848d4c245a3692f3cf85280693cc45cf017396291e4fe62d1e6ce72788537f0e7b0a936cde201feca1e142e011f33a17771a1c6a0fd
TLSH
T12651C773F81C6A3749DA994879463F139A3991A599613F6096DE2B0C01E765C2307C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 85b2492b506ce0bf79cd15092f2725ecc77d06d391e56867ca3aa5c25a2f0818
MD5 327417fe95bf6fa7b30d75c5051687e6
SHA1 529f54b82f452b08bb5c1b6c4255a95f71b13466
SHA512 599e5346eb64da7da941f5fe065941cc1543c19e5c28140f730a42784122664f9e0a0c7ef3821defc7a33e028ec61f580759e6e1c28f3638b24c4bc3548b35ad
TLSH
T14D71B676E868A9370DE6D944B8862F16B7699167D4903FA4CAED1F0C02E739C1302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 d7ac51c4cb98ed0948dff3e79fa23b7d214a9d29aacad11b595703a5f9332e0f
MD5 e4d32d890727f52e5a619bd1d1148d38
SHA1 9a6b3b87217e720cc341978edeb35700c44b00f6
SHA512 3f582fb2c60ee5fd931c0170948483014ad8f490adcaba7bd2bb6787e887708822ef3bb30a0cd46e11eeb32fd64c648adb1751b2f27f252ab7306a68228780be
SSDEEP 384:zj+aQikB+z/xvxjg/qhEwNbzv5jr+7Fm9zK:+/UxvxjgC+qJy7oFK
TLSH
T1CF728E3B956C7E2755F7FA0479490B5BCBB9C4B280C12EB88AED6F0906DB3A40306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 18KB
SHA256 003811c80eb532dd9822be2acbe716453107205eb3f0a2eacf985d12b8143f30
MD5 e27d74234f528771cfface3b3003296a
SHA1 5b1c5436677d8d99c20dd603a05126b736bd94cf
SHA512 a495034b36875fdeaa129bb83fb38aefb95af63b910efb5b04181d2497f85a81eca753403e66a3dc89f3ef31d2c2ebdc68aa6bb00fd67dc55ab12cbd7a066a42
SSDEEP 384:zy+aQikB+z/xvxjg/qhEZNgmRZljrRhWD7Fm9zK:x/UxvxjgC+DRrTWD7oFK
TLSH
T1D2828E3BE468BE2358F7EA45760A1B5BCBB8856250C51FF489E92F0D06C73AD0707D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 18KB
SHA256 f1bfdfb43c6e17fd5ae324501b02773ef1813bd75ba680b5854ce404c2019512
MD5 07f68e1d935fb65b36cb13b71d22913c
SHA1 e1fb562a1d52319fdd09ad7f703867ae264ef5b1
SHA512 8cbdf11c7ecb76eede24e9d236fa76f7c723d8bc7ff046f5b21bd61a8ceb3c08af7a01d42540afe7de923a48f32b4654cedb28cf80f8eb3c7b3781652ca434a4
SSDEEP 384:zU+aQikB+z/xvxjg/qhE3XNgmE5ljrRhTD7Fm9zK:X/UxvxjgC+3pELTTD7oFK
TLSH
T189828E3BE468BE2358FBE644760A1B5BCBB8856250C51EF48DE92F0D06CB79D0707D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58d136.TMP

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.WebView2\EBWebView\Local State~RFe58d136.TMP
Size 1KB
SHA256 974a1426f714e14ef4f656b529bb452ea9cc43d230ca5500d4b174044353aa21
MD5 06ff29099af468d813dac319423ee2bc
SHA1 c16d3e86107f0796001f6ea93ef3fdb9523437dc
SHA512 3d2cefe0cf1fa6ab47dc590312e412bb6969660b29b43d79ab09e718b9a8f0cd474b6b4b875710e4128b113e3953cc28e604f709c3becc52f1f4418f28cd46f3
TLSH
T1202184B7D0AD7E3268CDA98871037F5B1D34916A81205E1891DE670802FB5AC873FC32
MD5 SHA1 SHA512 TLSH

