Overview

overview

7

Static

static

3

SK-Games-Setup.exe

windows10-2004-x64

7

SK-Games-Setup.exe

windows11-ltsc_2024-x64

7

SK Games.exe

windows10-2004-x64

7

SK Games.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 14:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SK-Games-Setup.exe
  • Size 68.7MB
  • Sample260823-rh3egaae29
  • SHA256 e25f5a8b0657fb07aa325eec690cf797cda0ead15031841406cc945e03888bd1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 41 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SK-Games-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\SK-Games-Setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5456
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2672
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2388
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\SKGames', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1340
  • C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe
    "C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe
      "C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\SKGames" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1660,i,3018919330347161351,12319873701927422675,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3732
    • C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe
      "C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\SKGames" --mojo-platform-channel-handle=2132 --field-trial-handle=1660,i,3018919330347161351,12319873701927422675,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:752
    • C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe
      "C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SKGames" --app-path="C:\Users\Admin\AppData\Local\Programs\SKGames\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2372 --field-trial-handle=1660,i,3018919330347161351,12319873701927422675,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4632
    • C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe
      "C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SKGames" --app-path="C:\Users\Admin\AppData\Local\Programs\SKGames\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2616 --field-trial-handle=1660,i,3018919330347161351,12319873701927422675,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4208
    • C:\Users\Admin\AppData\Local\skgames-updater\pending\SK-Games-Setup.exe
      C:\Users\Admin\AppData\Local\skgames-updater\pending\SK-Games-Setup.exe --updated --force-run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5220
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2632
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6100
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\SKGames', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2184
      • C:\Users\Admin\AppData\Local\Temp\nsn6EAA.tmp\old-uninstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\nsn6EAA.tmp\old-uninstaller.exe" /S /KEEP_APP_DATA /currentuser --keep-shortcuts --updated _?=C:\Users\Admin\AppData\Local\Programs\SKGames
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4072
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
          4⤵
          • Hide Artifacts: Ignore Process Interrupts
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2200
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2264
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\SKGames', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2320
  • C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe
    "C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe" --updated
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe
      "C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\SKGames" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1756,i,1353446934757362829,10988810854682685288,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3224
    • C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe
      "C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\SKGames" --mojo-platform-channel-handle=2124 --field-trial-handle=1756,i,1353446934757362829,10988810854682685288,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5660
    • C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe
      "C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SKGames" --app-path="C:\Users\Admin\AppData\Local\Programs\SKGames\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2376 --field-trial-handle=1756,i,1353446934757362829,10988810854682685288,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1896
    • C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe
      "C:\Users\Admin\AppData\Local\Programs\SKGames\SK Games.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SKGames" --app-path="C:\Users\Admin\AppData\Local\Programs\SKGames\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2600 --field-trial-handle=1756,i,1353446934757362829,10988810854682685288,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5664

