6b326fd1cf9a586d8ccad6395afb180f69351b313443501f2866099f2e02b73c

Analysis

max time kernel
152s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Era Setup 3.0.9.exe
Size 149.5MB
Sample260810-jp87layvcx
SHA256 6b326fd1cf9a586d8ccad6395afb180f69351b313443501f2866099f2e02b73c
MD5 29aa22e73404ea3ba76749b43c853b2c
SHA1 44db0ffab8ecc915e1b52cc5268341f79e28c40d
SHA512 2eba84e45559dc98e150919244421a14d44600a68d85f10d01521b2041a326be27809bae76e93efbc4306722b2b6d2443d9f18c25d0f65c5d5d80de5357f92c7
SSDEEP 3145728:pLwCzwwpkOvHUMcbAwROoKrumGLWsyK9kEv/LKPXD0LADLo:lZtUMcbAwUon/WsyK9f/uXoULo
TLSH
T11B7833C7CC159C0BD521F47E87A06EBB0D413C6BD68136839B62FDA0A8F7891DF68856
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4600	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
2136	Era V3.exe
1216	Era V3.exe
5396	Era V3.exe
4140	Era V3.exe
3676	FortniteLauncher.exe
3412	Era V3.exe

Loads dropped DLL 22 IoCs

pid	Process
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
2136	Era V3.exe
5396	Era V3.exe
5396	Era V3.exe
3412	Era V3.exe
3412	Era V3.exe
5396	Era V3.exe
5396	Era V3.exe
5396	Era V3.exe
5396	Era V3.exe
5396	Era V3.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Era V3\snapshot_blob.bin	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\icudtl.dat	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\id.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\vi.pak	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry\cli-win32-x64	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\el.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\es-419.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\fi.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\pt-PT.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\sv.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\LICENSES.chromium.html	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\vulkan-1.dll	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ca.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ml.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ms.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\workers\downloadWorkerPooled.js	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\chrome_200_percent.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\LICENSE.electron.txt	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\en-GB.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\hi.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\lv.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ur.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\zh-CN.pak	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\bn.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\he.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\it.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ru.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\app-update.yml	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry\cli-win32-x64\package.json	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry\cli-win32-x64\bin	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\binaries\FortniteLauncher.exe	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ar.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\es.pak	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\workers	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\workers\diskWriterWorker.js	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\workers\downloadWorker.js	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\dxcompiler.dll	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\bg.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\sl.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\sr.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ta.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\th.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\app.asar	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\am.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\da.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\hu.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\ro.pak	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\binaries	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\vk_swiftshader.dll	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\af.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\lt.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\zh-TW.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\Uninstall Era V3.exe	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\dxil.dll	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\vk_swiftshader_icd.json	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\gu.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\mr.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\locales\sw.pak	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry\cli-win32-x64\bin\sentry-cli.exe	Era Setup 3.0.9.exe
File opened for modification	C:\Program Files\Era V3\resources\build\Release	Era Setup 3.0.9.exe
File created	C:\Program Files\Era V3\Era V3.exe	Era Setup 3.0.9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5316	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Era Setup 3.0.9.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Era V3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Era V3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Era V3.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fluxapp	Era V3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fluxapp\URL Protocol	Era V3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fluxapp\ = "URL:fluxapp"	Era V3.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fluxapp\shell\open\command	Era V3.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fluxapp\shell	Era V3.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fluxapp\shell\open	Era V3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fluxapp\shell\open\command\ = "\"C:\\Program Files\\Era V3\\Era V3.exe\" \"%1\""	Era V3.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4600	powershell.exe
4600	powershell.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe
5212	Era Setup 3.0.9.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeIncreaseQuotaPrivilege	4600	powershell.exe
Token: SeSecurityPrivilege	4600	powershell.exe
Token: SeTakeOwnershipPrivilege	4600	powershell.exe
Token: SeLoadDriverPrivilege	4600	powershell.exe
Token: SeSystemProfilePrivilege	4600	powershell.exe
Token: SeSystemtimePrivilege	4600	powershell.exe
Token: SeProfSingleProcessPrivilege	4600	powershell.exe
Token: SeIncBasePriorityPrivilege	4600	powershell.exe
Token: SeCreatePagefilePrivilege	4600	powershell.exe
Token: SeBackupPrivilege	4600	powershell.exe
Token: SeRestorePrivilege	4600	powershell.exe
Token: SeShutdownPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeSystemEnvironmentPrivilege	4600	powershell.exe
Token: SeRemoteShutdownPrivilege	4600	powershell.exe
Token: SeUndockPrivilege	4600	powershell.exe
Token: SeManageVolumePrivilege	4600	powershell.exe
Token: 33	4600	powershell.exe
Token: 34	4600	powershell.exe
Token: 35	4600	powershell.exe
Token: 36	4600	powershell.exe
Token: SeSecurityPrivilege	5212	Era Setup 3.0.9.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe
Token: SeCreatePagefilePrivilege	2136	Era V3.exe
Token: SeShutdownPrivilege	2136	Era V3.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 4600	5212	Era Setup 3.0.9.exe	89
PID 2136 wrote to memory of 1216	2136	Era V3.exe	95
PID 2136 wrote to memory of 5396	2136	Era V3.exe	96
PID 2136 wrote to memory of 5396	2136	Era V3.exe	96
PID 2136 wrote to memory of 4140	2136	Era V3.exe	97
PID 2136 wrote to memory of 3676	2136	Era V3.exe	98
PID 2136 wrote to memory of 3412	2136	Era V3.exe	99
PID 2136 wrote to memory of 5316	2136	Era V3.exe	101
PID 5316 wrote to memory of 4288	5316	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\Era Setup 3.0.9.exe
"C:\Users\Admin\AppData\Local\Temp\Era Setup 3.0.9.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Era\dll\era.dll\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4600

