de5ebae13065b6039da78f1f8eecc5c22c2e9305103229b9d44df49c31a062eb

Analysis

user interaction
yes
max time kernel
95s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IELTSBRO-Setup-3.3.1.exe
Size 76.6MB
Sample260817-sem12ssgkd
SHA256 de5ebae13065b6039da78f1f8eecc5c22c2e9305103229b9d44df49c31a062eb
MD5 58196bb79ec06d7e42d1052f902e5dd2
SHA1 7c93b4dee79df7dc763179f00234ceeceaec595a
SHA512 bf455b03f12e0f03487767e68330297fe77b44873be8b2487152ce5b3010f775cb2749c1af8956fdee3e7fce81c63556d475a0507cc78b1cc6abfdd846fac033
SSDEEP 1572864:2b/kwbM76WuGqZ5MAocPZEO9ZvWqxCzgkLVBkmotHpB0:2Aw4iZ5e2EEigkLMFz0
TLSH
T1310833263F9FD627CC2DDAB2049ED5821A1D6ADF9680C8E312A4DFFE55932C0584E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Discovers running processes 1 TTPs 8 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2004	tasklist.exe
2488	tasklist.exe
4356	tasklist.exe
924	tasklist.exe
2364	tasklist.exe
4312	tasklist.exe
4120	tasklist.exe
5236	tasklist.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\yasige\locales\ro.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\bg.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\ml.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\zh-CN.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\pl.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\chrome_200_percent.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\v8_context_snapshot.bin	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\雅思哥机考软件.exe	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\bn.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\hu.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\it.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\ko.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\version	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\da.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\lt.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\ms.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\pt-PT.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\sv.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\vi.pak	IELTSBRO-Setup-3.3.1.exe
File opened for modification	C:\Program Files\yasige\resources	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\de.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\gu.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\hr.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\zh-TW.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\LICENSE	IELTSBRO-Setup-3.3.1.exe
File opened for modification	C:\Program Files\yasige\locales	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\id.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\kn.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\sk.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\sl.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\Uninstall 雅思哥机考软件.exe	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\ffmpeg.dll	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\libGLESv2.dll	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\LICENSES.chromium.html	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\en-GB.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\en-US.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\et.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\tr.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\vulkan-1.dll	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\es-419.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\ta.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\ur.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\d3dcompiler_47.dll	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\el.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\fa.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\pt-BR.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\sr.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\sw.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\ar.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\es.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\vk_swiftshader.dll	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\fil.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\ja.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\vk_swiftshader_icd.json	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\af.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\ca.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\hi.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\mr.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\snapshot_blob.bin	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\cs.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\ru.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\locales\th.pak	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\resources\elevate.exe	IELTSBRO-Setup-3.3.1.exe
File created	C:\Program Files\yasige\icudtl.dat	IELTSBRO-Setup-3.3.1.exe

Executes dropped EXE 5 IoCs

pid	Process
5300	雅思哥机考软件.exe
4744	雅思哥机考软件.exe
932	雅思哥机考软件.exe
3740	雅思哥机考软件.exe
3312	雅思哥机考软件.exe

Loads dropped DLL 21 IoCs

pid	Process
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
5300	雅思哥机考软件.exe
4744	雅思哥机考软件.exe
932	雅思哥机考软件.exe
3740	雅思哥机考软件.exe
3312	雅思哥机考软件.exe
4744	雅思哥机考软件.exe
4744	雅思哥机考软件.exe
4744	雅思哥机考软件.exe
4744	雅思哥机考软件.exe
4744	雅思哥机考软件.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5076	cmd.exe
2704	cmd.exe
4344	cmd.exe
3868	cmd.exe
1144	cmd.exe
2592	cmd.exe
4956	cmd.exe
5852	cmd.exe
256	cmd.exe
5976	cmd.exe
6000	cmd.exe
4176	cmd.exe
2440	cmd.exe
4320	cmd.exe
5240	cmd.exe
5824	cmd.exe
2364	cmd.exe
2500	cmd.exe
3060	cmd.exe
2916	cmd.exe
1216	cmd.exe
5748	cmd.exe
3836	cmd.exe
4516	cmd.exe
4560	cmd.exe
2660	cmd.exe
2604	cmd.exe
3900	cmd.exe
4476	cmd.exe
240	cmd.exe
5092	cmd.exe
4660	cmd.exe
3940	cmd.exe
5400	cmd.exe
3904	cmd.exe
3332	cmd.exe
992	cmd.exe
1572	cmd.exe
1508	cmd.exe
1248	cmd.exe
4916	cmd.exe
2132	cmd.exe
1712	cmd.exe
5812	cmd.exe
2756	cmd.exe
3276	cmd.exe
5904	cmd.exe
1372	cmd.exe
3268	cmd.exe
3952	cmd.exe
2256	cmd.exe
3728	cmd.exe
4280	cmd.exe
2404	cmd.exe
1096	cmd.exe
4540	cmd.exe
5952	cmd.exe
6132	cmd.exe
1820	cmd.exe
3884	cmd.exe
4480	cmd.exe
1912	cmd.exe
1440	cmd.exe
1464	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IELTSBRO-Setup-3.3.1.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe