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 01ad5a7a6b9d8efe4e04d767156e91942eb715f9f09cd0c533e62c42be569c8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 d9b0fc4f81640ee8690511553f8b86c9799d0b924fc677cd62eb49f3455a6cc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 5068ea9edab9eb76c7bf7e59a635a9a519aa8aa199a8458af92c88817b62e7a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 b5f2dbefe3a61e959493d9fe8357ec598c11d4916d9d6b89aa177728d31592ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 0608995047a6d5445cf275f8599f2bda19ef56bb5e92a66029f31db566c3ca40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 575eb8cfcb1c8138c742badfd48bef80d8265ab14218ad54fd77a7bcb8b663ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 7c4712c9c4d3bf67253bccf4a987b8e85f885c9e6405f69e69f569a8b9f55a0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 adcfa5530220a44bc5db4ef951cfde83457b787e97ef7a9a231a34546164154a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall SK Games.exe
        • Path C:\Users\Admin\AppData\Local\Programs\SKGames\Uninstall SK Games.exe
        • Size 156KB
        • SHA256 16887fa7fee37d6e64cc038850ac7c3ae27780722a983e60fdf69dd6e169eeb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uninstallerIcon.ico
        • Path C:\Users\Admin\AppData\Local\Programs\SKGames\uninstallerIcon.ico
        • Size 24KB
        • SHA256 a43e4ec8e625ec987154a8c49fa3eac64fb8e117d121ae14bf88147ff639c121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_lr3wlm3q.xc0.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lr3wlm3q.xc0.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        app.asar
        • Path C:\Users\Admin\AppData\Local\Temp\nsn6EAA.tmp\7z-out\resources\app.asar
        • Size 13.8MB
        • SHA256 5ec5193af59caea099f9bd62e53e43bb354496c49d4dd6c1bfb5f0783bfa654c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LICENSE.electron.txt
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSES.chromium.html
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\LICENSES.chromium.html
        • Size 6.5MB
        • SHA256 9f3f2b4d9bbd3113486839eca85de119fab766450cdca08a4574b80748885708
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_100_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\chrome_100_percent.pak
        • Size 126KB
        • SHA256 9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\chrome_200_percent.pak
        • Size 175KB
        • SHA256 1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\d3dcompiler_47.dll
        • Size 3.9MB
        • SHA256 827d12e4ed62520b663078bbf26f95dfd106526e66048cf75b5c9612b2fb7ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\ffmpeg.dll
        • Size 2.4MB
        • SHA256 02a6d001e6dd944738e09b720e49dcb1272cb782b870e5ae319d4600bc192225
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\icudtl.dat
        • Size 10.0MB
        • SHA256 97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\libEGL.dll
        • Size 375KB
        • SHA256 961aff31cab097ebb973a32140c4f87c415734412771cf1fdfe24ddc675b54c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\libGLESv2.dll
        • Size 6.4MB
        • SHA256 e6ab5fc601d0d230c989d2f481b37c259a0a1fffb7fb841b7099a5e966f0088a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        af.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\af.pak
        • Size 340KB
        • SHA256 d63222c4a20fa9741f5262634cf9751f22fbb4fcd9d3138d7c8d49e0efb57fba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        am.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\am.pak
        • Size 551KB
        • SHA256 55357baf28716a73f79ac9a6af1ae63972eb79f93c415715518027fc5c528504
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ar.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\ar.pak
        • Size 602KB
        • SHA256 e34d5cabaed4634c672591074057c12947bc9e728004228a9e75f87829f4a48a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bg.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\bg.pak
        • Size 631KB
        • SHA256 fc4a59ea60d04b224765be4916090e97ed8ddda6b136a92a3827ed0fcc64bb0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\bn.pak
        • Size 812KB
        • SHA256 e325d936cd97c3f9ddfca2d87caefb8b6e7465ffa31d0386ae2456b18f7a92da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ca.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\ca.pak
        • Size 384KB
        • SHA256 e1d6b5fd0bc411f2895eaaa1409916f5ffe39a5c6bd1bafe8af7ce33da5be17d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cs.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\cs.pak
        • Size 393KB
        • SHA256 936466784a55b965d23b016bc49377655bc5d281d012c8369c0809c961e05c74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        da.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\da.pak
        • Size 356KB
        • SHA256 1b0793b1cbeb6a56ff1e64523c37ba753457320aa29f9718022caa07b4981d8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        de.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\de.pak
        • Size 381KB
        • SHA256 e0f632ce324951002c80e019dd0169be9f6b0640533fa434cd6ca80f28a1d3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        el.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\el.pak
        • Size 691KB
        • SHA256 92403b6160e38746597d4dd7f64d64cf19e30b5e7862901263c39679187b2c91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-GB.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\en-GB.pak
        • Size 310KB