C:\Program Files\Era V3\Era V3.exe
"C:\Program Files\Era V3\Era V3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files\Era V3\Era V3.exe
  "C:\Program Files\Era V3\Era V3.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\era /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\era\Crashpad --url=https://f.a.k/e --annotation=_productName=era --annotation=_version=3.0.9 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=39.1.1 --initial-client-data=0x514,0x50c,0x47c,0x510,0x504,0x7ff77ebb2a4c,0x7ff77ebb2a58,0x7ff77ebb2a68
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Program Files\Era V3\Era V3.exe
  "C:\Program Files\Era V3\Era V3.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,15723898025846499084,2430831129874962001,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5396
- C:\Program Files\Era V3\Era V3.exe
  "C:\Program Files\Era V3\Era V3.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --field-trial-handle=1840,i,15723898025846499084,2430831129874962001,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Program Files\Era V3\resources\binaries\FortniteLauncher.exe
  "C:\Program Files\Era V3\resources\binaries\FortniteLauncher.exe"
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Program Files\Era V3\Era V3.exe
  "C:\Program Files\Era V3\Era V3.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --app-path="C:\Program Files\Era V3\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786348487681925 --launch-time-ticks=624371393 --field-trial-handle=1840,i,15723898025846499084,2430831129874962001,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2824 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed"
    3⤵
    PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\LICENSES.chromium.html
Size 14.4MB
SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
MD5 adc1ff1ecd313896455e610d15d4eaa5
SHA1 22180374f927b9132c3963caff9c1f28155010c3
SHA512 e0ac562a8eee4ac0d816ff107793176bfe00d6a91900f6f8ec1a7c9933b2078914d8b722da51cacdd40b31030537f57298e1a5d9121b6807b8acc43b736f75e5
SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDuKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwReXEn8mb
TLSH
T11AE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\chrome_100_percent.pak
Size 112KB
SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
MD5 e7bbddff3081eeecf7f56e76ce1d48e4
SHA1 eb83b418ad0e8f502f12a339cabc2fef8ec06cb4
SHA512 2caaa851d095d1a641b959cf092a2ce02328298aafdfadafc773eb0a0054054ae54c41574328694f6a37928203509a0c7e38f3beff1f4fd2ded00b5ed5531d85
SSDEEP 3072:z84PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:zRYWFUbGz8LI1TnjQBQCrC
TLSH
T13AB3D0D7B7B0AD7DDA474BB783560170FCB30B2D0682120A5A99E479653AF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\chrome_200_percent.pak
Size 182KB
SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
MD5 1e1744b9410d29e7d1ed28c4f67d6317
SHA1 4f3fcf3db1f8a1eeefd5a4c2f3f2d2b34c094a82
SHA512 10fbcc89ae3251f4c163beea1dd3a53bca239486e1ed7a997e9b04d3a6193266cd96db4a1f8b753942429305ae9ee28b1e9d3fee7e2ddfee847a4db40c8cea93
SSDEEP 3072:dl4J8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:tGQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T13804F1D373B8AD3DDA570B73926610E0FD7A20291EB3110A5A9F98397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\dxcompiler.dll
Size 24.9MB
SHA256 aca2fb078fe994aa3cb7773d5919c8822c94398f216371f214045ffca2a4320b
MD5 2f5501f38f1a2f37ec178b9059d3bd55
SHA1 f0092390a8a14d2d04a45101e64cafc0443fd7f8
SHA512 7ed07ad76368ef627b357f1544e5425090665c33c1481332c746093404aac3ae8acde134342a8ee4d30472eb31176d06049e7abb8d4a44aa9ad93bd3375b20ab
SSDEEP 196608:KINfcxXBXSsTP5HtTz2HF0guYYl8Cqe59luxQpB:KINfcxXhSsTPduubGa9lu0
TLSH
T1944729122246D49DF059C878C3678616CA6C34E73FA778EBC0B461252B7BEBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 e2e85d40ac197934302822be1f1202fa854e26797010dec6f8f743607ba1a390
MD5 41e9050778ba83ba6de2eec71a625e6e
SHA1 1669432043922f864702dd61cf30a3ad591be7d4
SHA512 1b5117a79cb7a188bd848e2b4b3fba2f9fedadf227465a44f5e7d912dff48a697b0c58d2e7fc9a2004a4a64e26aed46a096aa4c3896a59a061414e5ffd5499b6
SSDEEP 49152:q43V5jmDptM2VrfQQdFiO82PHb1SKj0vVr48vCkvjvvMHMnfDKmggnxu/zR7GI2U:qQ5sM4FiOLvbq59vjvvMHMnfDKmggnxS
TLSH
T1B9E5AE03F6D650DAD029D17197AB9313F631380A4F2056EF2A804A253FA7FD86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\libEGL.dll
Size 492KB
SHA256 690daa1746a91728a33e52c275e3d3842a4bc8e8621688abb8e56131cd38c37a
MD5 20b2b93cc2ed687c8cf30ac56d93ccec
SHA1 87f4b61a375561cf0a05231ae5253042b7506835
SHA512 0cd9f61615405e050b405e972a23e99e89193b26f2312f393aeade637cb761793f399be70e9161a12deae2891c8bc154807bb18da531911ee031cebdb54898aa
SSDEEP 12288:Hw+rH43DMhDrlUZbQn7k9OpcYumlRtHos:HzrH43M1cmj
TLSH
T1ECB49E15F3E945A9E06AD0348B434643DB72B8560B65FAEF03E092792F37BE45B3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\libGLESv2.dll
Size 8.0MB
SHA256 626f667e2991bde6986a7fc5bc740f351a23854bf66b6879417b4fd29ef5fdd9
MD5 31a901c697bac9c3a777a4d6e091b09f
SHA1 abb8682386807abc5bbd77e48744c570e94d8a2e
SHA512 c288acf86aa6f26c56b34548ff84dbc106c62956a6a6d16478740453df7ea8529c2aedc52191558fd1708bdfc9f50ac8cef6d30db67d94c198c35b2cf0438c44
SSDEEP 98304:Woq5GKNYmZJsRM2lORqToXVEIrFPgvzW/:WdvZaRM4T9IrSk
TLSH
T113867C03F69541D8D05DE2B8875BA227FA31B8490734B6CF2BA413152F6BBE0A77E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\af.pak
Size 567KB
SHA256 ebfdf1ca739f74b0b58a7965094274523fe2deb44fa0afff5bed98635b70326a
MD5 b5f869b49f8c3889eb01c015694acea1
SHA1 7388d387be5ed74c3405c2c164816c3e9ada6622
SHA512 1fe89e4e22264e3f292b041ffded2a9c123c5e04281a0f4dbdcd62f8ef0ab740c1eecdb53b7db8851859566fd363bcc1fc6749831316f8061fba9a4ced6a9dfa
SSDEEP 12288:KZGxy8RXxgtRGt+vWiRwONM8KuY3GB1sz4H2Jyn9N+saAQGmQo0v4JIAga2NF+UL:5E8RXutRGt+vW+wONM8KuY32sz4H2Jy7
TLSH
T110C41B0BE781173D09B07696FB0845B7BB9CA26CC770B2B6DDA982320966DFC11BD1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\am.pak
Size 921KB
SHA256 e04aff8c10e90113e7fd281e067ad2b95703a1ebfa2cfac5a38c7090ae58d5bd
MD5 9bd74d3269c71b8767f9c7ee05ad8b39
SHA1 b004407906f559e3cc761af02cf5a43d3d18bb52
SHA512 f9121d86e5125628837359e4df8b1c27c7b2f8e6bf35375994f24c96892d64a316d8023714144878a534155ea40d0f237b2652007e9272c12defa230fc70b7ef
SSDEEP 24576:UZOnXTe1jEthTCMpyGvxVdDSjyicVzAVXjf5530iA7V6zZYPhW:UZZ5n
TLSH
T1AB15AB547EF9F7570F8E8A19A4320E4E9594AE4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\ar.pak
Size 1016KB
SHA256 44c7e802f47dd41335825b824d11a50b7122f065469378da258fe68df5f59c0b
MD5 ab758b0129241bfb7e59cfa9f254029b
SHA1 70bc796dae0f2386dee47fb3c57256a4ca1347af
SHA512 fba366e14d7035181c95e5e3d11a8931174cd305e35731d4dfa29d2b70af8fd4ac5b210897abf691c972e2592645b390423d056308e4b651337d78cd2727ed0d
SSDEEP 12288:UJy+n0zKLnBTLVJTLGLawjh8u+7v4UDWdBMkM+S158pNjpPEKfL82X:UJ5PLH5oEo
TLSH
T13B258BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\bg.pak
Size 1.0MB