4356	IELTSBRO-Setup-3.3.1.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4356	IELTSBRO-Setup-3.3.1.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeDebugPrivilege	2364	tasklist.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe
Token: SeCreatePagefilePrivilege	5300	雅思哥机考软件.exe
Token: SeDebugPrivilege	4312	tasklist.exe
Token: SeShutdownPrivilege	5300	雅思哥机考软件.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5300 wrote to memory of 4744	5300	雅思哥机考软件.exe	91
PID 5300 wrote to memory of 4744	5300	雅思哥机考软件.exe	91
PID 5300 wrote to memory of 932	5300	雅思哥机考软件.exe	92
PID 5300 wrote to memory of 3740	5300	雅思哥机考软件.exe	93
PID 5300 wrote to memory of 3312	5300	雅思哥机考软件.exe	94
PID 5300 wrote to memory of 3312	5300	雅思哥机考软件.exe	94
PID 5300 wrote to memory of 3276	5300	雅思哥机考软件.exe	96
PID 5300 wrote to memory of 4476	5300	雅思哥机考软件.exe	97
PID 5300 wrote to memory of 2756	5300	雅思哥机考软件.exe	98
PID 5300 wrote to memory of 3900	5300	雅思哥机考软件.exe	99
PID 5300 wrote to memory of 5852	5300	雅思哥机考软件.exe	100
PID 3900 wrote to memory of 5940	3900	cmd.exe	106
PID 5852 wrote to memory of 416	5852	cmd.exe	107
PID 4476 wrote to memory of 5584	4476	cmd.exe	108
PID 2756 wrote to memory of 3268	2756	cmd.exe	109
PID 3276 wrote to memory of 4268	3276	cmd.exe	110
PID 5300 wrote to memory of 3332	5300	雅思哥机考软件.exe	111
PID 3332 wrote to memory of 4904	3332	cmd.exe	113
PID 5300 wrote to memory of 1216	5300	雅思哥机考软件.exe	114
PID 1216 wrote to memory of 892	1216	cmd.exe	116
PID 5300 wrote to memory of 256	5300	雅思哥机考软件.exe	117
PID 5300 wrote to memory of 240	5300	雅思哥机考软件.exe	118
PID 5300 wrote to memory of 5748	5300	雅思哥机考软件.exe	121
PID 240 wrote to memory of 5908	240	cmd.exe	123
PID 256 wrote to memory of 4252	256	cmd.exe	124
PID 5748 wrote to memory of 1488	5748	cmd.exe	125
PID 5300 wrote to memory of 2132	5300	雅思哥机考软件.exe	126
PID 2132 wrote to memory of 2572	2132	cmd.exe	128
PID 5300 wrote to memory of 3868	5300	雅思哥机考软件.exe	129
PID 3868 wrote to memory of 4280	3868	cmd.exe	131
PID 5300 wrote to memory of 5976	5300	雅思哥机考软件.exe	132
PID 5976 wrote to memory of 1992	5976	cmd.exe	134
PID 5300 wrote to memory of 5240	5300	雅思哥机考软件.exe	135
PID 5240 wrote to memory of 696	5240	cmd.exe	137
PID 5300 wrote to memory of 3836	5300	雅思哥机考软件.exe	138
PID 3836 wrote to memory of 3852	3836	cmd.exe	140
PID 5300 wrote to memory of 3940	5300	雅思哥机考软件.exe	141
PID 3940 wrote to memory of 6064	3940	cmd.exe	143
PID 5300 wrote to memory of 992	5300	雅思哥机考软件.exe	144
PID 992 wrote to memory of 1440	992	cmd.exe	146
PID 5300 wrote to memory of 5824	5300	雅思哥机考软件.exe	147
PID 5824 wrote to memory of 2364	5824	cmd.exe	149
PID 5300 wrote to memory of 3728	5300	雅思哥机考软件.exe	151
PID 3728 wrote to memory of 5424	3728	cmd.exe	153
PID 5300 wrote to memory of 5092	5300	雅思哥机考软件.exe	154
PID 5092 wrote to memory of 1260	5092	cmd.exe	156
PID 5300 wrote to memory of 5952	5300	雅思哥机考软件.exe	157
PID 5952 wrote to memory of 5940	5952	cmd.exe	159
PID 5300 wrote to memory of 1372	5300	雅思哥机考软件.exe	160
PID 1372 wrote to memory of 2616	1372	cmd.exe	162
PID 5300 wrote to memory of 3268	5300	雅思哥机考软件.exe	163
PID 3268 wrote to memory of 2020	3268	cmd.exe	165
PID 5300 wrote to memory of 1464	5300	雅思哥机考软件.exe	166
PID 1464 wrote to memory of 4312	1464	cmd.exe	168
PID 5300 wrote to memory of 1144	5300	雅思哥机考软件.exe	169
PID 1144 wrote to memory of 2440	1144	cmd.exe	171
PID 5300 wrote to memory of 4516	5300	雅思哥机考软件.exe	172
PID 4516 wrote to memory of 2888	4516	cmd.exe	174
PID 5300 wrote to memory of 6000	5300	雅思哥机考软件.exe	175
PID 6000 wrote to memory of 1248	6000	cmd.exe	177
PID 5300 wrote to memory of 4344	5300	雅思哥机考软件.exe	178
PID 4344 wrote to memory of 2272	4344	cmd.exe	180
PID 5300 wrote to memory of 6132	5300	雅思哥机考软件.exe	181
PID 6132 wrote to memory of 4916	6132	cmd.exe	183

C:\Users\Admin\AppData\Local\Temp\IELTSBRO-Setup-3.3.1.exe
"C:\Users\Admin\AppData\Local\Temp\IELTSBRO-Setup-3.3.1.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Program Files\yasige\雅思哥机考软件.exe
"C:\Program Files\yasige\雅思哥机考软件.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5300
- C:\Program Files\yasige\雅思哥机考软件.exe
  "C:\Program Files\yasige\雅思哥机考软件.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\雅思哥机考软件" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1724,i,9567398942696826750,13394973939537841215,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4744
- C:\Program Files\yasige\雅思哥机考软件.exe
  "C:\Program Files\yasige\雅思哥机考软件.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\雅思哥机考软件" --field-trial-handle=2260,i,9567398942696826750,13394973939537841215,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:932
- C:\Program Files\yasige\雅思哥机考软件.exe
  "C:\Program Files\yasige\雅思哥机考软件.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\雅思哥机考软件" --app-path="C:\Program Files\yasige\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2560,i,9567398942696826750,13394973939537841215,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3740
- C:\Program Files\yasige\雅思哥机考软件.exe
  "C:\Program Files\yasige\雅思哥机考软件.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\雅思哥机考软件" --app-path="C:\Program Files\yasige\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2752,i,9567398942696826750,13394973939537841215,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:3268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5240
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:3852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  PID:4480
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:1712
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:4280
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:2404
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:1820
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:4660
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  PID:5076
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:1912
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:2704
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:1440
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:2364
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:2500
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  PID:3884
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:4176
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:4560
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:3952
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:3060
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:2440
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  PID:5812