        • SHA256 463af7da8418d7fb374ebf690e2aa79ee7cb2acc11c28a67f3ba837cf7a0937b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\en-US.pak
        • Size 313KB
        • SHA256 bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        es-419.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\es-419.pak
        • Size 380KB
        • SHA256 5aff3762747a6e8c6df9f2a3b470bf231b44163006b17ce87e2a03694be27b81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        es.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\es.pak
        • Size 380KB
        • SHA256 267e7b6376e7e5ab806b16fde93bbbcd961bf0c3a7b3a2cabccab37faa9a1d16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        et.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\et.pak
        • Size 342KB
        • SHA256 d984aee4d18ca24a88846b1b6e0294d373733430f30bb4f1b97bc7d50d512c2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fa.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\fa.pak
        • Size 557KB
        • SHA256 221bbbde078d135f6daca4978a31cc6a82f8f46536467ebc9a0cd322c58a7785
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\fi.pak
        • Size 351KB
        • SHA256 5339b8ca52500bd0082e0ba5a5f440c5f04733803da47963280479760c7fff2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fil.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\fil.pak
        • Size 394KB
        • SHA256 4cd3fa70487e894400ad29e3bfbfba3e1c5edd799aab12c62c3aff3c2580ce5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\fr.pak
        • Size 410KB
        • SHA256 1f6bc09499ee37456968a28b67b81bbf5b9df4f0c6035a388242d2037a3b65a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\gu.pak
        • Size 787KB
        • SHA256 c36a20730d5f2b91cb61b5b2a5912db2ea5a328a9b8abe0fca0af300446d3c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        he.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\he.pak
        • Size 488KB
        • SHA256 875712bb852c698f677c0c74e088f62d31adb2bce65648fc390607aad8705c45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\hi.pak
        • Size 821KB
        • SHA256 1e9623c7407ae8b8a88df3f69a47ae8117f74c4dcb56897bb794a9c38ee5805b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\hr.pak
        • Size 381KB
        • SHA256 3d7685163c5eb6a11e745ff934312b8681c5f85dfa8d9ea701e9dcaee1e7a285
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\hu.pak
        • Size 411KB
        • SHA256 3ec43893c6de5ec0f9433841afd5fa9feaaf59ddcef05f7e1cab14dba799887f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        id.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\id.pak
        • Size 336KB
        • SHA256 9210c4c4c33e7ceb5f70005a92a4fd36ca4facdd41701fdc1d2ce638db8adf22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        it.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\it.pak
        • Size 373KB
        • SHA256 c0dc0a4a87f7bb054a30eb1174c3228ea2014bd94668a7d22995b99c4937d817
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ja.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\ja.pak
        • Size 456KB
        • SHA256 3accfd9a1833ddeedb2082fb94101beb59b555c60f42e3070e9e04a372eba84a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\kn.pak
        • Size 910KB
        • SHA256 90b2df3338468e84e2cf2f2f67597cba5c3ceb5dba9c59ebd072ec15a70ce741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ko.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\ko.pak
        • Size 383KB
        • SHA256 b04c1b91cab31054be70cb851dc6716065545445801045daceb96eeee4d2334a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lt.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\lt.pak
        • Size 412KB
        • SHA256 9200a9509bd77834d9912f4ba8f4219d2b9bd2cdad49a11873db30e99b9d1350
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\lv.pak
        • Size 410KB
        • SHA256 b5a31cbfcb40ad8d911de1618c4eb7e8cc67b97eb8878220f15d40eb014d8ac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ml.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\ml.pak
        • Size 948KB
        • SHA256 61a372f170de0a22712be980c3c78b22035ebf40ce79332fab75cdcc4208c9e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\mr.pak
        • Size 772KB
        • SHA256 481faf7dd66cf10a476d8b156fb4ea452f920322d8007f7e25d41b2837bdbc09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ms.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\ms.pak
        • Size 351KB
        • SHA256 fe58cc4f62fc31e32c1fb9a0893a5483391ab6a91b1c92ed4a5e3103a962da7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nb.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\nb.pak
        • Size 344KB
        • SHA256 d565c6c95dad89d3f2b7210de4ec3fc437633de4dcfc994fde0704b92bb53ff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\nl.pak
        • Size 356KB
        • SHA256 55413d5eddb3300e0ae0fa5d79d26fdf1e5a12922d7018c8054b1faa9d660301
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\pl.pak
        • Size 396KB
        • SHA256 53b59486361b11512fb90f15065104b15ee2322bb7804f859cde2f2ecf9581fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pt-BR.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\pt-BR.pak
        • Size 374KB
        • SHA256 c9ec3822044365457b8736348cf95a8e39bdfe3ed36267449bf3ed739accef2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pt-PT.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\pt-PT.pak
        • Size 376KB
        • SHA256 c89170385b3afb2ec89fbd61b8470ac718713c7296441c8430f173dac218e74b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ro.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\ro.pak