SHA256 c66991330d9f7423ee26ecb8737f234e17982d782237121352ae925c2e44f904
MD5 ce4262228ea06724993f54c16280bb63
SHA1 6d6d12c1167e99a3877eacd9a647442e8954d5ba
SHA512 810e1dd215740d2f9bf20e95d0a56549518336c6b39dc1612247d7d04643845918c7c9125cdac38dab6251fda529ab573b8a2e9afe8378d95b7bca6a9066c4ed
SSDEEP 24576:c2nzPWNy/LYJzQkECtUrVb6tbGdx373ZTm1z3GjK4UfVDIMX74u2VZsxI5e468K5:c2zPWNy/LYO6UrVb6tbGdx373ZTmZ3Gk
TLSH
T1433524A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\bn.pak
Size 1.3MB
SHA256 15a6cefa698a938d2212d1b0d275299dea5a2e8a3c292f80ef7ca43fd27472a4
MD5 05add4cf1c1fbd73134a5db1583b32d2
SHA1 fdbbbddbc53535ff44cbe231974b6f1706399c67
SHA512 99414c084085bdb17e9610ee3abe0d2de8730930def6e104e19d411a403747999e6a7df1446dbcffb547f0b78a43daf3f17f8887da818d4b488f52a65e293d4a
SSDEEP 3072:gDjCwY53JKRjXcc259J9gJfifHRIkWvLypUBbxVQL55BkwuHX:5wSJQjX3kWvLypUBbe5UwM
TLSH
T1A355EF209C6E81B6A8C5CDC9434C6370C523AE9B9B61F74DDC17A14938ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\ca.pak
Size 640KB
SHA256 f65d82a9e81a8c135e35de1086bb1728e84125e650c5a9bb3a1a5592612ca4a0
MD5 a03efd9fc5f507a844604ab1c25edce5
SHA1 bb57848fbe5d5830912054e7822670c3698c92c0
SHA512 8e31be9fead4776817848b26473b878e777fdacff95eb96172f9a5543aa8a804e70ce9e276a7445fc3614e4428859896b2c345ea0df5a00b90145c822db4e0d9
SSDEEP 12288:FKqcdGB7hjGlCiGh3UQU8K5PsFYN3Mw2juwHzejm0t3l7b7T5+vHlw9LX/fnWyF5:FKq42oTLAD2l8MNc30K5M9ZUy
TLSH
T102D408239FC93B7704D2330EFB46C217A48CA9847B16D254F4AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\cs.pak
Size 663KB
SHA256 d1b71e5fc5eeae3fe3a0e7434d0be2a72db1de4b8e2d7a7bd2ef8aad111a3e23
MD5 b421ab641622c26fe5e7cdbfe010c7c8
SHA1 cad38c1b9dcedd46087141b820331c4b1b355c06
SHA512 a22985160ecf1b46e16b458c81c21f2cfe07fe89abe7f9b0306f83b48b9b2a6e39e674ea9cbe1b2a04305eacd3c99ed699e19d031d17e251c77e58b116a6cad8
SSDEEP 6144:Gx3MCCBEkuNUOygLE0z35AtcJlA7af5qzp/GZ8OwwJSBW48Qz:GiCCBEk35O35AtSD5qzp/GZ8OLJSV
TLSH
T1E3E4491EEEA36425584002487FBE4128BD1E83540B6EB9BB7C8F9D91267577E8FF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\da.pak
Size 598KB
SHA256 6c6c35e64f6a9213f64b76cee34d7f18ed5c456355a449ff2c51201600915fd4
MD5 4c9c77cef880fc43b39a911144606ed8
SHA1 58018fdd2af65b8d45c1592f839153d50a1ba815
SHA512 ddc1ba42bffc38010545d20a94f9c2075653a30d5c2ca5b62ed349f08ad12eb015eb498ba11205abb1923d42f2b3e8c1ceb83f39975a971ac3ea195fa0f14dca
SSDEEP 6144:SSSNvSxprezjFNoWKTGzVIv5MJNJBE/evTXwlAnsJwaLobiq2aag5dofwcYsgh8C:9SDzh1QKNVTa9W5do4ns+9
TLSH
T141D45B4BDC9D732FC9A90725F3118DA7EB5D943CC684264F65D8943A09CBCA093BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\de.pak
Size 641KB
SHA256 0f320e62aed97197de2e27bb06a797b8faeb2674f53fc334af525905a987a707
MD5 f7f19ec0f0d13561bff960f018cefe65
SHA1 25965685bad7c5281ee430f0dc1886b55a68ea6f
SHA512 1ef9b9761b85c7ae083af5f7f1b6e14a7d612b6da019b54b27868ac6dd9770c02794c2fae22fca34dc4131e6e7ce0e21190e27621e0779e5da6314343b9b6c90
SSDEEP 12288:xoho5NeZrQ5X3K7UpNgZaKzsK+F35saU7UdChT:xoh695X3K7UpNgZa0qt5rChT
TLSH
T124D41803ADDF621ED68673617305CDB77B19E36BC346322788EDD02B614B5B283AD522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\el.pak
Size 1.1MB
SHA256 c7e3ffd6424050f77a204cd243da7ad615e7df6096474589f33f5bbbd992dd8f
MD5 7a390cd9c011c9fa51210ad6f4125384
SHA1 959da38d29da871bd5e107bf1dcdbf4ad2502faa
SHA512 1774a682b0d4f3877aabe1cc27e2a381460a3f82017f4e8b80025978e34ef47c1f0aa954fafb1d253a3d323cbd0915a27e6eb3a50678a680b1281d16a4953536
SSDEEP 24576:HIRLHWFbr4K5Yp9Ck2txZueOJXDsSHCmu2Od7IO2USnBs3PyjkHvFz4VoyNJmIWC:oRLHWFbr4K5Yp9Ck2txZueOJXDsSHCm/
TLSH
T16845CEEFB4582DED8046950785D8F07C2BC66D6CE749CBD86229CB60BDF80719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\en-GB.pak
Size 518KB
SHA256 d25573feb04edd24b29f3f1e6139a3348ea31ac5d50586cf032a8f56a5bbe198
MD5 c0a2a59c29056daaf97738c7d4302ac7
SHA1 6d7824a0a8dcfc16be3760e1053e1cd396566245
SHA512 25f5d2ace69a06e9f6718d246dc81592dba1181779d56773f6236ab61c4cb43fb65b2462899744d2b9d329adf324962b9c3074338407defdc39c20189809624b
SSDEEP 6144:ISh+Z/KHfrcpF4yVEMP9pQRIBfaYHHDjko5bZDG1BcERJu:IU+ZeCEMLQRI7F51Dx
TLSH
T1C1B43C1FF784126A059352A2BB0AA562FF23D07CB35112663CBD805C33B6765837B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\en-US.pak
Size 524KB
SHA256 d4b35269d3b629c9895f3a6f98178f8578db37a7e840c9ea496c53044729b796
MD5 4246253fe6f0e8e7cf43a758769a3517
SHA1 b4b09f76552783fbbe0bf0cce8f8a1f8b65a1344
SHA512 6eed038be30300188c38ef202d8081216050d8e7641732f49b9b41a47884cfdaf2afb747d941ef2e6bd54ce55e58008b9d99e447674cfb8e712d437c4dccc387
SSDEEP 6144:IqZMW8YN+8MRF0PTMP9QQo94faYQ6TFB+5P2jdnngP8/s1wf:IiMlOHTMCQo9+C5Ojawf
TLSH
T11CB44C1FF744122A05A352627F0995A2FF32D06CA35112663CBD812C3377B6AD3B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\es-419.pak
Size 630KB
SHA256 78480bc1b80a923f8bf4209ea6ee3f6963518864c54c09888e8a531eaf298fb0
MD5 80d8c4e406d814087a48dc6eab520fb4
SHA1 8135c535407cb82965087e64be933603ec4067ff
SHA512 a50ac1cf09889500b466ab4ca65a78ffbbb30a94a6a20dcf3fdbc1426a02f3ec43a8278f7dc23bc5f8cc70e086809b516438a8689478cd8af15bd0cf357d6f8e
SSDEEP 6144:4Cq+PlkTOt58MLnHFFYjn3oZCV0a5iePr5AAiR6Cl:4CldkSt2Merd5ielAjl
TLSH
T15DD40822BAC81F5310E3A388B743D757E4D89545B408C29BE8EB876522CCF8CD967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\es.pak
Size 628KB
SHA256 e97de891605549684ccb3700871b448327d6777f14f1946cd33de326e10b7d9d
MD5 04998a34faac5263efbd1788a7985b81
SHA1 1051b7cf252626b1665e50253bfbf978a8897b17
SHA512 4249e4cd011a306ddd969e97b55422782cf672e789ddca925b10c959324f68ee6bd2eb74c9d71144e173d601a95ca36bc994ad8d84408594d4a782c062346b7c
SSDEEP 6144:ZWwtcH5rknMiezJqsq1FYbUngtE++5Qh4wmty8ji5JOvAJLlvJi8J36PZOW/:ZZ4lUcVdbUY9h4Vy8ji5AoJJvY8ho
TLSH
T12DD40826AACC1F6310E39389B743D753E8D49545B408D29BE8EB876621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\et.pak
Size 573KB
SHA256 f304e16a3820f8f9f624c1c5ed1eae2c2fd20807616280f0aa9736d50674d694
MD5 44bceee5e47659faa8b574d1e9cc4f6b
SHA1 d6b361e5fc049142dc433211bc4e1b7104b27855
SHA512 c29d659ff78df9623b7bfedf01478df4c76988e8720ad57c1a1c6bed0ca99038861b23fba8879a3f6e236dc75240c3343471ec6a380d88397e44248e8642da78
SSDEEP 6144:KzYJkiE8+dZyuRKgf9ja0+IPe6yH07nFdGpNQvmdsIPOTQysogWUiofoflLXhS5u:2YQfZFRtMkPe0nFdGphoPfljhS5Zq1r
TLSH
T14BC44C42A27D771B242412F9E737E923DC9FE7D8B4000D9668974A1970EEF8C38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\fa.pak
Size 946KB
SHA256 fac7c1836c64eeaabcf437fbb8f9b6c12060686b6502e7f28c60e31605f58474
MD5 3bd70feaf9db7bac46f88ee3bbd8c3a5
SHA1 4ca4f6354f7c927ee991b71eb4c3ac95676366ae
SHA512 8a26c3eb112df909c5d98c59e3d98216493e8fcddb3f1e136590bcb9708c0c1b81e789d9b7c8d79effe81f91af20550da5705f23d6ad920a027288a93a91409d
SSDEEP 24576:z9Yy8u313uyqoz+sb2VRmXnloTUoXtCfGk62Yh78ai/78MX4UOVU8Rkc02uWgmuF:zKS51d
TLSH
T15A25B1957AAC9AB15747CA0341E33834C773EF12D349FE40ACA1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\fi.pak
Size 584KB
SHA256 29220b9d2e2aacb542ee0905b676b914a748332bc7831fe0da0f453252f88235