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:1248
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:1096
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:1572
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:3572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:4916
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:2592
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  PID:2916
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:5400
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:3904
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:4956
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:5904
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:2256
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  PID:4320
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:1508
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:4540
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:2660
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:2604
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\LICENSE
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\LICENSES.chromium.html
Size 9.0MB
SHA256 b1ac2fb5c8f0407ec73ffbfcff46aa634a3acf034eb10ef3f69cf483f43e591e
MD5 a6788c05c8f55285267442473bc145aa
SHA1 a19630a8a0536a80f095e0be19b5a21b9f8b7945
SHA512 c7125e3062ce1591a646424e6f7fca36f0559cfe37197ad10f74415471916dd6d386b8d3f9c15accd43f678777b8a6f7c515be28f13b97d200942e5f13191d90
SSDEEP 24576:c4QQf6O36j54wRaXe1Vmf/6k6T6W6r656+eGj7/4po:xseGT
TLSH
T12CA6A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\chrome_100_percent.pak
Size 147KB
SHA256 14a6a393c60f62df9bc1036e98346cd557e0ae73e8c7552d163fa64da77804d7
MD5 3c72d78266a90ed10dc0b0da7fdc6790
SHA1 6690eb15b179c8790e13956527ebbf3d274eef9b
SHA512 b1babf1c37b566a5f0e5f84156f7ab59872690ba0bdd51850525f86769bfebc245f83988a3508945cf7617d73cd25e8469228974dd2c38415388b6a378552420
SSDEEP 3072:Mz8JCGIdkwTPa/XKjKkxP1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Mz81Idk8a4Kkx5K18Gb0OV8ld0GecQ35
TLSH
T126E3E1D7B3F4ED7DCAA756F7A2260071ECF3462C0A92124B178AD4352A66748DCC8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\chrome_200_percent.pak
Size 222KB
SHA256 20c93f2cfd69f3249cdfd46f317b37a9432ecc0de73323d24ecf65ce0f3c1bb6
MD5 3969308aae1dc1c2105bbd25901bcd01
SHA1 a32f3c8341944da75e3eed5ef30602a98ec75b48
SHA512 f81ed1890b46f7d9f6096b9ef5daab5b21788952efb5c4dcd6b8fd43e4673a91607c748f31434c84a180d943928d83928037058493e7e9b48c3de1fc8025df7f
SSDEEP 6144:HDQYajN6svyABnI86uKkxugx5GMRejnbdZnVE6YoppO4:sfjN6svyABTKkxa6edhVELoXO4
TLSH
T1F424F1C7A3F89D7DC9730AB3522601F1ECB211394AB6521F53DB9C357996AC988C9383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\ffmpeg.dll
Size 2.8MB
SHA256 94efdb523162f7a55884f6bc423012f3dd046f85504deccfeef59603307db71b
MD5 5253864a60577a0aa98db449cd7c6440
SHA1 f4423def8024c5015367747c624d035a214ef49d
SHA512 1af68134a381499134240d9ac42874005012127a81ba77ac3f1497509ba298bd092d7a17e49ca831865034d716ff156186c5547dab1ab8484431bdd1757baaef
SSDEEP 49152:/tOSF+Xn6Rjc8E+E4Og1JytTbEcS2E+X6CftBJyN/4O5Isy:/t9cWOgTyZxzZO/V
TLSH
T166D5BF03E6CA50D9D029D071979F9223F631344A8F2567EF16905A213F6BFD82E3E729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\libEGL.dll
Size 473KB
SHA256 c9f1fb6b4ded3404ad29e629874ff05852f48f82ac33ba606847cac0ebef79e4
MD5 cc528ba62f3867b7ad803ff22a6e1c08
SHA1 e13118e48060a58bff0f8d5c8394a3ff7b60cc95
SHA512 79f74d6f951624b3f8575acff6612aacae1e9f3e32b0abf9ea9688887666097429bf35d8eedf9ad3970a30957696eafd747020c6bebb76e2fd9b2d2e8526e0ab
SSDEEP 6144:f5M81DtTHzR8J6E8cmqLD0x9cDEZAw6wu7fPbAT1TAswwdph:BMkBB8JB8cmqLD27ZOwu7fPbAuZwdph
TLSH
T1D0A48D1573D444A9E06BD1708A574643EB76B4920B65FBDF02A092392F7BBF89B3D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\libGLESv2.dll
Size 8.0MB
SHA256 c636de2892cb651220331734ecc578003dfe31f6ed528ffffe66370b2114b086
MD5 f7aa9fea497e88d41e61cd5090bcba53
SHA1 54a9f86943d1c496d3a73dc888c39df7830194d7
SHA512 6adf7de3f6462b15c7ccec8d4858d30f3cf042dd5698c248ee371b750896c222f7720c39b787200136eff80438d0fe977d1278f49aebb90d19ba9ada79175861
SSDEEP 98304:6nXvuO/so95HjrmniuxV0OADYDOnOQP7sG+XC3OT56:6nXvj/so95DrIpgDfnBsvmOQ
TLSH
T156867C03F69680D9C04DD2B8975B9623FE3178990734B6CF269017292F77BE06BBA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\af.pak
Size 509KB
SHA256 5bd93621de82965b8a7d425660d4afef8102d058e48e8b42e0a45ea2b32ab2fb
MD5 6484a2029d88dcf78a569e65f2987933
SHA1 9e9a6f609333d14ca692730055cbd8be56b98c32
SHA512 6ac6fd8cb28c0c41beb5fb6ab1352681833d0c85507a752866db1139b75b75c2572aa0768ca82513235514af064e26cbbf0d76dd6a6fe0d20eb309e9c9ff72ee
SSDEEP 12288:qFoen+o3LDVy4VGmxu/PS+H2JynCa5eIRVho0vMI5gX2FT+FXZ22h+2pslVtn5g5:qFv+o7DU4Vj8/PS+H2JynCa5eIRVho0m
TLSH
T1DAB41C06EB80273D09A076D6BA0845F7FB9CA26CD770B2B6DD9D82321966EFC017D1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\am.pak
Size 822KB
SHA256 d759c21b9569163629f2443e69f274ffdb3b1417eaa2b72d1dacc9a31819dbf3
MD5 e429defda7e6297a72c0bc4e36aa3f5b
SHA1 c609b50a3108558891a6ba6ec55e4d08d28faea2
SHA512 e2933099d010932a5468bca06f8aa74f9d387d359be57a58a16886c4702cc7d445aa977dffb54b9d35d69517670a428f041561d198143b7df621c2a47a42c12a
SSDEEP 24576:EaqDTorJhTCQIymrxn7Kxjkexpz205C2gMRsVGq+XG/6Kx/Ppp:L5k
TLSH
T12C05BB547EF9F7570F8E8A19A4320E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\ar.pak
Size 901KB
SHA256 3883cff8aacb76e0ee906eb27eb5e5437674bb9af85bce1087fb49667d0c47d1
MD5 27f7382231e5edd297fce25db6c212bc
SHA1 a12ac371d96a713302350b91e85ce647f6b77fa2
SHA512 34b43f75c6600905194e98645603dae0188d09c84d7d31586f8bfa92df14221a9cae8ea0876c1ec37a19f07d01bb3542f950a623a4ee5f9f0f71b62c73291e58
SSDEEP 12288:BjwXVBFE/T/RKOEZrpvPUoIm+kuESJ5TNphQ/fitCj:kU5tQh
TLSH
T15A158BE21B2984720B56DF0FD1E23668E872BD23EB4BFC3124934A2156D7513E78E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\bg.pak
Size 938KB
SHA256 c87083562fe57e1168aaed1f432e74372919c2008aa690ca6ce719f1787d9522
MD5 ac47647ebc503ce6f77e036b218fe3f0
SHA1 e956c1a99025b8b8d92f8de8869a97a8cefc8285
SHA512 d3bce66e1ecbb1c216942a79102cbcd264b8d946de3723ab1f26b3b8e299b9569a0fda833cf72eaeb12d9656b0d681e5bd89952fddc5d8e51efa059041a8b4f2
SSDEEP 24576:LqDWArCqrOJLYazQkEC/UTVbAUkp373ZS73AAKUyVDxzR4umpfd2Wd5pbuFZojQB:+lrCqrOJLYn+UTVbAUkp373ZQ3AgyVDh
TLSH
T10C1524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\bn.pak
Size 1.2MB
SHA256 09dc06e2f6fbf4089cad32a23151cdc8fd873c17def2e85eaad31353743aac70
MD5 6a454e70f4587d7d767e3cd914a0387f
SHA1 a238ab368326c312815b194a9b057dda2a20d6f3