Submit Download

OWinstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OWinstaller.exe.config
Size 632B
SHA256 272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827
MD5 82d22e4e19e27e306317513b9bfa70ff
SHA1 ff3c7dd06b7fff9c12b1beaf0ca32517710ac161
SHA512 b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9
TLSH
T1F9F0E11048C4FF268F3185A33B774814EF3883B7108C091C705E39AB0B271964317233
MD5 SHA1 SHA512 TLSH

Submit Download

OverWolf.Client.CommonUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\OverWolf.Client.CommonUtils.dll
Size 674KB
SHA256 43a581a5c77695a08682fadfef7e8c2e835948a528b98ca832ef25e8ae329c6d
MD5 1e5240a947fe7bdd6b80f6e61743f5ef
SHA1 fbc9443f12f76a88c6283fffc3614188729f3f50
SHA512 c26cc32d0cb9b5f81196ede4e152720f22cdd9a8548dc4c4bfd69e14a6b5143a8861884f0c5a4b021c0a16faf29c0c5595b55055997dfe368d99e76799646ccf
SSDEEP 6144:tIs/33W831W3kq80Fh0Q+9J3WKuA+KMO/K5eFbPfnoueh/78fbpDdhg10YJs:tIy3U3kqa9yO3louGUbLj
TLSH
T14FE45A1233F8866AE0FF5B35A8B0121147B1F547A662EB4F399C904D1FA27498D61BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpRaven.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\SharpRaven.dll
Size 82KB
SHA256 776c6b0642f7a3f3f3ad3cc6bb5f1d528e90c6029b671d8f82b0320b185b92a7
MD5 271251960bf1d6a491803e15bd562e45
SHA1 1a305315dec8b44b4d80ef8c23452880b7e90380
SHA512 d5fe5c76f2074a05d32785945ee9f088fb4293786968a1c84389233d83e9bf0480d04d5fa9676c70fd0fed47213f434ec0e0cb2e38379f720919d680336aed4c
SSDEEP 1536:aa9qjviI1YjOrfRK9bvyyfpHbnzDwky7PndZ:aEuqI1lRKbvyyB7nly/
TLSH
T13C832B3123988728CF9D6734B078225A63B8625E3B31E6D6DB1C615E6F973C347212B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\System.dll
Size 21KB
SHA256 4dbc79d2b1c7987cc64bb5d014db81bb5108bdd6d8bf3a5f820fac1ded62be33
MD5 51bd16a2ea23ae1e7a92cedc6785c82e
SHA1 a9fbaeb9a695b9f2ba8a3ed8f0d95d2bf6a3d36c
SHA512 66ffc18b2daf6c4cba01aef0e4af2f006a51aa218eab0f21dc66e47eea0389d2b1748ef0e30d2ec9f0123fd7f38ed3aee964dd6bde5779aaee19ebf55369af79
SSDEEP 384:ASUmlw9T7DmnI5+N273FPlIYiPWfPJsaAM+o/8E9VF0NySk/bF:ASYTrINE3cYiPmvAMxkEt/Z
TLSH
T197A28DA246509CB1EC468D7074C8AB3B5B3866476AD0CAD3A3A7C0419F543C77FBC2B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\UserInfo.dll
Size 14KB
SHA256 a27dc3069793535cb64123c27dca8748983d133c8fa5aaddee8cdbc83f16986d
MD5 1dd4ca0f4a94155f8d46ec95a20ada4a
SHA1 5869f0d89e5422c5c4ad411e0a6a8d5b2321ff81
SHA512 f4914edc0357af44ed2855d5807c99c8168b305e6b7904dc865771ad0ee90756038612fe69c67b459c468396d1d39875395b1c8ec69e6da559fb92859204763e
SSDEEP 192:9xvcecVMIYiYF8tO7zhjjWvp9A5K+o/y2sE9jBF0Ny+aiQE7:kruIYiPWhjjWvHAM+o/8E9VF0Nyp6
TLSH
T1C2624BB386A45C15DC0B8E7135C8997B9EB0FB922AD081D7621BC1814B84787BFED2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\WebView2Loader.dll
Size 161KB
SHA256 465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f
MD5 c5f0c46e91f354c58ecec864614157d7
SHA1 cb6f85c0b716b4fc3810deb3eb9053beb07e803c
SHA512 287756078aa08130907bd8601b957e9e006cef9f5c6765df25cfaa64ddd0fff7d92ffa11f10a00a4028687f3220efda8c64008dbcf205bedae5da296e3896e91
SSDEEP 3072:7evoTTlTRTyiuPThTNTKm81SbbMYSPLNsknZiZ2HZ5AaliiT88FEtJ57dXSvlCW:HTlTRTyiuPThTNTKmFQdhsknZiMHfEti
TLSH
T120F36C5B72E4407BE16B8274C9A34A11E77778110B60ABEF03A447791F237D4AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\images\icon.ico
Size 34KB
SHA256 2b0767136e971cbc99daf157675af67cc997852d996ea01d0dc2aa482959aa00
MD5 2d76837971d64e5ad529ddf8b03820b0
SHA1 1ac4cf8f20905f6bb109c4c7e8cdf3b7cafcbb3c
SHA512 50fd1c547da87d26b54432ee8e773d33e7297e6af3e0d02f62b97d0aebaee2d603ea9c69c03d76339649dc61a87ff78ebb0ce5ca8570282a0015a7dd1a40d236
SSDEEP 96:kdR+F577lVzB67GhriqPaV2JgLtwaJbfB8R1b9RpsLZuSgV6slvHq1N:kdRO5xVNxpiKRJgLtw0aeKvHq
TLSH
T10CF2414AEB63A53CCE64417291E2AA25B7B0739B2837DE0E743B2430DC133073EE8595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\index.html
Size 27KB
SHA256 452154a082fd36b9ec8b5230bf4b6708c4715153e78fad120eb25828fa89381b
MD5 14c405b7892f466f89d16bb5b3ec68ca
SHA1 d7ba5ce2b5efd4bedc78c3c78eec5274df5b6898
SHA512 6795fe8c7072adf44ef990a12f9a840421622b2c0836a3590a7905e135d42be922f9db1070e09c1fd2f82f1c5d2ee09b4526e27e2454b04923e84d52afa49b68
SSDEEP 384:23JlhPshoRJ/seq06ItLglbyPasN1vnYogfZZ51Px+mppiq:2OhoX/seq06ItLglbyPa65nxq5xtoq
TLSH
T1D9C2D811DA36102CB237462AB5E2BA4E7024C117E6538A7FFA5C5635CBDB08B1E13BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