MD5 2c5c6e6addf2cec9cf438553926d9b27
SHA1 401722d2be89dad0bb49c6af12d2b5588d893bbc
SHA512 728a0d2b492c614b624e5b9ae0fb20be00e333a5549117bd291189955a44d4a4b85c6320fed237bbc1d4d66b6bd366d2aa64a21bb439d66515cf13f1d46c1fc6
SSDEEP 6144:jyKo/VMzr9U19cU8utNtmS6r5DDgK/sKC0WOERHboaQaLO5wJw+UH0RI8pvWaHGj:u/VIS19T/a5zaW5wJw+UURI8pvWamvaG
TLSH
T1B1D44C915219C22237C4D29E7DB0903EF5E5E3DCCC284D9AE843C7D849EA9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\fil.pak
Size 662KB
SHA256 9c2c3db51dd197c0ece433fa103829a96daa5a4b3335324f1a98bcd7345cafaa
MD5 62b223bc93bf11543cab384bf263ea2a
SHA1 638cdf9d2c8d4f1c39878b43ae2dece53066604e
SHA512 ecbdd03efd82b2c8bf030d58a48b9feb5bc9c3a03949ec8828748d3302e629ab4bf309a76e8ca7d0d8ec0098a6a718a41a07c41a1ed10a87be64b92eb71454b4
SSDEEP 6144:IUtF/LqfvSrVFFfgy4DQ+ZyITltRFhsAcJ56SGvla9boV8A1cOO:bRmi5yvO
TLSH
T159E4C715B7401748DBC352E55360A82F6AE560B83F827C6E0FBF269B7BA7CD5D270182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\fr.pak
Size 682KB
SHA256 38139282dbcd2229e4adead79ff4763c60d261b55c64057c66d9db666be2cb02
MD5 009a9759c05ba29222d7607c5df00c6d
SHA1 deb836fcd77265985bb383c35c8543a1a1165004
SHA512 111ea1fa93bf6342a353c8483333785fc3778a2b6405f6a3139faf778b24afbfef1ecc503871d99cecd99fd017d9cb3cd324e61ed97fa9922648e37320c54d15
SSDEEP 12288:c3prj0doRNZLAqp5dZb2Z7R6QuaSVYLyH8CezBIGBiZuYnYY8jw2wTxUDzLQdxSw:c3prj0GI6V78X5iF
TLSH
T18DE4E66FBAC431CB19C60277FB16D663DD348248F215E340D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 149237780840b625b95321117cfaeccf5d54d6ac870a9886fcb9a3bcb1e6080a
MD5 48eee10b179362671e8d98d2689bbeba
SHA1 a0dcefe9ec3ef67d822e36162fe5c71684254609
SHA512 d2dcad2134acf9ac0325cd27ec2ff0aa4cfae6f9cfbaeb0bf982ffe362c798f092bf6bfa776efecd93b38e3c2aa9cb6ee3c09cfbdbdb1ccc53c5ee5db9794334
SSDEEP 3072:kVN5X6tUNyD+hyKZguSrWn1jxuYBoLC0PjAwREJKVMjNiT7llj63rAulfcSi5Nnd:kVv86BhyKZgGQjtsQI5qCPCk1ssLw
TLSH
T1155509D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\he.pak
Size 829KB
SHA256 c4a828d6425bfc888d6e79ac1d9220926af6737c3eea05d86f0796206f7eef62
MD5 3ee266e45dadea5dec4da1ea91b7af64
SHA1 c569e3dc34fd34bc237732df9e360c92f7fe858c
SHA512 d59ed3dfc74e23cdcaceb962240f46b0267f403643d5c83a6625ac19df938c3332aa0f52e544ee66365169e400385f9bbf4b655b8a5ea4565975c498f7c78dfb
SSDEEP 12288:ks73bXB7hOF2a+TmoBrAfDuBAlGWq+/+J3OC0AACXlXeQCaj35RXjv60jsXk5mO5:T73F55162
TLSH
T11E0599C4B2E452255131AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\hi.pak
Size 1.4MB
SHA256 2acf2e5770dc1d8ca5fe4b93eef94f0395e44780e97eac8c03b3707c0e0e40ef
MD5 c526e67f2d73b6355aa87a01679bef9c
SHA1 dea1fb2488003c0a241add700d9cda5669cee9d6
SHA512 121f4967fcd2dd35cb786eaeada317be670285835907ca8e10176d847e33963f8763506ef9c4be60761616215b74d04a3041ee6659fefe653379192d1100a598
SSDEEP 3072:IfKw3xXncyTHhaJvBYel0EsFV/B90ZV1d3uGlqvN3dgNJEdtDVeDn1s4f4/BtROX:cLxXncyTBkveel3mG75pAndKBD
TLSH
T14A65050CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\hr.pak
Size 639KB
SHA256 a104df3eadd5a8217d58204b7407724c3c7731a32fb47fb6265090ece347ee86
MD5 38aa1c8229bab08e93234fb08c1e3d0e
SHA1 5df709024aedbbfe90dc4a964852aca6d66a68af
SHA512 00fe9d206e36cb8a587076ba1170fe4678c17f98cdd0d61c53c3d5adb625bdf5e3c926816c848438183faeec5d23aa53a1f0fe437e7d9ec294d20460c44c6fcd
SSDEEP 3072:zGIg2g1tc3lpiMgWeq08faLV08N0xo+pfpzWBkfBV038YtKzVMOSAqfnpskV60uX:ReHW9svX/KRBYE/5wQCOR7PrzpJ
TLSH
T162D42B7DBEF3570A0897B34AEFAA434479BD08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\hu.pak
Size 684KB
SHA256 0e3d482b4b09cacadf58043acd55baa2705fa631d1217ca0e10c7a8cc114fa73
MD5 5d20203d5c88ea08b090cf5b057ce9ba
SHA1 09bac276417a0349732e93be31586e0f49a4b1ed
SHA512 7476b2b1e455c774059cb6e02b1701c8e5173e19e63e006933b9e641dc202729a3c71ef3c72d4cab602f8c31c6db34a886dd94e58bc6e58d55e379a2df316fed
SSDEEP 6144:rXDSuMnMY0M7QtdyTpVHiLl/5kgWA4ZtOu8U5UTt8gZ494rYhCi/YtmuFNer2Ene:rXDgMfFtCAjU5UJ8Lta5Tys
TLSH
T15AE44BBB93769059B86C179778643F15492E481BAF2B36FB2883846D34A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\id.pak
Size 565KB
SHA256 0b35177ee2ca68f9ed7b516d6920696971cc9dbf2187c92f63adfa8e696e4921
MD5 1e6003d6cfb55840f293b8dc184006e2
SHA1 3e78aea5d74d2ddfb49f96e21b16c0b6ed83bd17
SHA512 0e7165b2069ea2e683277a24b44c0fd37061863b621c18b606a89382b9ade2a790700fb054b714824794304e971b5d6000bd09474d8fcf90585b783c7c45ad04
SSDEEP 6144:EKjJAf0Ke/tdMpPyQZ3ZA9tK4AfjzTFjlFtXmBmiFH/Q25R619KOBCTmGiTv8oy6:rlA8KGd23ZWj8TFjlFlmAi95R61v4a
TLSH
T124C4E8632ECD310C494842D5F2CEA91E7CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\it.pak
Size 619KB
SHA256 ed64dadb92c0113bd03c56c0417e0c1930d0ef17d76f5f6c356e6ede66a094eb
MD5 40c8eea9f4937cc8ca9560dc2a89c3cb
SHA1 df3b2e7f5c6e6c182f12a25d0f72d8d0a9bc1a8a
SHA512 ac615db102639d1602213d05b028c1b8ebca5654bb1efa7b6bd190822be9a7ecae6026de011dab1f99a5f47f0af354486d2c57cce4f9b9a6451592ac7259946e
SSDEEP 6144:JHOwZe5qNmiX97+2N9rYS/qBRRs61wtM/RT9TbOKkgEgCYrqCqpzSj9f3wBYUJf1:J/DLiZZeW8Y41AmPs5f4SliVr
TLSH
T1B3D42B3AA5D6212519976359E611F085FB6EFCDCFA417218C99B031C22CFE80F2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\ja.pak
Size 753KB
SHA256 25b71276ae5ddbe98e8cd237031d25954d02883584dba4a86ba5e16d7c308493
MD5 4214af7402afb56aec5545bd8cf082a2
SHA1 cdef2c623f68d2a43e9521b41b8bf4e57a15875a
SHA512 a321a4ed4a141b6a984c4e75a23c0fc6eb94858b669f9e9985d8cebc010bfe9fa91b52130569325f7f8a906cc45a4b5aead9aac9ec55773fe45c4f286b010562
SSDEEP 6144:DGhVgnaJybiPfSHm3y/rKWur8mdfOWV+Z8Q2E0uRPdbn5zQEu5tzV3:ahVAAyLG3y1kfF+Z8Q2E0sPt5zru5v
TLSH
T1F8F43F7CE3C969369D6152A22C4E36E17506AC5FFCA23A3A443DC074BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\kn.pak
Size 1.5MB
SHA256 1ba01542213e2d3e9da15d930922a12c0916b002665d6d7d9a2fb2f483f3aa6a
MD5 20652187154ef4e526b4f579e272c964
SHA1 2022f6eed1800e62394f7ef66793f9a3f9dd2792
SHA512 46a212c10de24b50149b823d4e6572f64a863aa2f88af126877cd00e67df3de0ae552aed4cc13ef81a6ddfbcfd85c8395b97fd22773ebd6938a15759b0db2b01
SSDEEP 12288:nx0YTSABwErftlzAE1TS7ZhsUq4FWqM7P5JLHMt4EryjEi:na4vwErEY55Mw
TLSH
T19675CD18ADBA7D301BD5006B24EC643ECFF16BE29CA907D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\ko.pak
Size 640KB
SHA256 baa4dc565c14119a4cae9016314b284d2795fbc427a76e54b27799910d3b777a
MD5 bf8ea40532d935d96d50180fc9722a2b
SHA1 28616a160a1b07059a4b000d9513eac9e372e33f
SHA512 43b4f87d16967ce207018c1c37f33acf668e4963acb17cf6659e62937501bb71c3cff4ab04b53182a50786cd31f075edf59cf9f03fda7b5e62b37d7d6a5bfff2
SSDEEP 12288:zBLt40ilgukiiM1WNiPszcbifYj4ZGRymIeYs14bLwLCMrI01xWSJGRG1zLhwEti:zxt40EIeaR5S3iHuI
TLSH
T108D4C5F238DB63CD1193CD82AEF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\lt.pak
Size 694KB
SHA256 cc3ad14a054ef5db438523d56f33cec0eddddcec82161c3ff231eeb6cd747e4f
MD5 d290658a4689886b945fb22e01b2a49a
SHA1 9816d258c03c3f4c74fe3da2eb9f2b2643d28159
SHA512 586982b9bcd6bdaab029d3be3ae6a9b642d5bf676ba0a9df37e021bd46637ac835d8d1496c32d78c737c6afa8cec4e015738fd3af08e7b4e78e934df4bdab2fb
SSDEEP 12288:nvZZkeR4oMwQJz0PrVKrB4bi5P7MIAAJP6StA:3JrMuBuqi5oItJ4