SHA512 13204dfd132df04fad51b4e1a636de5f2b63267c394411fcee57ae81d34193946a08634270800d86a30717be78eef20ec821659dae367328b1c6cffdaf2b838e
SSDEEP 3072:nv35NhwKwc/XeYvHCkSc2e/RT+amfmB0xyoYy3wFm7BbYzIh+5NBrqL:v7hw9c/uYviv6oYSwFm7BbM57qL
TLSH
T17645DE209C6E91B2A8C5CDC9474C6370C5236E9B9B61F74DDC17A25938ADC3C8CADDB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\ca.pak
Size 571KB
SHA256 17db67b5c28354db5bfa08697fae29c3555728a6409a653e0f136216c2d05e6d
MD5 a7f88df4c6929843e3fd867aba68775b
SHA1 5c911c2f451ce38f5d505eeed3b3b27870559694
SHA512 0f93247a1f05ffc4aa51b185c4400f1e38507ec257930465daf61bbe25ac85aa44da609d74f8cd22134d247df3447e5e634b33ad29582ba31a805b7d3f9d2e4c
SSDEEP 12288:HHUTVot7D1DeCie2O3R45PqFuN3Mw2juwHzejm0t3lAkbKTenjRxwOwjcXR2lxQc:Ul47SR57hhMNU62B56AUa+
TLSH
T199C4E8239BCD3B7744D2320AFB46C217A48CA9847B06D254F4AF1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\cs.pak
Size 589KB
SHA256 09483aa859d024639f5bd2325007b4d2a35ce339231e051a943e1f0eed1b3336
MD5 a13e490df259331b90d3f0eb7690dfb2
SHA1 9c8ebaa5eddaab4f1d962dc6196ac7ad5a532127
SHA512 392241b41167af66a71ecfc719feb8e3f35ec23f2f9d2bde9bf0447d6baa1096a654d02429261a95bedc3de1cace712528e611787cb86a5e6c988e2406df34bc
SSDEEP 6144:83udwrsAbJG1v6JuyUTNIAsZSmAcNO5c0CjAh/NOKbJSBf48Q0:8QdSARIAsMx5c0CjAh/NOeJST
TLSH
T18FD44A1EEEA26425488002887BBE4128BD1E83540B6FB9BB7C8F9C95217577ECFF4D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\da.pak
Size 533KB
SHA256 19d135158a35608e646299defa1647743132a9436c0411ccce2b595ef9738b45
MD5 d52825334984cf13c45f71c38bd07ec3
SHA1 f2ba6d65d15f50f1ae244581bf13747b2b2b1f26
SHA512 21922efbc307912e02daaf3ff66149e50d8fc05b2db2d0be0e3e7ea0fd420a9dd29a334e83df59f42f4168d2c04d4946bd4671a4495855884259e959ad87917d
SSDEEP 6144:OBawkwwfzVm05uE7ZY1seSjUwlQO/JwcgobwpPaHwn5N/6UdKHzjd42Fxw8:4awkwU7djwbv5N/NdSn
TLSH
T192C45A4BDC9C732F89A94764F3118EA7EB5D543CC684224F65D8943A09CFDA093BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\de.pak
Size 569KB
SHA256 954451a308b8c451f080ab628f53a16e6638c201b4d79a094ac5f3ae263c50e2
MD5 62fec38cacd3786d15a6299947e36a34
SHA1 927aae72ca89c1d1b7f15ec5c3a2a9823cc615e3
SHA512 957d6ac274db6bf63c789a90dfc5c437db316eeb6e30ffaf4899faafdabb8738cf2ed54acc100d15c41398bbc9f3d546d497f29e4675db50a02e1003f61fb339
SSDEEP 6144:GwqiLKbc0Y5r3K7Up26YwgsaKa6mzdyO9BdTgAKOzct5IjO63BMpUhPMlIsCx3:lKer3K7UpPgsavbHYt5y/MpU/sCx3
TLSH
T193C41703ADDF625EC78273607305CDB77B19E36BC346312A88EDD12B654B5B283AD426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\el.pak
Size 1.0MB
SHA256 627dfa327bd3971ae2f26048c247fcbeaa33b3301c3b78f72ec3f199a365ca2d
MD5 de1a605a023f9f70c167c0b5dfe3a3ab
SHA1 bfc7f3ad1782ba103227401cc40508be58a931bb
SHA512 2f8f3c40419761b6331927c0287b1e65067ae5815e6c4fba764d17a2a4d670a54a0db2b35108d5967067c40ab987e458b0e84af9a4ad851afdd6286758cd8265
SSDEEP 24576:BVwHcaFbu4FiYX9m3MDlrJXDsSlmiH63D2NpUyEjHm1mVT8y2IWYNQKlCt2rDQu8:gHcaFbu4FiYX9m3MDlrJXDsSlmiHaD2t
TLSH
T10825CFEFB4542DED8086950785D8F07C2BC62D6CE749CBD86629CB60BDF80718A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\en-GB.pak
Size 463KB
SHA256 811cc30238e961c852267a897c579d6cbebfb957fde9be662d23e4ad989ec894
MD5 f5e4073325dfebfd35aa09016108f480
SHA1 93919cb1a28ac0a4a77e966d6599fd832edafef8
SHA512 503bb198fbdad64c67df0a2a1a2730153758e58fdd3c0139bf7e89477b96cf7c8ecebb23184d48163e6e96d1dfca9646870aed77bb393a5355605efed49032eb
SSDEEP 6144:e/BeweES7Ve7adMUwzqNMP9eqQ3K8faYmfcmk59MxhBcRRpVA:IetJhMiNMtQ3KB+5ux8A
TLSH
T147A42C1FF7841269069311B27F09A662FF26D06CB35116663CBD802C33B676AC3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\en-US.pak
Size 467KB
SHA256 de60674fcae1e9395cb9a2a2987dfbd97defba59dcf7e5e61a452602e38179c0
MD5 45b984d76459ab58884ad190f54bd93b
SHA1 6c70aad992986beecd86aa35d04441d345b9beca
SHA512 57635aa89a30a0dbece3586ef4b92ef96003faa11c8f666b8bab6522f7c26d7d6431e08c6335d41aaf5e33844e5fb735a22ee7aa621956dab6fb6615ab54795d
SSDEEP 6144:5sNJk9kFTDBop3rfxnKF8HWMP9epQBDRfaYNr2B55Mxwngpt/hLFwB:AobfxnlWMaQBDBm5qx/FwB
TLSH
T1E0A43B1FF744126A069352A27F0995B2FF36D06CA35112563CBD802C33B6B66C3B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\es-419.pak
Size 562KB
SHA256 99d5177b232925a00917b191ac358d88cd8e9a3eed73ed456ac4a62928345b49
MD5 7c122de65f4203421225e792afd77fb9
SHA1 964edb32afbb973635397b66f36a42255f9e89cf
SHA512 fb8fb7d87500fb1ff2ab16a2c960428ab5d9548a17ae24aa313d8ea60b11a36478f86ff99bc45d29e0cf33e7a97ab9a99b05412337aa5f6a7a076c7df506f1f4
SSDEEP 6144:TeTY0pDeoFnPbDRpDYBcO5oi1A5za6aQ+lR51m:V04WprOE5zaI+7m
TLSH
T17BC4F822BAC81F5310E3A388B743D753E4989545B408C29BE8EB876562CCF8CD977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\es.pak
Size 562KB
SHA256 d66d7ac73c09edc6dd00dcb1b414bb662de6b588c06621764eb2e212db80fe9e
MD5 3c4e61e751fd35dba90695f806011bfe
SHA1 c29105b94443f3fe8400eead098d8c53fb9b7dca
SHA512 de3fb60248914f470a6677de2769efa485151b2e5c7a9f972c829cf7ad1c61d4542e71dea3df132bbb5202daaac45a60b01965ca03d39179d7830a6604072e1c
SSDEEP 6144:DNvbzJTpoaw30n1Fl0fEgRNkpT+KeuiR5R9njm5JLf2Q9g/N6PZauu:JXoS0Fqp6uiRpnjm5Z2oghv
TLSH
T137C40722AACC1F6310A39389B743D753E4D89545B508D29BD8EF876612CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\et.pak
Size 511KB
SHA256 7b17cf34b75cbcf65476af00a0751f55f77ade6caa68513ab3629a5254742b9c
MD5 c4e47186acd7c727283b480ad18e6f33
SHA1 96ba904d1a82286692f16cdbe8c44e310e5adb92
SHA512 a105c16e26b43a2f983096e9a7a2065fb255d951e365716faea81d3c9fccac3b93197052eea0cbb61b51fbbce48f6ff062c5d87574b2f9a7d8638bbbed2b4da6
SSDEEP 6144:8OunMp9UWdLs9/8uq+p9fUL40tmFooSPT88trPSikntfLH5oM2CjiCKMxacfJPQc:5uMpRNG/PhQmFoX4fLH5oMYW
TLSH
T183B43B42A17D731B282412F9E737A963DC9EE7D8B4000D9668970A1971FEFCC38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\fa.pak
Size 836KB
SHA256 00a9c5e4915408b948667b7b5c5715fc3fc8e6d628210bf9a341a55e86b6dfd3
MD5 6e6eff8214f35735566b31d1754ed6b9
SHA1 bcd1fb9a6202d98ed0db195c3c9748d6175ff8b6
SHA512 4c95e42e65e287ddc62266d39ab580cb1d552756a1576477c2e0af3e6f7555e6bdae0fd1c3e2b3840630e73bdb7be4eb6bc630b19a4a4e1f7d268d1484484221
SSDEEP 24576:eDH08u313uyqoT+seqyRmX1loTUOmdAQifaQ2XxFMJGk62YhhdTiI5MX4qOoUtjV:/55X
TLSH
T1A705D3956AAC9AB16747CA0341D33834C773EF12D34DFE40ACA1076609A5B139F5EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\fi.pak
Size 522KB
SHA256 c2e954d937baa4a8ad382d064d8c6b0ce2fc3375c576dde7b8f8adccb83e4bc5
MD5 1920bd8cf37dedd27bedf200f350e1aa
SHA1 4c39426f62b03091130704ba5e6c9bd5442a1921
SHA512 f42a61efe41b6f4e2eedb4690f48b876af4a9c08a596143c3e6b6e12f7e546fcf2cf7f42f3d1fb0072ee98496255811d11934465627096feab5792c76b9b6db5