block_inputs.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\block_inputs.js
Size 789B
SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
MD5 b5b52c92b90f4283a761cb8a40860c75
SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
TLSH
T14301D2D864D3A87A597DA328536BE748F7391964905A1054F0DC8C64BAF003BC16EDFD
MD5 SHA1 SHA512 TLSH

Submit Download

cmp.bundle.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\libs\cmp.bundle.js
Size 391KB
SHA256 039d5d4e442cc360b6f54923c53cba5432d80727b8d614a3ee99f7c70307bcae
MD5 48ccfc31db67a9e9d6decd5b18df96f3
SHA1 2086877b894bd0ddec2ae80dd853e47fcbdc638d
SHA512 e369682bbba708ea66797024bc2885e85a4e2b4ac6a4005cc648a7a81d8a4b1c3691c5484408bbd847c40ee80d12e72c5d9722950da020b284843c10d05d0963
SSDEEP 3072:iyUYM9z8F+GxPMqbOISP88WEAtvgnnhLCVJkNO7Z6BEFltnxKg8rq0gU:LrF+GxPQWEDLmkNO7Z6BAly
TLSH
T13D842B8D7991B0E617D722F1802F900BF33A6458784CC490B660D8F1ADF96AD927BF6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notifications.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\models\notifications.js
Size 5KB
SHA256 c32495d55eed52f47dc7268eeccb90fb6bdc5686135ed089416c6bb8f703a578
MD5 911451f65b2503d23bc27c6a6aa6af72
SHA1 01d3654b23ef7f5adeb4097bd851e8c100a7b2ab
SHA512 06edaebb0bb2980a7b6d6baa31a9c0894a9bb5f14a91468ffb8f182d98f04bb811df2a4c37f0b56d612603528aa21f390eaa7cf885874ae770a24dce2f9b249c
SSDEEP 96:sOr8u1s9FHYYdfHsW/GZwzpJGf8mui+U8QrGjqTxoOxoYsdfHsW/GZwvpZGNjINU:sGu9GYl3rNQ8K+JQC+N5Rsl3rxeEYIo
TLSH
T1F5C1AB5F90BA00A7057293A819370342FA5753AF49408CAF737C5EB40F311A6B4E5EDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analytics.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\utils\analytics.js
Size 5KB
SHA256 0a3b80a0263691f71e85ec681be87229e6325a7d173ff430bbf4eb7fa355476c
MD5 52b20797b4568fd9eaa065d676b7a344
SHA1 a14cb0b575f2a7d274a78093d74906351b603dfa
SHA512 f99786edcfc0220f1563617f40441f9b0ff02083be2c1847677b6533f7d1de16911227e349fe41e328800230bc2994b70db3ab79e4acef5fe07631e87aad0c5f
SSDEEP 96:LlYkmHqqVHlnZrJGvt+QP2EZc8kukLQsO2LT+gObNSPgPgzauV:AHqSGV+kC9zNObNSPvzaA
TLSH
T1A9C199292469719068B373B68F5B1518EBB116233144E9223BBE87415FF6D02C693FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