TLSH
T152E42B0069E3AEFB9A4467C981A4CE78DEFD50009767B861EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\lv.pak
Size 692KB
SHA256 b792d7adf76e8a87cd0fe28947b0683859e91d0f05b119a14964239d28165b2e
MD5 bd10e7ec31bba5bda9057fe4e6e144a1
SHA1 f761e7030024f1725b975a6cfaa83960d02cd583
SHA512 b8f0b607643fe591ba134767570781c6c6668100034c2c95c77c680380773dfa9e8cefefbecf9b11d9ec6295641d8d020d26f7e7a8444fcd2dc7a5383986c6de
SSDEEP 12288:ZQ7sqmcACylMd9ztQHINT5qchTyscSx5S:ZGRACylMd9ztQoNT5qcrc85S
TLSH
T15CE42B959EC68FA94D904DCA733AD132A8CCD740FE07E112DD7D8B3A650F52822B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\ml.pak
Size 1.5MB
SHA256 007fbd34d82ad4faf6ff8c0192a09783b37bf988ef76f4dc6ce8a93cd7364fff
MD5 f5e0485d52971724a697a7aabf499a43
SHA1 db8c03cb330bc099ddcfebeef4de3fe4acc30464
SHA512 d85bf79ed1adf3d112a1705a6bb144231e7985e23ad9df630f32587d1a18acb934ab37d7632d49fe3c6a1d2731d9224f9f39c4b2a2c0f045931aeabe6781e474
SSDEEP 24576:rkroUYF/oZAuuxyYl+9y9XBkx/em7KfyBR+zXcb+v2uiLl3751aaiAD3e:rkkUD5g
TLSH
T12C759D57A036CD3B0FD102267B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\mr.pak
Size 1.3MB
SHA256 c0b460f8fcf6a46f94385ffe57d9be6ca1bbff317cc866bd2c7722d813c04df1
MD5 6482bcffb438f682d0717995d5e4b0a3
SHA1 4b2f449d92fe9fcb236725d9f439c5994acf7dc2
SHA512 36c83f350b2e220c9f080cc0581ece6ea075899fccba843e6d2d0355651fe26a0634b88aa034e885396fd78e2d05342b3d84995e3720b28540bc284c6e3cb63c
SSDEEP 6144:fdAJQ/QbwOumXTG53JRiWUPZ90PRQo4Y455mAAy2:fK+QSP53+25Qo4Y455mAAy2
TLSH
T1E855D24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\ms.pak
Size 595KB
SHA256 195a63e82ca877f07e12eb531779e2b93f35b4f45accaea4e9d133d6b52f1883
MD5 809264adf764ee15e33d1ba5d8f8b28c
SHA1 edf63aa96d8d7d52ab4bda9aba562b68d4556861
SHA512 502d530bdcecb835b710a21695b20a955fb4f932240f41882391b701054d85b0cbb38629105594ac246288ec50b308a004e347024df0922613038cea0016dcdf
SSDEEP 6144:b1ytBQp+1BAd8cXuHxze6L/rg42Huqwo9I78AVzZY5b4tVlqL3VDhh:b1sBQp+1BAzox66Q/Huqwo8fY5GlqF
TLSH
T144D4B7569EDE3118085843D9E2DEA91B3CDD3332B705AF2B4DB08FB0126E7A53315B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\nb.pak
Size 572KB
SHA256 0eeca6206c27b7246a9ef09217b00e60ba3d0f72cce528e9dc21836c32ac2d66
MD5 74ce9ab0c53178d375d98efed98994e6
SHA1 4baa8ffdeb6039b8c3d8800266e6cdaf1a4a1c1f
SHA512 2b47badd713bbfaddee88118deef864f82777f896f688d29b44138cfaa17acedb446fc8f1a8ec3f7fd20df2bdf7b72969f442f2aedbbb8cfeebdcbd2596bb519
SSDEEP 12288:PzhR8ZQXbO2jOp7fI4R3sv3qG5wmNBdls7FDu:LLOessv3qG5XNB7uA
TLSH
T1C0C40883EE46B72AF2A443A4F519855B9B7D942CCE98199B54CCC63E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\nl.pak
Size 594KB
SHA256 8189f284e1e1b665c17b91becf084cdad8e88d0574dd99f165c994885a7668c9
MD5 b1e6f1e2d4ef63f31c78ac0de285ed44
SHA1 8e63709cebe9484afc4162ac3574eea25db5eb18
SHA512 cae030a96e0ded04690d2abdcbe09bb9c0438c072908e69a7a7818b2e1db25093d63df853b164a08116161da28b69e75c76ab98754f2defaee4a01ce6c92bb8f
SSDEEP 12288:1hxKm5plbJWQusNUSW/gKf6095btbyUigqHgGfDTF:1xrlbJWQusNU3f6095bNyUVqHgG7R
TLSH
T1ACD4FA07AC4E253E59C1A349FA098FBBBF2ED22CC26CE6BD94DDD5340443F68429D589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\pl.pak
Size 663KB
SHA256 504077baf20983656f334b7a2bd78e97ad267c1243ffaca05d83723724c30508
MD5 2d6c4faeed5f1e98582beeab57d1c9a8
SHA1 bdcd89feefa78c72fb7dae0de98b14e8324382f8
SHA512 a36788143e83fd1fa2d84d729e97243377b8944d7134805da6aa4b6d20215cc8f36ec00c257019423f8df3eb4e470f59ed34f5b8efd3e7dc9198ce342a80216a
SSDEEP 12288:+P+Bp2nMKiIFwfQfuzSJabZ6bEYPPxCUdTe3mbUUmMrma1Qh8j5RMJRolEqtT:cCEcIuYbmM91Qhk5jB
TLSH
T1C1E45C0E5AE58A4E8CB008E6F2E70B7CACDDC808F109D35FE45F4526615B19ECABE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\pt-BR.pak
Size 622KB
SHA256 423059732c14cd00c450ea2d6b9204c34954ac117169abb506ec248da6250052
MD5 d7645414b7216089ba6460959d2602ec
SHA1 34f4f30c7d7972cc6f04418e9aa58e9415d5b250
SHA512 374e4a96bc9eced177527a2594654803dd187b5de48c3c054f1641655924f7ff76aae4ec6ead6eda6237630fc4d360e190efcb7675794a0485108699fcd5e7a1
SSDEEP 6144:tzFV9V0TlNBXBLWjPJQnyli5mEN1hzgMsRUJyMM:t0+o5mERtsReyP
TLSH
T114D42C2A6ECA136604225350774EDB47E5881745FE0ACA87DCFF4F06A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\pt-PT.pak
Size 625KB
SHA256 6ae5c44e2044c1fa754d2cfbd79a33d3b9c2bd24702622df0f641bdbc7991435
MD5 82ce340cf07022445f4a8fe497323046
SHA1 3a1c2228be107555713dda735a25c708e14fbd1f
SHA512 a6029f1c3b1b0a987bc62f74d8fd7ab0dbd99f4a20d98006bbf531a2e871313334059e05ecba6c116d6742381146db9e5cc5ffcec0d59a69ffefa9438079d6ff
SSDEEP 6144:mZaE2UVN5P5znieJVJJxhwID2fbPGfDUh53nsusGMSRod:ua+5P49h53ns6MSRw
TLSH
T1EED429286EDA136605135341770ADB03FAC86655F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\ro.pak
Size 648KB
SHA256 8880b2ee29244efa9fe250d88f17dd5ae8f3e56a354c8208c5d4be4ff7cc3b74
MD5 6388f9a13bbbfa1e084a15acb046594a
SHA1 3c7d73066d2322fc99d409bc36afd30b36e35047
SHA512 71c9dc9eef7111883253e42b2d983af9514fac48ef1c7890ebdbad604b18ba822c28ecf009f19470623cc91343c2038d135b8df02aca607d6d0d6f072926eac9
SSDEEP 6144:1Kc+X3Mgrjd+RXklwj9yvnB3ghgLyg24+xDG8f5LAEK5se7W2Oja/9rVf:1K1sgPmkuyvnBQ8d2/j5LAZ5Bc2/ff
TLSH
T10EE43C23A1C82A97295153B2B73624D3E88D105DF641E28DA4DEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\ru.pak
Size 1.0MB
SHA256 4de88dade1118467dce77afa84802c2e52e49a574bf91cd8db9262d687f86000
MD5 331676f3ca97d2ef68747ad05ac06a6f
SHA1 08d95c85657c793de48823e45e4751846c9de77c
SHA512 fddbab0452834df2cc9f45158693ab09a72679be2abb73d7b25c40932b638761b578c72d651a4935cd498a85f6195757adb2b5c68b31984326885b7b3f2e2421
SSDEEP 12288:EPzVrx5pXfQeRo4YwSspSzJ9wF+oasUWXv6HzW/oqSv9s2WTaENtgA8Nb6dwYHyT:ipxw6S5Ro83
TLSH
T1B0358760669E64EE1101F01BDD08BE0D3CEB45FE3FAAA31619642D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\sk.pak
Size 674KB
SHA256 d0aa4f73024ae7f8bc95a6e6e8975fdf65cfa52d0c500f7e04db483d13fc1566
MD5 305572572fa84d145c7c71b7fa11cd79
SHA1 bee43d29143bc311747a929fa0bfde45151aab1c
SHA512 4bf0499ca16dfa4640179dcf609030d652985a70c05dd4d5525ae7a558a4bca1d098f20eaadee458f90200b5ddf33177d54e6fe1977fcee6e3a6f1bc512018b7
SSDEEP 12288:g7ihjBq77PNUANi5i2Tj5Bnyf9YQH+8pTjsxt9iv:h8PNViR5cYV/twv
TLSH
T1FAE44D3FDFE7181E8E8D0148EFEA7110F97E8650864EB4A6944F324714E26EDCAB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\sl.pak
Size 646KB
SHA256 7fb4f5154e2f158777bb5b03dfd35f1037bafa6be772203f96e5c53f7a771643
MD5 1ae72652bcc4f16b152076d75cfcbe65
SHA1 99c0397671c02fc6790917de3715afc96c4b1bf9
SHA512 4f7b11ed743b4a970daff3d8d1fe03ebdc7099df2b31f5bdacd236b0f7cd33e4623a55eeb63a0196702c82cf876bf3a789780dcac17cfd35b9156f74de71b1fa
SSDEEP 12288:E+uorNEWpcB2BcBwYL5lbH80WOq9Myi/fzeDJql/ad:puoGWYwYL5lbH8ji/fzeDj
TLSH
T1EFE41B397AA75E0F0C9AB28FFEB606007FDC044CD252A6A2FC4F33695415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\sr.pak
Size 993KB
SHA256 39dffe2ac8a038bc8ab98b3796da08109d7b0201299a0b8411d0290b507dafda
MD5 c6372c8181a08f478f283d1998147084
SHA1 d73f1353660e62ea9a958c29a21e7637f165710f