SSDEEP 12288:C5Hs0LI19loPajaQ5lkgUtWnep0WaAvqYM:6Q5lTn1l
TLSH
T1FCB46D915219C22237C8D29E7DB0903EF5E5E3DCCC284D96E843CBD849E99887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\fil.pak
Size 590KB
SHA256 70e5b30013027e3406ee0a9953bb34e27229d3e0ff60758a7c53837336966833
MD5 f244bdb007787a98e41196e403a002fb
SHA1 95ba50906890d275674d254ec39880e642733f37
SHA512 8720503d85ec0f2ea6ff8127e7c40786d5ffe7545845c7d0795c4fd7b58044549c6f194f0f7e54c49a1b32a78b5594e5bc1637eb62d61927df081b5c4be14882
SSDEEP 6144:lFcF+oO8bCkUEmsynDQ1Jx0phwA6umx5vMq7proEuAlmdK:loO8xTx5N7V
TLSH
T105D4B615B7402748DBC352E51360682FA6E560B83F82786E0FBF269B7BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\fr.pak
Size 609KB
SHA256 fae930c71e897b3a6275d526384e9a5ac62fedc562b76904dd108b55b26f1246
MD5 c4a35720d8c9397215cc73ebf096ca44
SHA1 fddfa670699437b1b7b86975734de0279ff442f0
SHA512 ac0b1a210a30719b58223894367d28e3f8ea1c29ab782181ad135df07174bcbab4274d73b6bcfa850b72f5dcb6b35332040018274fe7cd24f7331d7831a04e08
SSDEEP 12288:MuGwUHo87ZL1H43p9ZR6QuaMVqRZz14xlZsZCMYnY8R58g9sQzc7IPV8IxwSSWt5:fbYViO5+W
TLSH
T10FD4F76FADD431CB1AC612B7FB12D663DD348248F215E340D89F4295129A8ECC39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\gu.pak
Size 1.2MB
SHA256 391a825c8f33718bc87ba6d8407e7fbe951b0fe554d0db689a6762eed38f3006
MD5 0ae1b87656ad93fdf7077743964f25d0
SHA1 501e4abb0e046e80812140bc7ae4db8d316ad759
SHA512 196b92f0c7d51cbff1a8c298656559b2a5b00685fbcba1d44ab6a002abe28c07347400eb5c4cd3b790a7912009c430af52a38d695e49eab906d80b9a1f5a946c
SSDEEP 3072:1oXxpIkT/T2imKPo5zfpJ/rfoIwjAwREJKVMjNiT7llj63rFulPCaSi5NAWsWi/p:1OIiTHm6o5NJbgb6/5qwhr1lXR
TLSH
T13B4519D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\he.pak
Size 734KB
SHA256 1325b70d40e5d5019276c50b4777451875f6dda15e9bb4e23df0de404a2bf76a
MD5 aab6517caad0afbad64ff1736ecd15d2
SHA1 33782592c0e22e54e91225dcb33a3b703c075ff3
SHA512 1497a5069015c37296ad71f6a37ad155f70d4cb06c4c63431382eaa18b2a12870511b7e754968009f5b200537202083cdd272401915a478284f22675127d7a8b
SSDEEP 12288:9XqylNaQm9hVzyD4ki2T2rnCkW9Wqu/5l2PX8ACeX+7eQCajp5Q6syU+ZHWO53N7:FqyNart5Y+j
TLSH
T1F7F49AC4B2D452255231AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\hi.pak
Size 1.2MB
SHA256 92b057a1e57bef223a3fd8c4789c0b8b94825822a07c29b2e7c057853cc627ef
MD5 af21f47fa2fe383621a66adf29101fba
SHA1 85492bdf2ad120f2885053bd72b3091ea9d0f121
SHA512 f985a3bc72bcce3083c17fd968e6c9119d0abe281b24738a0829c77d6c172b71694960b2cb23ea6bfb7545bd045d31410e0f04accdae60362c44abcdcb710433
SSDEEP 3072:udTXlt9ui9DMN74LYYK7lWV/BB0ZV1dKu4lYvhOEOTByntDPtDlgpfgrs4fe/8K/:udblvui94ycYK7lD25RKbhcn
TLSH
T1D555060CEBBEF3B55DEC3C8A32890D37D59D3674A3E5525348D5B3DB9844CB8046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\hr.pak
Size 567KB
SHA256 5df6daf8c34c3e74eea274c8d608b3a177f4d6070a3bfb481cec19ae853b58dc
MD5 512e38d6328c71a24b8a9e068d2a4db9
SHA1 66fdaae1696b4cce1e0ec0d13d346ca5ebd8bb37
SHA512 116f8cbcf0d59139d7b1d197bb2117d34b9579dc418c0c6f17d0b3ffd338836e5d5ce8f1439f792a08839e0a1079ed4afe4f85752c5aea22844a70cbfd551a25
SSDEEP 6144:ikTWSkiC1OhHU0qhw8ZhTE765e9YjPCjlK:ikjgdhw8PE25uYrUK
TLSH
T10EC42A7CBEB297090897A386EFA643447DBE08DCE52597B7784F532E0043F4D6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\hu.pak
Size 611KB
SHA256 a09f07ffc112438f9e79b88907b7853de161bbb91a807af96f57d01339e365bf
MD5 ac4b7e349c25d9d2b29f2cbf2ef866e6
SHA1 d56fc6fb8f66a0b0a0883f572f8345b6ec2072be
SHA512 e70066da52cf2d6752e6e22465c9ff891bfcdb5d04c9f2b2cd052c5059e0229f86a188cf0cb3435b059f66d2e97912d8df33c7ef4b400b5e51e457fe4e84ecfc
SSDEEP 6144:2w6RVhkmyedqVRj9/Hd2DfAUAxekitpd5qK8FZ9plLcYNtDdK0djew6cTnjDi54W:23V7ndqVaAcd5qK8ZhD0qbm5HPyK
TLSH
T15CD44C779376905AB8AC17D378647F16592E481BDF3B26F72887886D30A078D0D83C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\id.pak
Size 505KB
SHA256 8bd54bf3b8cd369b4a92804c160bd3d2b888cc0a716d910c7a324569777f4e95
MD5 5785c0a1142b99b41b6118e096e37e1f
SHA1 a2e8ed5ca1fec60ec811ae9cab74c1286467a4ba
SHA512 2a2a374f74c24cd1876859e4fca2525b5bc8e6d86f88212af1e13970cf4c5b52e7dac31911f6dcaa54c94c0829fff39a984f738813be68c3a80d30051b02249a
SSDEEP 6144:KNU4nGe83eEhx38gmO8jBYBkf+eVnjHFHTmiZI/u5C7pjOBsIn0iT8wHp:BGGdeEhx3F82BcVnjHFzm8IG5C7pWp
TLSH
T159B408632ECD300C594843D5B2DDAA1E7CCD233BAF05B76E8E348F7055A67682726B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\it.pak
Size 554KB
SHA256 d881daf64575dab20072130995d602d21381ec4536b7c57d862b511fc7b34e63
MD5 4e6fb4c153c436faeadf56125b6d2ced
SHA1 bb50f6204e0b7c2d08845ebb46136e552a72c229
SHA512 b44b674e10e726e4eba3a4b0a6e22a14c0cedbabc41e8af42bf2ce0ee008ed944e54e0ee185b116971dd9e14f145c9365c949183cbd27d0c629d0fffeb28b202
SSDEEP 6144:jHeZxQ1ClwrdN/hTx991jY9NxvESIqRRxsO1ytKvWjRT9Tj+ia3bDxLUAqpzSw9D:j+7QPdNe0lZTG8/Pskfgm4s5pLI1W
TLSH
T197C42C3AA5D621151A976359E621B085FB6EFCCCFE417218C99B031C23CFE44E2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\ja.pak
Size 675KB
SHA256 c772f5030a7fa6437e8ec2161694566c8e22319b68c2a2d4777eea7b327f8142
MD5 26579ff78414768486706a010168661e
SHA1 e56243b75fc025bb75d75a6889b6627100c78bc8
SHA512 814984f571a79026b855efb435cbc7e6e24c67a60899cfde9f055375c1b3ba072f47483bb3e059ac3e9d3607ca76bbc4d4f9d97a25538c5de92b2d5a9b8bc22e
SSDEEP 3072:tO5HmTzjDuFR6pe4VhuLKOw7Ei/lwLhO3tcACd5XYSRL51aZEhyQ2ImkNuHvPkwm:YFR6pe49kgKoixaZLQ2ftXabt5z2vVVs
TLSH
T1A3E4407CE3C569369D6153A22C0E36E17606AC9FFCA23A36442DC074BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\kn.pak
Size 1.3MB
SHA256 29e2613bc55ebf10dc0e6318233aaac0b39428a3af0b1e0867805ba60194e88e
MD5 ab565e8d33e64bd5b2b33ee54e3ae644
SHA1 07fd172a4b28dc2eda3081befbf9f6a03d5130e0
SHA512 6698acdbfa8116e124512644de545b5b28fcece8e745122fb53bfb3a81f16dca128bd657c8b5808aaa4b7f055d10b2484c9c92bf425a3f3c82369b6220e0cbf0
SSDEEP 12288:APR7MrXUZiMdlzb4VMQOEoTQ6m0hY7Q593W24hjSEjR:AzizA51WR
TLSH
T1F855CD186DBA7D301BD5006B24EC643EDFF16BE29CAA07C2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\ko.pak
Size 572KB
SHA256 6b32ceb4d71dc8fbebde2f4ca3a543dbc4963525345c9298e8daaa3279663340
MD5 d1ff388e387db1ce20d5f2d462e49981
SHA1 c5a5f2ea00be1d4d8a10960564deceaee958224c
SHA512 0dfd299a6c3a3aeafa1c50254a1a422f7247869cf99548b477802cb0d24cfc6c105172538a9c9f4651a82fb562c40c4757a7af8a34cec2fd969fbeed3e6ed521
SSDEEP 12288:PEw78zNYv7ANf/FTS0mIXRxMSAG0GlzRXhw8fIt8OQ4E3hstRbrCqYwH75Rag7j8:L83A5vK2oUa
TLSH
T14FC4D6F238DB23CD1193C982AEF4FA198382D976F7530294ED44CE44DE645D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\lt.pak
Size 615KB
SHA256 1334d488e5b1a8357cb480508c8f6ce2ad211a9997f347e9ed1b9f712c60f74d