        • Size 387KB
        • SHA256 7247470057a936d03bfa2a8776508ab66aa1040c41a4eb8f79c1e93551c74bb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ru.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\ru.pak
        • Size 634KB
        • SHA256 b4223b56ec88235819a427d60bb937eb3984076523f02a018f57819e0429bea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\sk.pak
        • Size 399KB
        • SHA256 75f179897cad221ca6e36b47f53cead7f3fb4159ee196f1d10a5181b84e1b5b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\sl.pak
        • Size 385KB
        • SHA256 6002c129a56558832e9bd260c427c0bd2e1566e0aea3ad999f89c8e479534f9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\sr.pak
        • Size 595KB
        • SHA256 524acc64e70918a77cda43fd9b27a727645b28ad2d4cce16b327105101c8bbeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\sv.pak
        • Size 347KB
        • SHA256 3420a1fbcca5bf8c2d65d6dcb0db78b03f95f7f2fc56479a0de6e3312333ce6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sw.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\sw.pak
        • Size 365KB
        • SHA256 690027c4a31c4aea00b7d1b32ec6cd3fa50b1eac412ae273ab15e72eb485dd6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ta.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\ta.pak
        • Size 936KB
        • SHA256 7e818deedd50a533851bbf08e056bf2ad8d45f442a1a61d9b48e66804ea848db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        te.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\te.pak
        • Size 869KB
        • SHA256 d839531c4ff4a2885c993e0d358f78667215b0950c77a06ef01a6acff9221c5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        th.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\th.pak
        • Size 731KB
        • SHA256 cd80bf232f2f128a3d411f52c8039987559dbc1055f746eed6e0e8478b116dc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\tr.pak
        • Size 371KB
        • SHA256 b22fc7b75c52cc142f201d5cf107d17c1b173a494a6add022127f559fb46bcb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\uk.pak
        • Size 634KB
        • SHA256 28ea88f19b2c34699d535ca0c691449b7e4001c12e8aed8d04b2078916e88a37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ur.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\ur.pak
        • Size 552KB
        • SHA256 4c7affdcc324cd791d10e235da809ce7501e8005be64340b6e8bf5595647a707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\vi.pak
        • Size 439KB
        • SHA256 b75694e390bd2e20780b3bc72f6e1473ba45d7537c27642a7d888dfd3bb6c3bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-CN.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\zh-CN.pak
        • Size 319KB
        • SHA256 a7ac9fda6f4cd189b75fdadc4b70cd0d369a09b66eaeb5d032678cb97ffc98f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-TW.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\locales\zh-TW.pak
        • Size 316KB
        • SHA256 c5061ec00bd969f76f3c0c6ff15ddacafed7491260bd8ced78118691ba57bdff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\resources.pak
        • Size 5.1MB
        • SHA256 4f29587bcd952de1dbc0b98df0aa506bd9fcf447e6a7258c5eb7e9eb780e6d6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app-update.yml
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\resources\app-update.yml
        • Size 101B
        • SHA256 2fe4b29bac5ad3ef54069b96ee1b6a5c3d9b9a117c3811a14eeebaac8a243ac0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        app.asar
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\resources\app.asar
        • Size 14.4MB
        • SHA256 3d320ab67a3ab1fd03af16d3a3b3b42b13b3486f75ec7f8dc11dd851f4081756
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SKORGANISATION.pem
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\resources\cert\SKORGANISATION.pem
        • Size 2KB
        • SHA256 0c1eb581e37d5ad4b7ba1feef437dc48fd677885e494b3a3bee7a2fc95509064
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        elevate.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snapshot_blob.bin
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\snapshot_blob.bin
        • Size 292KB
        • SHA256 3121f179e50d7825795caa68e722e996f794e17240ad6ea0aa94bd065e05aa13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\v8_context_snapshot.bin
        • Size 585KB
        • SHA256 4f72c7b625b64d38f819a970cfff5921ff4080e27de84b00b9a7cf8be15277c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\vk_swiftshader.dll
        • Size 4.3MB
        • SHA256 01742049534047b956328b9a0ca57f720e957edb684a6a0d70acc992e2b684fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader_icd.json
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vulkan-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\7z-out\vulkan-1.dll
        • Size 774KB
        • SHA256 84c7f070e59f3b0bce2d32d4f2e6c7e03fb5d30f82a99c4edd8a251c9a3c0e74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SpiderBanner.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\SpiderBanner.dll
        • Size 9KB
        • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StdUtils.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WinShell.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsis7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nstB194.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default.exc
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512
        Submit Download