SHA512 48ccffa2d0f687618ad7ee32a9ea5458e6e02617d3bdec2aa13a92b2da1ac26bed7d005efdaf25b00d11b1275395be04ffc7667b3b91161d2ed4823abdf4d9f5
SSDEEP 12288:vdSMK+z3nIAhuSOd8CC0ili4gCkHvs5YEZ/XC4xKGZ37GduEU/k/D:1Svuo05JCTT
TLSH
T16A2556B19B9E64DB0901F41BD808BE493DAF41FE3FAB975211601DBD34E10B847B929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\sv.pak
Size 577KB
SHA256 78c25c86c120e4db41ecce3d91ebe550d127a97d8b72c719d3a2a433973946d2
MD5 2bc74cef723840ce2edd3efbe4c15059
SHA1 38501a37528f40e83d9d4158d8a25b7e166c6e17
SHA512 1bce472fe61d47c66c6bc4589fa862164259b76f9feb6e5bcb5975368cc225d6f9f23d4e5af85d32dae21fb8fc005d17026ee48080e1e1e61fba01591a0108f3
SSDEEP 6144:aQvuXkfeldQywJ+T6Id2NxbINlejeLAVRFcz5RtGmL+SM49mFMBZSOGQ5tl/UiRc:alXwTM2Ev5MiVw8o
TLSH
T12BC42D438A10F526FBB2530DB609015F0AEDE25CE7E2954EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\sw.pak
Size 610KB
SHA256 c2df1fc14a64c19c92d9b9b891aee74ee1d9319cc054642251c517ed00363bae
MD5 f66c4a25f772976f544da0cb6260b53a
SHA1 67c338601e0e11da7a0ee4b03a0cd5185dd88940
SHA512 f28d9b276450623e9bab2ff9fdf48b682d08118ab421ce18cf6c6bf28b6d9569c2372536bd5227e7ce629185f614170a11efd7b9a0e979e670b8cdf4bc0f3321
SSDEEP 12288:iU1fV/4hyZh72yxGC2qMCZ5CmedqNGjRdpvC574FqHKLC6y5IZSLQB4GFpP2NUiJ:xfVQG5GFDi4j5WcQ
TLSH
T11BD4D6629871E1191233518603DDFF732BDCEC5C292B2D936A46BF0F118F98C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\ta.pak
Size 1.5MB
SHA256 b7dcc6f63181392752f4522d3bbb573fd4a6ec65f9058a922ac61ce21b257b76
MD5 50db620acda7e481c9fe7341ec7d7977
SHA1 dce3993f0fa2c930e95cb4764b1de7865e83ddec
SHA512 6f5ec91f0b59813113d7d822fc77c900cb1a3c1698e7267ca7855aac97961d508adeb2825bc75a845108d262979bc90371efaabc02f9b51468be17a3590eb505
SSDEEP 6144:v+YllkNs6KnYEkdWkGP5w55q3tR9Ptm1vYpiMyO:vt2s1YQkG655qBtm1vYpiMyO
TLSH
T151750CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\te.pak
Size 1.4MB
SHA256 72cf1e05c189751946df56b1847776ffbbc2b4460fad07a070c4c33396516ef2
MD5 2e85b6f1e3c3ffb73390c6bfb78fc8c9
SHA1 daa3bf1fa61655cdefb5cdcd9ec4df55716cc92c
SHA512 a58507f4e68621321da8311f8a065eeb03350f672f44e71a98b9ca25f3e812465a04f4f5004d6c8d50abb18b91e8d40a3949329e58dfb83fefede2bdde7e69ff
SSDEEP 12288:ciIU07McKNxywG6USF602ygIC8ymoRRT5bbiu52C6WuB6SI3p1FG1Ya/C/lb2B36:iY154RcaF
TLSH
T1BA6592023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\th.pak
Size 1.2MB
SHA256 45a573589f11c1694490913c00bbff65d57e232d33ca2270ac2e443207b971d2
MD5 79b81841fde5ef8edcb46d2ba86dca09
SHA1 7d9fe5a44d137dd4cecc6009d597f77587e84c7d
SHA512 31641437d3c012ab0a88db26539731c7c60d141d10646c4b457691c0827f0a0459adf479579b52263e6d4c46728642cceeaf6ba59a2249ff76a4c7bd5c59d056
SSDEEP 12288:lvJJLN9LyZYAhzYLz8AsShukJUseTPsO5eXffpbDFDS6Sd2N+Qj4B1qsl5URqE3D:9J0O5Ssf
TLSH
T114453BB37247DDD479441B5B262A7789672DAE693F73F8E00089215A73F071A8432EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\tr.pak
Size 621KB
SHA256 a75be19b6203daafc5c01f8ada1ba464076346a4d4959a2e05e91523ac56c446
MD5 5c351d664330c6edca0165973a953503
SHA1 88b055a168d8bd7c31e6430f0483a46f203f1e87
SHA512 a9aa54f9d1fedad97a7f2efe2e8596860de96d53bf82e72d109a034538e853adabed76060e35ffcf100d5ec69c7dff2d3596b2c16887fa97f34f1145648838fe
SSDEEP 12288:/jJSKGxGzkqABYgB5Hz6sgwpIfZFMzGRkKkG5MA41:/NSWK7KkG5n41
TLSH
T117D4E98178EF682C8BB9278FD6E90666F89F0766B331F446DA168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 01989ebc539c272ed8eddd3a9d25810e39c7fa0276a19562492f5b332ddc380f
MD5 84dad3e9efdddf304bf5f46c1d2999ce
SHA1 c9ae490d7d47d356f7d555558a086a06c3e338a5
SHA512 63453f1d7bc1f73cb2bb0a40fba92735719474d727cd3138ad88034cf637378066797a41f17df33baaf6a928451cb7ba7222dd7a73d79dec959e1b925e1d61fe
SSDEEP 12288:PoWQSGLEHsGjIwkkmV4EjvC6sSr+f2nxu6CadoBEIKT3/5iNvcA6Qqe860YudLNQ:PKSGKgZ548E
TLSH
T11B35A9A19A9D54EF0105F05BE94C7A0D7DA701FE7FA6871625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\ur.pak
Size 933KB
SHA256 d99ccf422979a0dda1c46919934e6eb599d2b75a7c724c34b761da8215a727db
MD5 f17ef5c00e2e537a25a67a50a4e42519
SHA1 b5e42db115863b8ee55343a2f7f257b1796e689b
SHA512 e4fd68988b8f5f637d22dbf49ccea38adb7452376c9b21a4035530ecebf0e0ea09ec6e1e45766a31670e99b854a1bb4720bc9697c1752c728fccf6000ff6e19d
SSDEEP 12288:cCb7IdSoew8Pl1eqtdQlrIvyRKXpt5gnpEhjGMOd+DyQYrsKYjwadcJKwUruqcos:6yD5xGXp
TLSH
T10A1500D2E6B896B34A21D92780D33C34CB735F13D34AF285E56246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\vi.pak
Size 737KB
SHA256 2b28fc3de60a6f3e75423bde8bd681fdfd149372455070e6aa0508581707e94d
MD5 105fefbb728ad849215a6081d859c12d
SHA1 8723e3a4549108c8fa623c8d7ef3a3e42a97465a
SHA512 aff23c74d733bd0ca28c0c688724860e7d1a1ae17d1eb8c2d711b868d96984db374f053e9dea4c781cf96a49d444cefb36799911680eb1980e75490392988890
SSDEEP 12288:fljen+Y6+cDZ7oE1sVpMhbg50+0sVN5OFWd7aWx3p5a8iVy7oINFZIj6l2eziuRj:fV+cDOVF0bFGu45a8JVC+l2Yiuhfzq1M
TLSH
T124F4851217E1302680AC553EC6CE540D6FCAE42FF7C18FE56FE4297476221A46F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\zh-CN.pak
Size 529KB
SHA256 03754412deb511ddac23a23e0858bba40373b5053bf97cc21e9e0b3c5d00ec4c
MD5 ddf51184074c6edc7884b95165e1437a
SHA1 f3a18a95ce6c4336fd088037c02d7889c3ca9405
SHA512 8b4213f6efc2668f5b4bef913dbe9dcd10c152e390361e0eded352db211e6b3b8d827588c4675af3818dceb08ddbac1da63b691a6ba45cdb62372f5873ef978a
SSDEEP 12288:zLpL+sVdi1uzOjnc0UHERA+5hhjYYcVLL:z1JdVzOjnc0UHQA+5hhjYYcdL
TLSH
T118B47DE910F9BDEC004650A03729613DBC41720BF66BAF766ED248DD1AA2FAD0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\locales\zh-TW.pak
Size 523KB
SHA256 d97e1a4b2b3b7b64e92dd419480f8abe84fe3148834cdef5abc31b36f69391bd
MD5 7ac97a3a13af0429a1037725dd7639bb
SHA1 b7a9529837c85031a2931eacf9c42016fb9ee0e2
SHA512 b9588fe570200afbca51d130900b2bea054b6b39354fc811c4a0ea1c4565c04b852b72bb405c3439c957985ad969ec7526b8f6f1955575df1bc508b80d5ee453
SSDEEP 6144:xWlKhKK6Cp00BxTWovVJVXKf92duTm9M405PYUoH8DnXmVX20X5mrT4:xWshKoSoBXa7m9M405AUoH3A09
TLSH
T11AB46CB619FBDBEF0901E884B7CD523BBC9B342CDD777632FC8518D42E6AA640A61045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\resources.pak
Size 6.0MB
SHA256 948252e0a45d6d4395e7efe0c9378e23aa342b0ba4b9823d148eac47c10d6705
MD5 52d6b30a3f69fbfa6094b99aa361d869
SHA1 214c6f363a7fa5d20d96bfd95d29f67c00c14fa4
SHA512 160802785009ec6db184b49731d810a1526ad8327736b90c22e783df7e16e7959f23b056fed126e26148c797a36d4c5d90cef52ea7ad55c64e79948e965659f0
SSDEEP 196608:lsBRFlDPw+WkrYtJ/eA5hF/F/eZFFfD5CcowhJT:mTFdQkrI/T5T/oZfD5N1b
TLSH
T1FB5633F2F360287FC498477942D187755F3C998A1942A0270AACF265CF5610F9B89BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\resources\app-update.yml
Size 172B
SHA256 78e3d079839e8ab5c2537a9426ca445ec36b8199cefc459dd83636a0b662a6f2
MD5 094ad6158878f93f169a555ec079a13a
SHA1 af0d2fb1821c840ba3dce553a7408cef33531e58
SHA512 134d4e44f1474322d99423fae97a7795c8c8ea2749b81046a80222d5dcdd2a40d0c1daf530e8baf2b6cbb916cd71a0ea0a80834a1cc634644e33c8f779af1220
TLSH
T159C08051CB2483344922479870087B64F05E0666F4DA7B5141AF571F62174398D3939C
MD5 SHA1 SHA512 TLSH