MD5 24d1fc605857a53ee7a92e6003d032ad
SHA1 dc744cb97b47f26cf74ba9e52666cd6c21656456
SHA512 552b1458337403c697b5112e5486aefa50ad994ed8cc9e11bb12a91bf0de2be92e934debe8af1dc670e398464096c925542eb63009bdaba8ce348cd597281a22
SSDEEP 12288:9pa3G+S6MAMF2glccVOc354745CMjMK6SuM:q3GOMxmE3595JjMA
TLSH
T18FD43B0069E3AEFB9A4467C982E48A78DEFD50005737BC61EC69C79AC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\lv.pak
Size 614KB
SHA256 2486f896cf18c55462835ad2f363866995cbb992d5d9d39239b569727afa58b0
MD5 5d5b4c71b5d3cb178511d2c7d7488d1c
SHA1 3bfbfaaf6ccc59e49649ed69a42fbf0d4151f887
SHA512 ccbab44c35da319eab4563ec15d4e612462074e6a99ab35a775531badc6160c5b379f8000420f57894be691da46b9579e48d1c0f57e6cedac350871b19da1c85
SSDEEP 6144:Qa6OdcQGWLW+ta28mZEN4mNLtVFFKbW0E14i4f/ZbOHu51b4BWFAqZTCO5CoCYJf:BXyQzrGPUBE0HcHu5xFAqZTP5bJhgB8
TLSH
T17DD42A559EC68FAA4D908DCB7327D123A8CCD740EE06E112ED7D4B3A650F52432B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\ml.pak
Size 1.4MB
SHA256 3335642c3f0c852beb595889d8a86431001133cb8c14c45bba688b764008b1d0
MD5 af63dfcb2b13d55a37875fb74c30d1cc
SHA1 b3b45850a5a07d1561412882526d5b4ebda643dc
SHA512 73b8ea93e3e0c35b5792cda9e7044c86111b7229d5d83005bbc1efd13a2afcc06b48899a44d50710567234c5788ab8331aefc61f09ac65aaac13e8a0b86f2f93
SSDEEP 12288:FvvbhsMrrKWIcaWyygh4hxn9mMPIPFiKfpBP1zX13dqc9Cuz3ejha+5465MXAfGS:dbhtPpgQKfpBP1zXLRz3eb546WXAu3C
TLSH
T180659D5BA036CD3B0FD102167B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\mr.pak
Size 1.1MB
SHA256 39b3080a83994129a5dd5222dce549640bf51de644da13f2769e836126b7b782
MD5 d9edbcd139a2dda14efb088dbb99d36f
SHA1 757434df97d64e25bbd2e7f9f456283807a49c0a
SHA512 0309a16c49920b45e2add8020c527350dc6613ffcd3ad3ad22694ba419396b583108698ee6dfcdc5c28cd2562c5bb1bf82f1313243a4fc969e1914599d3b8b5b
SSDEEP 6144:aK4MfL6X/05r9Bvw9acCsKZKJUPjSHro053mPnkj:3PL6X/CC9acCVZ1PjSHrJ53mPnkj
TLSH
T13E45C24DF77AF3685DACBC8E36580D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\ms.pak
Size 529KB
SHA256 0615106f5c7adbeccd9bb1ea207c8bbdf5e917499e3860103a3fa60069b835b2
MD5 6f0d9ca4630b5ffe349247ccb3f34589
SHA1 ff9a079ada57344154741070ad85902d576476d9
SHA512 d63db7111f9f92bb18c908bc5a499bc918df54859dca5267e352fa9355968198bcfb42872d96a61c5e4355713ecd0c21aa72383e84bc3713d15526de613c3ae2
SSDEEP 6144:/LPFWCBDA6axAq2YemRl/B5VTUcjt95b3RSyGADBmvzt:5WC1MxH2sl/FL95V9Gv
TLSH
T140B4B6469EDE3118085843D9D2DD6A1B7CDD3332B705AB2B8DB08FB0166E7E53316B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\nb.pak
Size 513KB
SHA256 114ca3cf8ba38df9885e54feced2db9f25c789c12fbf41ded07e58ffeb7d852b
MD5 8788fd146d53925f54e127a2b99eed0d
SHA1 0e892f0ea357ada0e66a868dc908cee3a448c858
SHA512 45927030c080846ce3c533c84cf26ad93f15aed8070edc07f6e12d7a4b4aad3eff6d84cd0b998314635a1655e0c8836199e110ff7f86077f46caebbd268353db
SSDEEP 12288:xygOR9chol4u5Op7f1MHY+HVbE59KLbSAk7f7t:xY899+HVbE54LbP4R
TLSH
T1B5B40783EE86B72EF6A443A4F41885579B7D942CCE98199B54CCC63E18C7EF092BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\nl.pak
Size 530KB
SHA256 f7577370e356b5d1868b0faee46a3030aad4d7a72ff068e8910972862f7e43be
MD5 fc2f845462d8fd201dd55a9bab0c13ac
SHA1 d07988fc8baaaa94cc70e0b3152f96944c8579b5
SHA512 7712854e94730be7973231a55379d51271969cb156bfb88c45497c1b1563f1c4817595397570a2236a43aaaf07db9de89bf3294d76b35952491d9461680e0f69
SSDEEP 12288:G7JXlbJ9WQusQUWFgY5smc2x5btfmzmkbqqn9/OTy:kRlbJ9WQusQUM5smc2x5bFmzmkbqqn9V
TLSH
T1C7C4F917A84E253E59C1A385F6094FBBBF2ED22CC36CE67D94DDC1341443FA882AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\pl.pak
Size 591KB
SHA256 4f12dccb61513bad8306c4f8865daf59d5f666c3540c81bb9c56ef52a972819f
MD5 b6fd1e076dd7b6027d27b09c86440513
SHA1 0a59a7168c7a5f96a4c675b8191c9581f6d61a28
SHA512 d5b77baaf891fbba7786bd67b280fb1289751f9535586a236660a8e573d6ea87b4aec8616076d9987659d4d08b58ef6111766efdef1c15eb5793bd7b000a86b7
SSDEEP 12288:+7Y+WoOB/kDqOXfQfuzSJY6HAubIoP/CUdse3m2UXMgm/1QhHsB51bT46ewy:+62DM31QhU5KF
TLSH
T11BD46C0D96E98A4E4DB008E6F2E70B7CACDCC808F109D35FE45F452A615B19ECABE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\pt-BR.pak
Size 555KB
SHA256 74f1be3440a80f55b028cb3c42f291fe41c1626267603d94f57fdececeda3358
MD5 b00063d518dc48d46182bb86a2676357
SHA1 850c6757ebf56758f4ad9452e394427903527889
SHA512 75459d63e98eda8b450576d9cc1931c0e11f208ddc0742b9962b5e63c47dba92b6cffe2ef8bc5fb288a2302303628dbc6b9b7837a61b50e9dad1d6df29a16345
SSDEEP 6144:ikRiNLcbEORKqqZdNBXBLQSL4yPN5hDXFmW1sRgMCrX:ihcbEORKnZb5ZXPsR9CT
TLSH
T10EC41B2A6DCA136605225350B74EEB43E5881745FE0ACA87DCEF4F05A3DDE40DA33BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\pt-PT.pak
Size 558KB
SHA256 72d9a069944ccf2ac4a6ef44110a2e3e70e8aa550664bc70445947ff72847038
MD5 27c720e2920e684d908f6037a9d9efd7
SHA1 28384d13c87368cd4196c461b86315eaa91525f7
SHA512 136d22693d858e968651c50d3759796f15bdcf20d002a41e70939291398d30774c4677284d13d20332571e04b54653880fa03cc310c0ea18e33c2b5bb7c2ab00
SSDEEP 6144:higrtjhtJKr5QBieJVJJxh2D43RfZRI5ejB/9SRIh:higvseI5ejB1SRA
TLSH
T1AAC419286EDA136605135341B70ADB03FAC86645F90ACA87D9EF0B0672CDF84D776F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\ro.pak
Size 579KB
SHA256 432c9424a471857301b724035c973ad009502a7dec2a9df95ccfa73fc46dd0f9
MD5 f9d153fc60c03ac552c775c79f862513
SHA1 7e3dc463ad9c4e2d3cea0e5af84aa6afefef086a
SHA512 3fa61ff461ad751e51270ffea575cd0a2c70691afb895de2860c45d3b77e669061d3fabc2fca47bf4b3e2dbd87b2cd150f2d827eb4a5466658fcb223c3a11d20
SSDEEP 6144:z+nmepgF/wMnXEvTpGKdjOoTxatgVSK0GFq584xUXqs2u2/t2E3:Cmepuw0XEv8KBOo9aoFJq58CUv2/p3
TLSH
T12DC43C13A1C82A97199152B2B73624D3E88E105DF641D2CDA4EEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\ru.pak
Size 952KB
SHA256 d9dd48e68d20de6d90f8ae074b4f0f94ad8a9a9fcf20fb86a9a2a41caa618ea5
MD5 19ee869997b40de66599e7dc8d4b8432
SHA1 d7e320dd0a46e1137a2792ed37eb937545544455
SHA512 be3899306e7fdc8de376e2bb92469c61040e3f6256301d04f60578f705ec8e69f2c58e7e01c98dce1a2295f786748f1aabe0d84fca5f1657860850eeb3c26bdf
SSDEEP 12288:OHKqmXdfQjRo4YSWPAY+zJ9ZF1WAavd/96HzW/yqSvDs/m1sXel+YHVeXN2hVO3Z:oKqmXdt5/3rb
TLSH
T10A258660669E64DE1101F01BDD08BE093CEB45FE3FABA35619A42D7F35F2024C63E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\sk.pak
Size 598KB
SHA256 99ed2b13a2804a399a6f4bd5e5608221ffb5874229dea14c33ceb24d99dcbbea
MD5 93d13caf1d389a6489d911468af1df66
SHA1 e57c07f3a46518edd327166b31f443b20e419209
SHA512 4f449e4fe79393c228936c76f11088ec1cf0df887a9d3e6781e9bf4e5d5c41b9f7ebbc1c7f94e8b5b7527be8a3d1037453e7dbe3b585f84d0f83ea59da318476
SSDEEP 12288:1PFFojkpIh4di1i5JAY5Evvw3QXtWTjsxt90g:PFobciY5gwIPtCg