commands.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\utils\commands.js
Size 15KB
SHA256 160ca35f80aeae58f6723c37cdd3e52cbb4ef56e659fbe105a8edab1f0f35ace
MD5 ccfc18e42871f7eb701c54bc1833dcfc
SHA1 7da62247f4383148109c198aee1e26c21484104c
SHA512 f6a08520790106482faf6345ab534210f14e8b5629880f875af8f4210a3d1b7efb24e05dbeed895e2044034a6d535a4b4cc2dae34f5b15e7c4960806c2d0340a
SSDEEP 384:2Ur5Hs8cD+1uUPULQq06WCHp7GvvoWqEWOnvsUmd:2MwGUd
TLSH
T1C872EBAA68A721651933B73DDB9B0215FB33083B11465C147EED46917FF6402C2A6FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\utils\cookies.js
Size 1KB
SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
MD5 6c60e675f8c8c68c0174b644d3a63a2a
SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
TLSH
T17721E0087580D81EC5725739AE286778FD30992611C6D54DB88CA4F02F30C169DBE9FF
MD5 SHA1 SHA512 TLSH

Submit Download

modal-events-delegate.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\utils\modal-events-delegate.js
Size 1KB
SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
MD5 117e4fdbdb0ecf211c8bd909efd337d1
SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
TLSH
T13C31D54D36FD173AE5B7172B5B2F5F8CAB72120B09054A26B2E69A804F354241196CFF
MD5 SHA1 SHA512 TLSH

Submit Download

strings-loader.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\utils\strings-loader.js
Size 5KB
SHA256 9b833f9e058ddb31ada44764449fe030f05e241dcefdef46886a74e30cd04ba5
MD5 8ac781fa72423fc5c4c21a8c4138b709
SHA1 50ad1d7f383d6801c57f916e46c1c17f79222725
SHA512 f78558488968b1151b189545294a0bb97131c0a4d5dc0fa61ef168d999151e0f12af271389aae985d129adacfc6bf610b0191fb912ffdf8e97283829e2802604
SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6Wfwk0lx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6WGe0muXDK0W
TLSH
T132B1ED58289354118C32B764CD935264ED6A4917023996F3FDEEC2686FB149E82F8FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utils.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\utils\utils.js
Size 118B
SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
MD5 a0952ebeab701c05c75710c33d725e7e
SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
TLSH
T1ADB01274B7AC73A2D315377AACBF6C1DF0375C368414B099B19034E19572D04519DCD4
MD5 SHA1 SHA512 TLSH