Submit Download

sentry-cli.exe

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry\cli-win32-x64\bin\sentry-cli.exe
Size 11.7MB
SHA256 e3df9ac4efa1a8407bab95beaa2adde6f7addb39312c37796d9f2c9d12441a0a
MD5 1eb21fe71d38e4c109d078a538dac860
SHA1 4039dd99d8b8e10d07e318c5eecc07ef4cfac740
SHA512 e3274b609e9a1930b212da70b55b1cfef8ba7cab6b66fe7052415b977fc15efa3a804aa3acc259d8918b1da9e02a802506e0d42d3db8f326a12e41ae5ab90033
SSDEEP 196608:SvvpkJAxXEouPQ20C/vgS6HlcVe4Ei4eGUae:SHXEoohZvgS6HlcVe4FgUae
TLSH
T192C63943F76291D8C06AC174835A6232FB71BC4D47307AEB5BD08B212F66BD09A3DB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\node_modules\@sentry\cli-win32-x64\package.json
Size 365B
SHA256 9b0041b4799756ce82651b2ad149d7c07ddaddf034d413ae2dd24fc8a438c3ab
MD5 a851ffed31758f620ef28512796731aa
SHA1 b9bfe17febbd82f1584d9d14e646094f0e23727e
SHA512 0d52bff75dd7591ccc60a8b22b5ecf907dd50ac1cdfc255240cf4a0dba4631e0579034ace668d0fe0c47d26075d6bac7b38417677c8b95d6319208cb8ba4fcad
TLSH
T1FCE0687142701B2309DC2B60DD1D518663120C53555D3F086AE762091B2E42374751AC
MD5 SHA1 SHA512 TLSH

Submit Download

FortniteLauncher.exe

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\resources\binaries\FortniteLauncher.exe
Size 52KB
SHA256 31eb3c804c7a248fe505d948ad9b3891b6b6f9210bd84aaf0eb716478c490b66
MD5 aeaa6f47b71614437c0d47828da005ca
SHA1 f9d016d3817ebbc28556967b8b8c05d120acbc58
SHA512 6785eb5ae5d6d78a9c2f004ba5c91dd6603fd8efb39cb50f4bc3ac16d7377fb1317ba12658b63d575c17de04696b88c09c8a812340c4c40394196dab99d41a60
SSDEEP 768:XvoQcESFi3EadmMYDH8B85W2Fb9bCm/fOhgrv3B+o:QQ5AijdmMYDo85Wkb9bCm+Wbb
TLSH
T1CC3362D43AA89CDAEA10527C40FAD331253DB6E0865347576A30B7320F13BE17AD725E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dll_injector.node

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\resources\build\Release\dll_injector.node
Size 121KB
SHA256 dab11fce07f57a740ae7c9d58dec72433794eabf2d672c82d5d48795affba111
MD5 d021187e242f1c4d789c6a8004e9f593
SHA1 c93f9cbf02956f675a6c9d58e0226adeed6f8b45
SHA512 4ab021d5bb96a37d2bb3041c9d3ace2afe6a9cdb11ca241ab26b4acea32efe954c8585959a6d0b16f24cd0d7bddb58b53e8fe3b8f673b04a2bc9ad47bf28b310
SSDEEP 1536:gRZ4STUtKwik1O+tSYmKjhpSRagSNiJoxOlKw9cirW5KzhUsWUodw9dlLSCdXjGX:UlUHfrqG0RagAtgKw95CKiA1SYXj
TLSH
T160C36D0BB3B900BBE1778279C4530A46E772B8451A60AFEF03A406561F637D5DD3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diskWriterWorker.js