TLSH
T111D45D3FDFE6181E8E8D0148EFEA7110FDBE46508A4EB0A5D84F364714E26ED8A78D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\sl.pak
Size 574KB
SHA256 d6a8d1e4539dc08fc4dd6ac5a048dc20047b6f202103e3782ce59e3f2d908696
MD5 acd74a626e4e41f0e5f3516790ffc410
SHA1 2becb9f0394e61459530cf7028caca2d5b77fd3e
SHA512 0e5d2ca27d1331e916f0a71546351fedbe060efa44726a41a117b3a8fef949604d30a194523a88421bb9740e1092bc288ab19a5eea326c8bdba70e4673a48b28
SSDEEP 12288:o0MGJ7P3cB2FXoFPy53rfpWJU1ui/fzxlqc:oVGJbXkPy53rfgi/fzx7
TLSH
T157C42C35BAAB9E0F0D9BA2CAFEA606007FDC044CD252A661FC4F337D5015A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\sr.pak
Size 884KB
SHA256 de79d880a33f7ba3e5cd8ae457321671582e8fe513eb4e6f5b9e257f6fd3581d
MD5 b4c168b797939706eeab8e590df41a87
SHA1 96aef6c5565c407c1b8558630829e8df34e00caf
SHA512 12d3c08f4d28f7bfb7bcafb3df6ceda91c371d58d6df819810df3a9c0db11c89378cad0a2c7b0c63b618c92d6db7f603ba043c28c494857ede5c6df1a9ba3905
SSDEEP 12288:u2uMrZb7M3KS7PISzNSzdV/Jui4til40b95YLEqu0xjHgV37n5Di/k/0:VuCCuv595guWp
TLSH
T15D1557A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215601DBD34E10B887B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\sv.pak
Size 516KB
SHA256 298cadec1174abc1b918bce83b22a09835cf8dcba87a3438dbe114bbc0463bd9
MD5 409223e938df09ff042e51247591bc47
SHA1 19d98ed2b4e7f6eee3d07913e442c65195aedc5e
SHA512 208266b425d6813f6889d7abed9dfd549602fa26f21231beedf13f8b09f3b2f9ae33d709540a3bb5d637d299fc2976bdbcfc9c7d4671851519318ca7559f7bb4
SSDEEP 6144:wQ/ltJdLdItw1QdjT6shgjCCx//Gl9dB+4RFcz5RtGl5nYF4tkvMmSO5DE/xJa5z:1ttjLdYdjTaCUL50rF2MC
TLSH
T17BB42C438A10F526FB72134DB608115B0AEDE25CE7E2958EB8D9883DAD8BD5805FF347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\sw.pak
Size 543KB
SHA256 c39c3ada455757bfcaecc3d80652e79201d2264578d42d221c52d7c50a601b0e
MD5 40c6e45bbe6afb7e05bf476c9a9b0fa2
SHA1 3d9b166d7ee7eecd748ef5b5796105397fde437f
SHA512 112d77897a9676220bc825ecee6598f0ebbcd5618f7756fab651ab8d6990959bbb16f1f481397f365f4a202366f714d432d3976ffa3e6e787bc3e62f12262f5f
SSDEEP 12288:vslxH+oNrKJpdscpU5QmedqrCBfRdBFUQbQW47TxEaFqYJjNegarCgMje15Z1/hz:0lxHlFC15//B
TLSH
T167C4D6629871E1191233518603DCFF731BDCED5C2E2B29A35A46BF0F218F58857ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\ta.pak
Size 1.4MB
SHA256 c66ce9d65f8691cc431db79178e77bc615bc1f212b27a754d395e5c8adc0fe13
MD5 2401a2e74b1462715a3322101e76e1e4
SHA1 f3ba3ee37edb088faf069de6f83e92ca7426504b
SHA512 28505fbed2d8b665b623053ad4cecc8a7226071779ce50f735efdcf5fa472a5cc00e1a89ab6fcd46a5df11d14b32a7b2f9a99161ee2bf15e4396c6dd9018d629
SSDEEP 3072:cg2yHsU3/YSTDZkE0tJzjKGfd5k62sntRdRtm1vYpiMyf:nBHPL/eF5KGfd52sntRdRtm1vYpiMyf
TLSH
T11B650CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\te.pak
Size 1.3MB
SHA256 4d9ba6b2727f5f62d90dd45019c68137f3d55efc23a85f62b4fa52ece972a073
MD5 e9933a531c8c72a589de854195e9c45b
SHA1 ca9cabd1c81bdfffff5da404b7f2cda5a2fc5905
SHA512 444d751674d9c6a00d571f918582b46ac78fc4be78636c4a1caf9fb52bea63469f70fc8a0f57fdaccd79f12327583f24ab575890dad6d2613bd38d2f29ea0da1
SSDEEP 12288:bKQ1jr7McKNq0yRcJ7FgnC8ybtKRT52bNcW3pk8W9fhBp3p1FZCnATitlF2iJk78:GQ1j/e50UHVj
TLSH
T1EE5591023A6AD310DAE60273752CF66C49781B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\th.pak
Size 1.1MB
SHA256 77209d15decca546704f621bf4e8d9269c56add000c057c568d0fe977c447e21
MD5 aad565b6857b6acce9bd4d551c80308e
SHA1 fc4883a2ef32230f8fbc768e949a443f57217dfa
SHA512 eb75505f6fa302d68def6cab133c6b448f40a2a9e1f4c2910bf56f68388272c8515253143fdf69f0e1febcb9596980ad4f2be0a9b3b96ae229c7f6d5aed31fb6
SSDEEP 12288:EDtO4bQGN9LyZYAPTKznLCVsjU7ynaO1vuB5UzKdfL3fgj8uRU+wunRUdG4Lw+wz:EcT5hNC
TLSH
T127355BB37247DDD479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\tr.pak
Size 554KB
SHA256 df9220e39703440ea7c9d9b74796ab5196fdd0ce7b5953af8813567f39ff500f
MD5 f5ffed9e08e2456bec4f4304358f37a3
SHA1 7fa837edec8f65c80a9873a24f9040046ce1a69f
SHA512 473b831dbe75c08ccc4668920fde200abbb23a4145b255d56fbea41ac1f51e0c71801f8b194324b46c0319d4a86adb89084c7e6b86e3c5cf92de2f313ea9f3a9
SSDEEP 12288:cBr+XqaG9flVXHzNs7DQqZFwbyt+545MI8JX:GsoVq+54538JX
TLSH
T149C4FA8178EF281C8FB9278BD6E90666F89F0766F331F4469A1A9636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\uk.pak
Size 952KB
SHA256 b76695b9352440d27c0319f59cd66df2d8d76eb1162d5f78a8374748562ad210
MD5 1ac5ee33a091d5c44ea7b0c9dbcf01cd
SHA1 97eba903ca99c5764ac11fb075eb06fcfe7fffdf
SHA512 74c72262cdf2d9e02e91490d03c1801416851150a910221cb5cefc4ac5e7f888978d0ccb7583f98d7abd54695a97279b91a4bd466d1fa5a0d66db19212712278
SSDEEP 12288:7MHxyqFx4gaqwmsSr+rhqdgZ0ZYd0IniML5iB3IjsHAf+rTjuuKLNiXErqXYjgX:7MHwY45kr9
TLSH
T14D2599A19A9D58DF0106F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\ur.pak
Size 831KB
SHA256 78799d1065fe84bc64c8c851d5457639172830516ee5c74f08e210973908770e
MD5 b105eed802ffaa71f4c5d802d286a6e2
SHA1 369a0042ccab4ccc1f629f0fa186c62e96feb12d
SHA512 94c08fbb7eec3398ff1a9082c558b5c6830122ff8cfeee03361783a777d0393dbd99a4d654e9d40ba941f798185c171a3b9232f696828aba2a7830453df22c77
SSDEEP 12288:cEYAPz7FC8PIARlaXd28NJry41cfP5k66EhTCkORvlpQYrlYVwadcJKwUku5co/u:cEDPvb55CPn
TLSH
T19F0510D2E6BC96B25A21D92780D33C34CB635F13D34BF285E52246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\vi.pak
Size 658KB
SHA256 55bbd8fed3330da92aee877fb18640cf7c6391d7a6c6bb5aa2d072b4800d3ac4
MD5 95daebfa784e7401c2261f4b3e85013a
SHA1 47e290ed5029f297054eeff67089d974fd3a6c6e
SHA512 fa84e9cd8ba8bd6ce1067ad90373433c8183ed70595fd73915f48823fdbdf9c1b581ab8f10fe738e1b4c7fb6986c62f965e2618b7044e7ce6b7ca0b6d34fe034
SSDEEP 12288:joKSvf1+c8ZoET9VwMNgFu088xY2GbfEj2Wx5a8hZ7cE8UO+mziKHrvacQ1h8:j0v9+c8JVDgo07xHss5a8T7RlO+wiKLp
TLSH
T1EFE4851216E1702680AC553EC6CD540E6FCAE42FF7C18FE56FF429747A221A45F21AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\zh-CN.pak
Size 473KB
SHA256 67e96bfc54394701cb91e112bb07b7b7042ce9f285db3332a19476af566444f6
MD5 780ad68339ccbdd2d0b3590fea4f0d0f
SHA1 c9fe2e935a5f43e90ac6d778d2c7f77209f6c2b4
SHA512 c77f4eb2639f6277404be4a0c70ae68626f119b4a47b8dabd86ed599c07bbde3bc5fb8eae2b2c36b5806def0d08fd9ba756c770f4ba365897368d4166170a35a
SSDEEP 6144:F+Fhet0dfThfYzhJxs7+56PCXTH61pH59zb/4krv7HpulM:F+bemJThQzh3L56PCXTHiH5Zr4krTT
TLSH
T158A48EA911E9BDEC014640E03B29617D7C40B20BF667AF766DD244DD2BA2FAD0717E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\locales\zh-TW.pak
Size 468KB
SHA256 ed372b000597fce75c14edd18ccad1c99e2100be884b58a7e7498488163f2554
MD5 550e545b7a3a3ae0e5b73f127b09813c
SHA1 23592a5cce7a4791366653fdbebcb21b456b2651