Submit Download

cri-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\windows\cri\cri-controller.js
Size 5KB
SHA256 8c8c3097f0b587d715e051f55894d73a0fb7b441024f47512fa340eb3f692152
MD5 344b079e423000460dbcc623d3dea42f
SHA1 6f7a6db5cdf0e4c511ae1ec8aa1f08dd9e79190c
SHA512 15358d30f96ba6ec330417896ccd5c837e71b1712357185d7d84e60e8e6c21af52eadc1fcf61f6ce9a79165fab94813370a5ef0b632742043355ae3eb7eb6856
SSDEEP 96:u6CeVFfOhETv5T6ToY/aq4bCWCtoQNxcGyUkeErscwn:u6jVtOyl2EY/aLmWCyQNxaUkrscwn
TLSH
T1BAC1DC9C7CF9866058B7277BCF160518E732420722426A2B7AFE83404FF5E404A16FAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\windows\cri\template.js
Size 1KB
SHA256 016ef6ba4ccb64f2cbdf63357d180f0d3a5f74857633556b311eff57be8d023b
MD5 2f82acef2d339db31fab5c73edf8af19
SHA1 d9138de6fe1320cd232fd6e1971fbbfdb9225bd6
SHA512 90311035970edf2c1d0175c9b718c731fad4f58ad5a0b43a2588e2e6132cc09deff1d49328174408c51fe3082d62612f7a2a6c25179ac474101468ab68c2abcd
TLSH
T188212E24441C90331B7B979BDA13276CE9519301D80B7D3871AE43A82BF3B828E62359
MD5 SHA1 SHA512 TLSH

Submit Download

cris-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\windows\cris\cris-controller.js
Size 9KB
SHA256 13f1bb9718444c1e15dc13cd99862c8ad4cd9f1a607680906309f1ed9a058231
MD5 056d641203097bf638dc846e01712869
SHA1 64f77761e9eab875f8dfa67f3dc5d488aeb9d4f3
SHA512 88e1e2e7d26fee9a37ae9b0c9fea3e61066a9c71f15b8a6e328bec6880f6b9795ec8e85af6055350d2a10d5bb814cdb6cd5c0fc09f29553dfa4b2c6d8f64a3c8
SSDEEP 192:nCoyl2vxrZn2C7s+vK/H0mIvo99hnap0kelwPcGMJ7i9W:9yl2JV2C8/HyqkelGh2Z
TLSH
T116120E1998BE26299A777375CF6A0508FB3042172944EA1A7CEDD3940FB950182B7FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\windows\cris\template.js
Size 480B
SHA256 c6c0799e027b5554e44e1c31262ef62b2879bdf1b862fae56615426f07f471d9
MD5 408961db547931d2427d96035dc7245c
SHA1 8a0330bf52f53cb1e82e36cd67723ebb29d7a6bf
SHA512 08d79c8f54cc9898956df5b4de8360a38d482ad19ce155e84a33843221a0242240c59c49ce0ef980e150fddce716557bee7071a6525ef438fdcde9bdacee95aa
TLSH
T1B5F02E114135CE20373F17BE93631B28F631D0024A82E634D5DB5790333B4E78A96769
MD5 SHA1 SHA512 TLSH

Submit Download

modal-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\windows\modal\modal-controller.js
Size 2KB
SHA256 e3556a5482b5a8c9f9581902d9c91b9293fb664f6da938c700bc78c21fd1506b
MD5 aa727a41b4fbe5c3ceb80c32a5b9c7ef
SHA1 de32c713099c441a9bf60a1fb06d76775b2078e6
SHA512 dacc2df7748a5f859c7debb34503d031d0689fa445898f1f2cf26f909332c5ca1e7bdd5dfc28e110d2f09283ec975960be84cfc4b34630b0fbac1046de6864c6
TLSH
T19451268A241E116585B7677FCF87029AFF73509B4A41421A3FCD8B411FB0850A3DFEA9
MD5 SHA1 SHA512 TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\windows\settings\template.js
Size 4KB
SHA256 8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f
MD5 28513de0830383a516028e4a6e7585a0
SHA1 d31fc3a6f4a3ce6c4afb82ff2342a1ed718809e5
SHA512 0f7321c2ae13145bb694368dae1b74e6fe20e6b09712da2178bc46e6aa65223ab84c38abbf0ed074c85b42dba1a238a5f3f8d1ae060a0af6df748c5befe11b61
SSDEEP 48:Zx8LQmDdbaoFRpm4+0A2AEeQmDdbaoFCpm4+0A2AW:wpm4+5nHym4+5nW
TLSH
T18891086384219412477680DA5B369F1EFB65CF0241E65E34B2FF6BCC978BC8156ABB0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\windows\welcome\template.js
Size 1KB
SHA256 42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb
MD5 17f54fca6723b983875d940d931e0afb
SHA1 01774cd5cea36bd74c80a708d6f77567e8091024
SHA512 401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038
TLSH
T12D31FF0AC55D81361533C3FAE28B5A5C7860AE40C9BDBC3439AF075967ABC00B933B70
MD5 SHA1 SHA512 TLSH