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\resources\workers\diskWriterWorker.js
Size 8KB
SHA256 61dec2a88c00909e9a41b4e8d26310c3667235c3cb6ef38c81845d4ac31452fd
MD5 4a3d4ab4d552940217e3914e76813c79
SHA1 28dc56d0fd2f5c1099568cbd84667370180b69d1
SHA512 55388e3e7f03a6216d1a4f9d1ee07cbdb31cf587f930155375bd3a238d27ae769ea774db1c726cad016b1c7a2d088d04e81948e5ce0c83130d8d1d3b134f576a
SSDEEP 192:L+YA68hxpz9BVRGhwzJVgQktNV/i25aou+DEv4GSbEyQBod1mnnhYvVfKhLCUbS6:yrNhjzihwzbghrTQlSo+c1/XP
TLSH
T1D102535A0AF62B29806332562E5B5413362EC1675618FE98FBCC83F46FC413C9DE17AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloadWorker.js

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\resources\workers\downloadWorker.js
Size 920KB
SHA256 40339feba98cfcbd4ec5531cac27c07c86515193b195da788d7b96ed7b2cd3e6
MD5 0ad19db6b64cfeaf17947f4d255f3ebd
SHA1 050ea0ae66bb828a4316e60cbf1f354de6d41292
SHA512 098df16fde90462f4ebf4c43c727c97a73ba9e9dfca559f6e08c6e2b59c18736d1cdb47bda6530b1bf74067043a8d3195c8964836805453466baa268720d59c5
SSDEEP 12288:5YtWXGdOnDK9IG4gVm72bICY6R27rlBtIzfRnxRDss:5YtWXGdOnDK9IG4gVm72kCY6R27rlMn
TLSH
T17D15F4891AF324129363B17E9F5F9402B134D003260CDE98BD5C97A55F899788BF6BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\snapshot_blob.bin
Size 394KB
SHA256 53b1d8a58564147d34384e6dd4e6f4eb76c9c78eae8c9e48baed031817c18937
MD5 4a959a0c78e5befe281fae1b73a31d22
SHA1 0380555565b257bc5c05aac87f24b34ba1a50755
SHA512 af89537d8ea7a62431baaff9197e2ca9bbdf2ec404e74171576047de5b8964cf7a3b1b602943f7832d10ebf623fe2414afe120a60326e40cb89dc387cfbcbdb7
SSDEEP 3072:mU6QtROt+xeRvISYOXFG7Qi7qSkvcfB+sE3qfJjtN:m7t+OcRCvcNjz
TLSH
T1AE84A909B349CF36CE083A756CE887896526B18D6D96F31B7519772F38B35740E32A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\v8_context_snapshot.bin
Size 758KB
SHA256 18e61e7439cac6193040e2590e47c43fa59ae74d86c881e581852554c29fa06d
MD5 cd08f880a9ced26c26bce558f1e00417
SHA1 ff7baf2260eff45fa08c84cc7615c0bcc93fe408
SHA512 9fbedffe901a08046158dc5fa31f9a56f85838a2a10dd94626c89ccb0b352d02ec49f0d49ee578113d61de6bdb9199abdf3427d673e10d97f01243d262789aad
SSDEEP 6144:AU0ckYOkGt+Oc0CvcUoNyuZaVaBgJjdOSkvh8mQu/INZV/peyWBOI:51RbvloNyerT8mQuANZhcOI
TLSH
T1B4F48565F74ECF2ACA4537B86DE547463835B04A6F8BD21BB518233E38B65B00E3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\vk_swiftshader.dll
Size 5.4MB
SHA256 461995d47666c0cfdaf8494f606b6511d96f4f1b50ae96c81c5edfb033b2c2d4
MD5 40cfb8f567e63a2f5ccfff7f4b832436
SHA1 16f7fd12d09ddcd0d9f3e9ac87d387e1be3dd13f
SHA512 4b8183b3705759912455b3305082e349ae1e3c4f6424b983becf8726646bbdbdd99efff7e26c96060121a3a6ed82a32a0995baf6dbe0dfdf2bf960c0cd347f6d
SSDEEP 49152:zvnCO26zzoxH35myRF71jieroxfGDZIM/swoJ030NLxGq9lBEw1vEkl1l6SfRP/0:TnCkzoxH35myRjoLt2HUOJ
TLSH
T1F2462713F28681E9F06DD679875AA623F231F8844B2276DF16A01F192E77FE06739710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\7z-out\vulkan-1.dll
Size 922KB
SHA256 9dc9b00151609244872116fcc8150c6a4701ca376564cac58aa752263bb381c2
MD5 cb21a3e77e11d533d05ef4e013c86d95
SHA1 9e9e784d40803b279ab37d94b2dd92c36b7eae36
SHA512 46cf3b9213cfd464c8a86f5cd8751806b58f8af5fb509bfba5895184f937602adfd3de4e9a81af26f2a5db6f021d1a6b1c514da0b7a1545aaf245fcc453d0c37
SSDEEP 24576:806dvAb4CpKAvlSlQP9s36Z5WGc4DYsHQDy6g3P0zAk79oOHAF:8tdYb4CpKAvlmqs36Z5WGc4DYsHQDy6W
TLSH
T163156D23A65485A9D47AD034D9D18707C9B174822326B9CF02A81718BF6FFF47B3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Registry.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\Registry.dll
Size 25KB
SHA256 4f585d4dcb449fc1b0e002d7e850a059bf254769aee0fb83841f73064ec63014
MD5 5408d183e7e2098ffa0290a7a5f9af49
SHA1 5e8402903bd805ea136796032115b72f2d728c8a
SHA512 2f3936808a257aeff0c1daabc274abca583e04395287c2a60778a4c01b5449c9364c6b42ef6a1588dab6823456b4f196ed22a7a911eb5cd65806a01da4d4c398
SSDEEP 384:wUsbaKAjqsQZlJee0QwFJM5LPnnqutjZGmaZUjeVRVKY/raQWBQqLN9AYUVf:uBAoBwF2ZtN77j0KUeZBQo9AV
TLSH
T17AB25C8171D1D4B2D09F1579AB862F19E3EFAD603270E85211A67FCB33918A2D379B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpiderBanner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
TLSH
T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv5E82.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\era\Network\Network Persistent State
Size 1KB
SHA256 8eb92b64e9ce2d6563269f6a165c6229b0b2bc278c86c46135041c103baeabcc
MD5 3617e893f200cb2788b7984029c8b0f3
SHA1 b9e0296ceb88e6355d1c60333a98141341f98caa
SHA512 4aa6b616c3a2f615993253e3bca8a8788d0b8759d15185dc28a18231bb13b676f190d013fb73c12e03da8f55d49aa69448fe12aa6b6d42bfe31ddef185d5d214
TLSH
T149219DDBC2EC467D899697F12E267923C5AF061C42283C02C9D9DF8F97F1435464114F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5af270.TMP

Path C:\Users\Admin\AppData\Roaming\era\Network\Network Persistent State~RFe5af270.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\era\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/3412-719-0x0000012BFD030000-0x0000012BFD3FF000-memory.dmp

Download

memory/3676-718-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4600-38-0x0000000007EB0000-0x0000000007F46000-memory.dmp

Download

memory/4600-18-0x0000000005B70000-0x0000000005B92000-memory.dmp

Download

memory/4600-17-0x0000000073070000-0x000000007382C000-memory.dmp

Download

memory/4600-16-0x0000000005BC0000-0x000000000620A000-memory.dmp

Download

memory/4600-15-0x0000000073070000-0x000000007382C000-memory.dmp

Download

memory/4600-14-0x00000000033D0000-0x0000000003406000-memory.dmp

Download

memory/4600-13-0x0000000073082000-0x0000000073083000-memory.dmp

Download

memory/4600-20-0x0000000006370000-0x00000000063D6000-memory.dmp

Download

memory/4600-19-0x0000000006300000-0x0000000006366000-memory.dmp

Download

memory/4600-23-0x00000000063E0000-0x000000000673B000-memory.dmp

Download

memory/4600-24-0x00000000068D0000-0x00000000068EE000-memory.dmp

Download

memory/4600-25-0x0000000006900000-0x000000000694C000-memory.dmp

Download

memory/4600-31-0x0000000006EC0000-0x0000000006EE0000-memory.dmp

Download

memory/4600-28-0x000000006FA10000-0x000000006FA5C000-memory.dmp

Download

memory/4600-27-0x0000000073070000-0x000000007382C000-memory.dmp

Download

memory/4600-32-0x0000000073070000-0x000000007382C000-memory.dmp

Download

memory/4600-26-0x0000000007A90000-0x0000000007AC6000-memory.dmp

Download

memory/4600-33-0x0000000007B00000-0x0000000007BA3000-memory.dmp

Download

memory/4600-34-0x0000000073070000-0x000000007382C000-memory.dmp

Download

memory/4600-36-0x0000000007C40000-0x0000000007C5A000-memory.dmp

Download

memory/4600-35-0x0000000008280000-0x00000000088FC000-memory.dmp

Download

memory/4600-37-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

Download

memory/4600-39-0x0000000073070000-0x000000007382C000-memory.dmp

Download

memory/4600-41-0x0000000073070000-0x000000007382C000-memory.dmp

Download