        data_0
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Cache\Cache_Data\data_0
        • Size 44KB
        • SHA256 ff6a09443f0918ddcf7fdbe5233e41fdee109f59056504bf33249c8a5b7d16dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data_1
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Cache\Cache_Data\data_1
        • Size 264KB
        • SHA256 401437fc149af509b1dfd2a2b64a02b5dfc63c6b427d8403803275804c130f5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data_2
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Cache\Cache_Data\data_2
        • Size 1.0MB
        • SHA256 2caf3606ae964eabcf37cbe35c26b50f29dc81b0109c3ed594138823600a8a41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data_3
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Cache\Cache_Data\data_3
        • Size 4.0MB
        • SHA256 03e4626343a6d1f45c7619a3f8cc5240ea4de24d87fc7775938882f66c567f96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f_000001
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Cache\Cache_Data\f_000001
        • Size 27KB
        • SHA256 2add7d60b1cd2ab84c9967e23d5ec08eb3fc9635c46855b17d59404dec6b410e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f_000002
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Cache\Cache_Data\f_000002
        • Size 21KB
        • SHA256 8b774aaa5137a38ef40f4ac9d36db9a5eee152b2f66589dfdc82ff007fc87135
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Cache\Cache_Data\index
        • Size 256KB
        • SHA256 c56419b0f62d1ae8c21f93f08be3d7e89e9d303c5113a87fe2a56f8f5a9fbe99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data_0
        • Path C:\Users\Admin\AppData\Roaming\SKGames\DawnCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_1
        • Path C:\Users\Admin\AppData\Roaming\SKGames\DawnCache\data_1
        • Size 264KB
        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_2
        • Path C:\Users\Admin\AppData\Roaming\SKGames\DawnCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_3
        • Path C:\Users\Admin\AppData\Roaming\SKGames\DawnCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Local State
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Local State
        • Size 389B
        • SHA256 78c644cf85de95aa5b43cd3d764094acc691350d0b89210595d61367b8e763a2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Cookies
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Network\Cookies
        • Size 20KB
        • SHA256 4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Network Persistent State
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Network\Network Persistent State
        • Size 697B
        • SHA256 2fec1e5833501df8f3c47828739cfcaa7a9ae8765c7d16950da01b27f7caac20
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Network\Network Persistent State
        • Size 848B
        • SHA256 ba1fa5588fd8395d1369823f07a8421a399df3d971b5f820a9b21edf56786f35
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State~RFe5a6dfd.TMP
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Network\Network Persistent State~RFe5a6dfd.TMP
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        TransportSecurity
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Network\TransportSecurity
        • Size 371B
        • SHA256 8ce198b688cdc0271a5882130cbe07fa3277ca0835344d57c327e69b0ca981f7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Preferences
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Preferences
        • Size 57B
        • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Preferences~RFe5a6543.TMP
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Preferences~RFe5a6543.TMP
        • Size 86B
        • SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CURRENT
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        MANIFEST-000001
        • Path C:\Users\Admin\AppData\Roaming\SKGames\Session Storage\MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512
        Submit Download