Submit Download

welcome-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\js\windows\welcome\welcome-controller.js
Size 2KB
SHA256 50a9faf985750a344344657dffb6880dbad95d2f0a060d911224f2addc6995a9
MD5 163f58f27116d6fa6f82aa9512259fa5
SHA1 8ae067638d5c3889d12ff18d3725982bbb76dd91
SHA512 a8d14643dce70da2fa5b9d519bdb012a2d1567f857d24c4cdad0bd4b42eec65b04e76a2e876cba0e7a6c433ef316428b2dfea42edcbaae15d874ad38d7eaf6ad
TLSH
T14F41DD9DA9B583742A357B3EDF2A0748FB32922F0A19866D79CC52410F71014425AFF4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\app\manifest.json
Size 691B
SHA256 6fb3383f94e63810149126e2a504a3b35fc9a7fda46f405cb610aa61f8198134
MD5 4cdc836d09caedc9a5740ea954e20db4
SHA1 e715a84365aa15ab6ee3fcf4c764da054e06533f
SHA512 801d6ab2bb2582084f6f19caff75035a87f55a3ca9375a28bac1b2fecc63bf5c19f0eb624ff70ebba8f300fa4c91c885c598efe304c6b3c4eb5029a0771f0968
TLSH
T18D01A419E8946DAB157A761668E50701FB85433F02024E4B37BC504C5FB21592457E74
MD5 SHA1 SHA512 TLSH

Submit Download

log4net.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\log4net.dll
Size 270KB
SHA256 ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309
MD5 f15c8a9e2876568b3910189b2d493706
SHA1 32634db97e7c1705286cb1ac5ce20bc4e0ec17af
SHA512 805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e
SSDEEP 3072:F+8gmdoxSO7ZbQFroo7RVir/dtnK0sgdnogtHcU5qFG1RSGCkE9kKn7GCcaLoWnS:I1N8LLI/PK0scnodG1RS1T93caLQD
TLSH
T15044065477F84A19F2FF6BB8A475411587B6F946B87ED39E0A80A4FC2C33B1089117A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uac.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\uac.dll
Size 24KB
SHA256 10a0e8cf46038ab3b2c3cf5dce407b9a043a631cbde9a5c8bcf0a54b2566c010
MD5 861f7e800bb28f68927e65719869409c
SHA1 a12bfcd2b9950e758ead281a9afbf1895bf10539
SHA512 f2bf24a0da69bbe4b4a0f0b1bfc5af175a66b8bcc4f5cc379ed0b89166fa9ffe1e16206b41fca7260ac7f8b86f8695b76f016bb371d7642aa71e61e29a3976eb
SSDEEP 384:5GVY6ClGoWxXH75T1WVl83lLsFIYiPWc+6AM+o/8E9VF0NyOk:tBWxXH9TYqlAyYiPjAMxkEH
TLSH
T14BB27DE682980E6AEA235D3175D563335FF8B6502DE0C1DF161786448B607D3BB3C27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nspC436.tmp\utils.dll
Size 58KB
SHA256 251ab3e2690562dcfcd510642607f206e6dcf626d06d94b74e1fa8297b1050a0
MD5 c6b46a5fcdccbf3aeff930b1e5b383d4
SHA1 6d5a8e08de862b283610bad2f6ce44936f439821
SHA512 97616475ef425421959489b650810b185488fcb02a1e90406b3014e948e66e5101df583815fd2be26d9c4d293a46b02ba4025426f743e682ed15d228f027f55c
SSDEEP 768:cmLFb5dc9LS+8dayUhaPxYkkLE53UEDNnxqWLb1pA26MbwYiPbAMxkEu:cmLFtd9+O0fkV7xpD6ww7Pbxy
TLSH
T1AD434B1172A0C433D5665A3069E8D6629E7E7C422BF480CB7FA9027E5FB13C16B78367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallerTrace_2026-08-10_05-50_4024.log