SHA512 0e4b4851b0f73159ef0e205e9732eaf3e7aaddfb786327f81571b7f8304a13f26ef27fd901f19a6f4805834615b8b683637dab0f9cb551b3d9eb7b5bdd488412
SSDEEP 6144:/WIM+T9wfsQwTc9ti65JyF72/Yu/lVNt5+QznGhkUnKFieWTl:/WkT9wfEcLi5qNlVNt5+Qzn19S
TLSH
T1E4A46DA609FBDAEF0901F884B7CD523EBC8B746CDD377736FC4518942E7AA640A61049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\resources.pak
Size 5.4MB
SHA256 c8cea345bb0b6878b329c9ffa0a1d0e99036bca70ba40ac7be5842ac3ffe45d6
MD5 3c1b2f7b2cd5c7608ebc5954a853f964
SHA1 3ad812cd6e5e1d41efbc4c0ae0f68eaa9f2f73ef
SHA512 6fc999e482e97019b03704db5b0e8e8278769b3a23df15f93a58c6cb33f7576faa32a6f9b123e6917c26ff289693922168fa3b839a497ee529f65d77a061eafd
SSDEEP 98304:snNlfLKTPeIoXG13gkPOGuKJSml2rwrxySNYtu397pE2RSvc:YlfLKT1gG1nuKJSmQkrxOwkvc
TLSH
T15346338AB7261D3BC8AD437B48AC45331AADD93A0610B857724CE0746E273DC5BC95BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\resources\app-update.yml
Size 123B
SHA256 4f9b71843012d806c65c348784a6010581d64f40af346021212fbf88b8312fbc
MD5 ed8ffcd955ee8845bcbc72dc3e9c7bda
SHA1 10e4ba29b8d9b545cce76dad0427ee40e6f3c893
SHA512 e0c9079361b9fccaf3b27c3858760eadbd1eeb6b6c86b526e52c130cddbfa2ffaa0181122c3b72a9b227b747b11cb01cd89a872b9eda807c969f023cc1e7209e
TLSH
T123B09B51C626C1265761496458426B30F5CED226C859455490E944D4C1278119E1E598
MD5 SHA1 SHA512 TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\resources\app.asar
Size 1.2MB
SHA256 9e527f1d6beeb4dd6c8411314a1dd8450c111db033e9a2db8a72a29a70ea9580
MD5 8c4d48f80e2e1551a25900e73297b31d
SHA1 aab67dc749d55b03065a2068addf6da2bba3e1d6
SHA512 5fe9e5133f0c94b0b44a8ea6c7b312fc23dfd7da00274fd8dfd7be83cad2027663f515065ebf3f66f6486d6a06a04349835f6162b0c33be97b461ec7853d4b92
SSDEEP 12288:g3aJBgFMbX8Saeucbk+4Vi1YFD7KTXGAFyLVK9:gKBgFMbX8SaeucbB4VieFDeTTFyLk9
TLSH
T1504508D33052A8F24FE7A1BF9E56A191F236400DE4C8581EF6ACD4C9163566C1327FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\snapshot_blob.bin
Size 306KB
SHA256 012485d0f26435a42f27c1852433e18d065952c8290b426b5e3ac12286ad8fe8
MD5 186507e8eff5f2b60ea168c3099cfbad
SHA1 274b207de1c205a582a9eb6ac5a84df36bdfd7d2
SHA512 6504d9cbc4f6d7615ca2f0e66d6a987b32b05446aad8a2aef1faf9fc565f3b1602fa0769cb84e40b98dd66e04f51644998d842010143a9962aaaf6b4341682a7
SSDEEP 3072:6gC8CwQXLwqHMp2ubdJbhlsN2CZz6ZU7A9Z+alYu1dVjVBzpLDTA:6gC8wwqexre4awbtJs
TLSH
T16564FB05F7A0CB1EEB156A709DF8DF9A3235B2DE5E06AA0B32C5432D3979A340E0574D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\v8_context_snapshot.bin
Size 650KB
SHA256 f4bf1406c6e521f98dd39a2ceb6d81a8c0bf35055f062bdd708d98c53cd82536
MD5 2cfc6a8da875c38728f909046e73eb11
SHA1 317f38a9a9c768fa678106d39038c8f75e27ea8c
SHA512 753e95f696aa69667edbaea24c44c5651f7a27a52eb0aa6648e2d2631a2e2f868ee57a5202c98013874a0f02b4d93f5300edddae3873d1a1ceefd1ed0234d273
SSDEEP 6144:6BUhyeygCsJwqexre4awlTGWDg9oGhgX2nhxRg/4RpZqCaBPgPEkknFmJA:6BUhyeygCNXGWDcqmqNCaBsEznFmJA
TLSH
T158E4B767F794DF2AEBC95E70AEF7DBD23234B0899E0A651B3186532D3179B240E4024D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\version
Size 6B
SHA256 cefb3d67c024edab1048bbad7f85a6673ac388a823075f47b18b4dc15eb5bcbf
MD5 a7b94b8b6e47d295788de89673744670
SHA1 ad6b3b619962238a677f35cd5eaafac7279ce1d2
SHA512 4c3c0a158bdc76ff53247413154a4ce02879d63ca1f7eb479d1401d07d8cac8fa0f5dc2c7a97c863203ed2ee2825ef30d6c67bf61998aa95955342cedf24b544
MD5 SHA1 SHA512

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\vk_swiftshader.dll
Size 5.2MB
SHA256 a4c0d966165bbc827c8ed00ab4ecd4a611d17872f6c2beacdd1ffa39dd08f275
MD5 3a7acc435c09a8e04309bd0970847ab0
SHA1 abe8fdd0954fa50f238187b7707638211ed763b9
SHA512 a9f7f4d4a7922268170e2dda5abb1f150681a384521941a38ecdf314af8099407dd86db76ea981363bfe99956fde3e7ac00c4b44c6cc6f454b24687114149bc2
SSDEEP 49152:/CGqXVpyP/Xyk8pKe4rIAvp4xC2JXrjX72aqiOE+jFvboDUs2TXT3yirn8h1cxls:JOyP/ihYvc2r1O4Vz
TLSH
T171462803F2858099F05DD1B9875BA622F632BC801B72B6DF52A01F192E77FE06B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\7z-out\vulkan-1.dll
Size 874KB
SHA256 36d6a57e7f6bad5a82c096fa21a2e0c1e2b27801891c0f5f3319de18b4c1cd8b
MD5 dab7c6d9f373359a0ac2270dcb650b1e
SHA1 7f848a2f22b894542aad891aa05ba65386440754
SHA512 0c5783a3709c3492bedeabe886679d9d9f5674dbef0a23eae38a48d99826be060c6f8ff4e1cfa8404b9d99065ca88f32eaaebf70af1618eff2f920e8efa56140
SSDEEP 24576:MwklBPn5I08Atrwoyz6Z5W1DYsHq6g3P0zAk7/BoxR:ML5AAFbyz6Z5W1DYsHq6g3P0zAk7+
TLSH
T121157C22AA648669D47AC074CDC24603CAF274921326B9CF02A45714BF6FFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg843B.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\雅思哥机考软件\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 95d7df46c40e652cf4e8ff1e13c9d360c2c02ae1913034fa808c642affa05f57
MD5 1c1b716e0ef465f3f169f3498090b66f
SHA1 8e086ccd373f4d897c00b68e99d29dc9715a0770
SHA512 2f7d97a3ad23d7f696547fb5d5b04eb92c376c51fdeb63b66aa7f755111fa269459d6129a83fda84cf3277960c4fdbf8dc8cea1e4e14cf99155a70736a1d32c4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\雅思哥机考软件\Code Cache\js\index-dir\the-real-index
Size 984B
SHA256 824580ed54eec12924b6afab2bac1374899304ff18a0c61e5fe23ba53669b4b1
MD5 adedff1b4381cf0f3399e10b20946829
SHA1 d17746d6b2c520e17102ffefc39fbb5706213b5b
SHA512 41eecca218b65112b2f6c0657ef3aa972209a91b2426ab8ef42ced618bc3d0e956aa9473cc7adeaff38061c70119bb3120c085aa9a464898a269014962765760
TLSH
T1E311761183D08515FF1076312BA0CDADAAF50AA379E2376F11541D68B8AA7E663000F8
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\雅思哥机考软件\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\雅思哥机考软件\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\雅思哥机考软件\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\雅思哥机考软件\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\雅思哥机考软件\Network\Network Persistent State
Size 439B
SHA256 5ad6840b7914bcac60488581af0290e2dfbf380b39881d7e5aa44d46afd9034e
MD5 b833cd53f786d64f4133e973b9d2193e
SHA1 7f65f44dbb1e7d108fd2b648682b5d0eec521949
SHA512 fe165f9803e827fca9b8a5d83ac7af6f46d78b0dea08973a2ada4afc7d800a4f2b3714ec6df74d4eace07b2f3da3770dcf69f29eb3dc25e0c52945a3dba8fe9f
TLSH
T1EEF0A0AB837019BE172293F85E142E23DAFE1119134CACA286A46E2A43729B6641158E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5afb2a.TMP

Path C:\Users\Admin\AppData\Roaming\雅思哥机考软件\Network\Network Persistent State~RFe5afb2a.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\雅思哥机考软件\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/3312-478-0x00007FFB9CE10000-0x00007FFB9CE11000-memory.dmp

Download

memory/3312-477-0x00007FFB9CE00000-0x00007FFB9CE01000-memory.dmp

Download