        memory/1340-68-0x0000000005DE0000-0x000000000613B000-memory.dmp
        Download

        memory/1340-73-0x000000006FB50000-0x000000006FEAB000-memory.dmp
        Download

        memory/1340-70-0x000000006F9F0000-0x000000006FA3C000-memory.dmp
        Download

        memory/2184-739-0x0000000073330000-0x000000007337C000-memory.dmp
        Download

        memory/2184-742-0x0000000072F30000-0x000000007328B000-memory.dmp
        Download

        memory/2200-756-0x0000000005960000-0x0000000005CBB000-memory.dmp
        Download

        memory/2200-762-0x00000000733D0000-0x000000007372B000-memory.dmp
        Download

        memory/2200-761-0x0000000007110000-0x00000000071B3000-memory.dmp
        Download

        memory/2200-758-0x0000000073330000-0x000000007337C000-memory.dmp
        Download

        memory/2264-774-0x0000000007670000-0x0000000007681000-memory.dmp
        Download

        memory/2264-771-0x0000000073330000-0x000000007337C000-memory.dmp
        Download

        memory/2264-767-0x0000000005BA0000-0x0000000005EFB000-memory.dmp
        Download

        memory/2320-792-0x00000000733B0000-0x000000007370B000-memory.dmp
        Download

        memory/2320-786-0x0000000006340000-0x000000000669B000-memory.dmp
        Download

        memory/2320-788-0x0000000006BC0000-0x0000000006C0C000-memory.dmp
        Download

        memory/2320-789-0x0000000073310000-0x000000007335C000-memory.dmp
        Download

        memory/2388-56-0x000000006F9F0000-0x000000006FA3C000-memory.dmp
        Download

        memory/2388-59-0x00000000072D0000-0x0000000007366000-memory.dmp
        Download

        memory/2388-60-0x0000000007250000-0x0000000007261000-memory.dmp
        Download

        memory/2388-62-0x0000000073030000-0x00000000737EC000-memory.dmp
        Download

        memory/2388-51-0x0000000005760000-0x0000000005ABB000-memory.dmp
        Download

        memory/2388-52-0x0000000073030000-0x00000000737EC000-memory.dmp
        Download

        memory/2388-50-0x0000000073030000-0x00000000737EC000-memory.dmp
        Download

        memory/2388-49-0x0000000073030000-0x00000000737EC000-memory.dmp
        Download

        memory/2632-715-0x00000000069A0000-0x00000000069EC000-memory.dmp
        Download

        memory/2632-720-0x0000000072F30000-0x000000007328B000-memory.dmp
        Download

        memory/2632-713-0x0000000006050000-0x00000000063AB000-memory.dmp
        Download

        memory/2632-716-0x0000000073330000-0x000000007337C000-memory.dmp
        Download

        memory/2632-719-0x00000000076B0000-0x0000000007753000-memory.dmp
        Download

        memory/2672-29-0x0000000006960000-0x00000000069AC000-memory.dmp
        Download

        memory/2672-17-0x0000000073042000-0x0000000073043000-memory.dmp
        Download

        memory/2672-45-0x0000000073030000-0x00000000737EC000-memory.dmp
        Download

        memory/2672-20-0x0000000005AF0000-0x000000000613A000-memory.dmp
        Download

        memory/2672-21-0x0000000073030000-0x00000000737EC000-memory.dmp
        Download

        memory/2672-43-0x000000006FA40000-0x000000006FD9B000-memory.dmp
        Download

        memory/2672-27-0x0000000006570000-0x00000000068CB000-memory.dmp
        Download

        memory/2672-22-0x0000000006240000-0x0000000006262000-memory.dmp
        Download

        memory/2672-19-0x0000000073030000-0x00000000737EC000-memory.dmp
        Download

        memory/2672-28-0x0000000006920000-0x000000000693E000-memory.dmp
        Download

        memory/2672-23-0x0000000006360000-0x00000000063C6000-memory.dmp
        Download

        memory/2672-31-0x000000006F9F0000-0x000000006FA3C000-memory.dmp
        Download

        memory/2672-18-0x0000000005460000-0x0000000005496000-memory.dmp
        Download

        memory/2672-24-0x0000000006440000-0x00000000064A6000-memory.dmp
        Download

        memory/2672-32-0x0000000073030000-0x00000000737EC000-memory.dmp
        Download

        memory/2672-35-0x0000000006F00000-0x0000000006F20000-memory.dmp
        Download

        memory/2672-30-0x00000000078F0000-0x0000000007926000-memory.dmp
        Download

        memory/2672-36-0x0000000007BF0000-0x0000000007C93000-memory.dmp
        Download

        memory/2672-37-0x0000000073030000-0x00000000737EC000-memory.dmp
        Download

        memory/2672-39-0x0000000007CA0000-0x0000000007CBA000-memory.dmp
        Download

        memory/2672-38-0x0000000008320000-0x000000000899C000-memory.dmp
        Download

        memory/2672-40-0x0000000007D10000-0x0000000007D1A000-memory.dmp
        Download

        memory/2672-41-0x0000000007EB0000-0x0000000007EDA000-memory.dmp
        Download

        memory/2672-42-0x0000000007EE0000-0x0000000007F04000-memory.dmp
        Download

        memory/6100-731-0x0000000007A00000-0x0000000007A11000-memory.dmp
        Download

        memory/6100-728-0x0000000073330000-0x000000007337C000-memory.dmp
        Download