Path C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2026-08-10_05-50_4024.log
Size 4KB
SHA256 20438eacb0e99de084d976d82c11298e88a60e51817e655973dddc7b6384a984
MD5 a17356ff8e206b00ee978d13bfe239ca
SHA1 ae9ec3f1dcc74b8e3c6120a9ec888b11d18a68e3
SHA512 b00dc6b62d5457743a970e73289406357beb2ef4089053b8e378ef3e1b75e2a400a6c4337e4e80d7298f8b4259b69b6dc4837114b59e892040cc9c664c3fcac7
SSDEEP 96:K+0h+oj1j5w0SujB6fiMw+/U+Qv+nv+u+nR+U+d++R+gj+q+gj+F+gj+K+Mu+2+h:LVojB5w0RjBulpjmXn0Rx0gigpgu+fN3
TLSH
T15BA1BE060EBF0CF08D53820E952B4A3E55737843F31E6061AAE5364A1E76B04DDFCE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallerTrace_2026-08-10_05-50_4024.log

Path C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2026-08-10_05-50_4024.log
Size 1KB
SHA256 199cd2df6664615770772371bc6f90060cd7f336792ed99f3bd7d7e263ecce02
MD5 af15e913f30ef6abc02fd0963fae7eb1
SHA1 531cc5750e3c2fdaa81f87a8e557e70bbfbfb894
SHA512 6ff5216ca05e8fb63cb8d564133a9401e29a1410e7dff49fbdc7782738d3eecfa90fdc39d975b146732550b89b6907ede9173338cdcd6ddab4d05908ed84360e
TLSH
T10431BF640D9FD8F14D574B4EA63E4A3EA0B3F806F11A305066F936865BA2A50C5FCD49
MD5 SHA1 SHA512 TLSH

Submit Download

CurseForge Windows - Installer.exe

Path C:\Users\Admin\Downloads\CurseForge Windows - Installer.exe
Size 2.9MB
SHA256 c8a11fced0b0cb6c66d490f094313ef64446b88fbc2d99672d9a2c75c36bff94
MD5 f1388ee3b468e7c912e6a5e0ddbc758c
SHA1 8784db35a6721a95eecf5973ddef8cf5c096e685
SHA512 16bfbb192d355bef20bbd110960cb05b4451fdb768c76c96a21f40be98a35f6b3e7dd5fd44d8e0c0d3777d1d730111c831f8bd9965f923aa5c51696448e4a067
SSDEEP 49152:WLNFeI8xE87vxpsrFpIvQ4kvoHch90ksssY1XbGIw3UhsooAFhR8MEYHzcYqoP:WxUBPN+TIvrWccYXQ9bGrkhsbc8MEYT9
TLSH
T1ABD53322C27F816EDB12C57179B441AE9166CF16223B0FADF7C4E8A46456B83734C87E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-618-0x00007FFB7CB10000-0x00007FFB7CB11000-memory.dmp

Download

memory/984-617-0x00007FFB7C2D0000-0x00007FFB7C2D1000-memory.dmp

Download

memory/2360-1369-0x0000000070170000-0x00000000701BC000-memory.dmp

Download

memory/2360-1356-0x0000000005A30000-0x0000000005D84000-memory.dmp

Download

memory/2360-1377-0x0000000007640000-0x00000000076D6000-memory.dmp

Download

memory/2360-1378-0x00000000075B0000-0x00000000075C1000-memory.dmp

Download

memory/4024-511-0x00000188A8FC0000-0x00000188A8FCE000-memory.dmp

Download

memory/4024-486-0x00000188A91B0000-0x00000188A9260000-memory.dmp

Download

memory/4024-508-0x00000188A9010000-0x00000188A9032000-memory.dmp

Download

memory/4024-464-0x00000188A8E10000-0x00000188A8EBA000-memory.dmp

Download

memory/4024-504-0x00000188A9260000-0x00000188A92F0000-memory.dmp

Download

memory/4024-473-0x00000188A8F10000-0x00000188A8F28000-memory.dmp

Download

memory/4024-469-0x00000188A8EC0000-0x00000188A8F06000-memory.dmp

Download

memory/4024-467-0x00000188A93F0000-0x00000188A9918000-memory.dmp

Download

memory/4024-466-0x0000018890550000-0x0000018890564000-memory.dmp

Download

memory/4024-460-0x000001888E880000-0x000001888E8D4000-memory.dmp

Download

memory/4644-737-0x0000026F374C0000-0x0000026F374C1000-memory.dmp

Download

memory/4644-731-0x0000026F374C0000-0x0000026F374C1000-memory.dmp

Download

memory/4644-732-0x0000026F374C0000-0x0000026F374C1000-memory.dmp

Download

memory/4644-730-0x0000026F374C0000-0x0000026F374C1000-memory.dmp

Download

memory/4644-738-0x0000026F374C0000-0x0000026F374C1000-memory.dmp

Download

memory/4644-739-0x0000026F374C0000-0x0000026F374C1000-memory.dmp

Download

memory/4644-736-0x0000026F374C0000-0x0000026F374C1000-memory.dmp

Download

memory/4644-741-0x0000026F374C0000-0x0000026F374C1000-memory.dmp

Download

memory/4644-740-0x0000026F374C0000-0x0000026F374C1000-memory.dmp

Download

memory/4644-742-0x0000026F374C0000-0x0000026F374C1000-memory.dmp

Download

memory/4768-544-0x00007FFB7C2D0000-0x00007FFB7C2D1000-memory.dmp

Download

memory/5132-1251-0x0000024A58F80000-0x0000024A58F81000-memory.dmp

Download

memory/5132-1249-0x0000024A58F80000-0x0000024A58F81000-memory.dmp

Download

memory/5132-1242-0x0000024A58F80000-0x0000024A58F81000-memory.dmp

Download

memory/5132-1240-0x0000024A58F80000-0x0000024A58F81000-memory.dmp

Download

memory/5132-1241-0x0000024A58F80000-0x0000024A58F81000-memory.dmp

Download

memory/5132-1248-0x0000024A58F80000-0x0000024A58F81000-memory.dmp

Download

memory/5132-1246-0x0000024A58F80000-0x0000024A58F81000-memory.dmp

Download

memory/5132-1247-0x0000024A58F80000-0x0000024A58F81000-memory.dmp

Download

memory/5132-1250-0x0000024A58F80000-0x0000024A58F81000-memory.dmp

Download

memory/5352-665-0x00007FFB7C2D0000-0x00007FFB7C2D1000-memory.dmp

Download

memory/5688-1330-0x0000000007D30000-0x00000000083AA000-memory.dmp

Download

memory/5688-1288-0x0000000004DE0000-0x0000000004E16000-memory.dmp

Download

memory/5688-1289-0x00000000055A0000-0x0000000005BC8000-memory.dmp

Download

memory/5688-1306-0x0000000005500000-0x0000000005522000-memory.dmp

Download

memory/5688-1307-0x0000000005D00000-0x0000000005D66000-memory.dmp

Download

memory/5688-1308-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Download

memory/5688-1316-0x0000000005DE0000-0x0000000006134000-memory.dmp

Download

memory/5688-1317-0x00000000063B0000-0x00000000063CE000-memory.dmp

Download

memory/5688-1318-0x0000000006440000-0x000000000648C000-memory.dmp

Download

memory/5688-1320-0x0000000070170000-0x00000000701BC000-memory.dmp

Download

memory/5688-1319-0x0000000007330000-0x0000000007362000-memory.dmp

Download

memory/5688-1328-0x0000000007570000-0x000000000758E000-memory.dmp

Download

memory/5688-1329-0x00000000075A0000-0x0000000007643000-memory.dmp

Download

memory/5688-1331-0x00000000076F0000-0x000000000770A000-memory.dmp

Download

memory/5688-1332-0x0000000007760000-0x000000000776A000-memory.dmp

Download

memory/5688-1333-0x00000000078E0000-0x000000000790A000-memory.dmp

Download

memory/5688-1334-0x0000000007910000-0x0000000007934000-memory.dmp

Download

memory/5688-1335-0x0000000070870000-0x0000000070BC4000-memory.dmp

Download

memory/5732-1399-0x00000000702F0000-0x0000000070644000-memory.dmp

Download

memory/5732-1390-0x00000000057B0000-0x0000000005B04000-memory.dmp

Download

memory/5732-1391-0x0000000070170000-0x00000000701BC000-memory.dmp

Download