c64fb39ed754cef548cd3167098772eedfc4bfb34cb38d4e6b86fc9dbc56fd5b

Analysis

max time kernel
153s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ascension-setup-1.0.102.exe
Size 151.4MB
Sample260827-mrj72asscx
SHA256 c64fb39ed754cef548cd3167098772eedfc4bfb34cb38d4e6b86fc9dbc56fd5b
MD5 1a2d554d2c13fb6702b50f185384c8dd
SHA1 22202dd78b071245c5128fb924dbb144fb25770a
SHA512 844e8e03423d171b02c49a98811049d096393165c92ea9935bb4d72969509d84b0d5fb42d7abd7160507134c7eecd76da84fafd0d0dd8394f57d0baac098683c
SSDEEP 3145728:41M9NNNv9UrNqd+Xjq29FcmCXjeUO18VseaTRLUQ:19Nbv9INqlScmsyeapv
TLSH
T1B97833B0C9FEEFA9ED61E4BA11808C5288F9BF5F187C904358D675B258341FF44E498A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 20 IoCs

pid	Process
856	DirectX_9_SDK_Install.exe
5832	DXSETUP.exe
944	DirectX_20190310.exe
2196	DXSETUP.exe
2384	infinst.exe
4292	infinst.exe
1748	infinst.exe
1896	infinst.exe
2296	infinst.exe
5212	infinst.exe
3416	infinst.exe
5832	infinst.exe
1808	Ascension Launcher.exe
5412	Ascension Launcher.exe
6000	Ascension Launcher.exe
5944	Ascension Launcher.exe
3008	Ascension Launcher.exe
2732	Ascension Launcher.exe
4972	Ascension Launcher.exe
1112	AscensionClientServices.exe

Loads dropped DLL 35 IoCs

pid	Process
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
5832	DXSETUP.exe
5832	DXSETUP.exe
5832	DXSETUP.exe
5832	DXSETUP.exe
5832	DXSETUP.exe
2196	DXSETUP.exe
2196	DXSETUP.exe
2196	DXSETUP.exe
2196	DXSETUP.exe
2196	DXSETUP.exe
2596	regsvr32.exe
1808	Ascension Launcher.exe
6000	Ascension Launcher.exe
6000	Ascension Launcher.exe
6000	Ascension Launcher.exe
6000	Ascension Launcher.exe
3008	Ascension Launcher.exe
2732	Ascension Launcher.exe
6000	Ascension Launcher.exe
4972	Ascension Launcher.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1972	tasklist.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\SETC1DA.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETACAC.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETADD9.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETBDC5.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\d3dx10_43.dll	infinst.exe
File created	C:\Windows\system32\SETBEFC.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx11_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\d3dx11_43.dll	infinst.exe
File opened for modification	C:\Windows\system32\SETBF69.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETAD4A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_39.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETADD8.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSETUP.exe
File created	C:\Windows\system32\SETBCAA.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETBE60.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETC126.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETADD8.tmp	DXSETUP.exe
File created	C:\Windows\system32\SETBD75.tmp	infinst.exe
File opened for modification	C:\Windows\system32\D3DX9_43.dll	infinst.exe
File opened for modification	C:\Windows\system32\SETC005.tmp	infinst.exe
File created	C:\Windows\system32\SETC005.tmp	infinst.exe
File opened for modification	C:\Windows\system32\D3DCompiler_43.dll	infinst.exe
File opened for modification	C:\Windows\system32\SETC1EB.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_39.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETBCAA.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETC1DA.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETAD4A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_2.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETBD28.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETBD28.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETBF1F.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETC0B1.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETACAC.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETC05A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\XAudio2_7.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETAD5A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETBF9D.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_1.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\xinput1_3.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETBEB1.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETC05A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\XAPOFX1_5.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dcsx_43.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETC126.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETAD5A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETBEFC.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_39.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\X3DAudio1_7.dll	infinst.exe
File created	C:\Windows\SysWOW64\SETBDC5.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_7.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETBC0E.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETBC0E.tmp	DXSETUP.exe
File created	C:\Windows\system32\SETBE60.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_43.dll	DXSETUP.exe
File created	C:\Windows\system32\SETBF69.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETC136.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETADD9.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETBEB1.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETBF9D.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETC136.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_5.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\X3DAudio1_7.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_43.dll	DXSETUP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4592	powershell.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Ascension\Launcher\resources\AscensionClientServices.exe:Zone.Identifier	Ascension Launcher.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3016	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3356	cmd.exe
4464	cmd.exe
2864	cmd.exe
5472	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DirectX_20190310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DirectX_9_SDK_Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ascension-setup-1.0.102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Ascension Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Ascension Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Ascension Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Ascension Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Ascension Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Ascension Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Ascension Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Ascension Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ascension Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Ascension Launcher.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4200	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Ascension Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323013525999243"	Ascension Launcher.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\ = "XAudio2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\ = "AudioVolumeMeter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ascension-launcher\shell\open\command	Ascension Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ascension-launcher\shell\open	Ascension Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\ = "AudioVolumeMeter"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_2.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ascension-launcher\URL Protocol	Ascension Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_2.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_2.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ascension-launcher\shell	Ascension Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\ = "XAudio2"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\ = "XAudio2"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\ = "AudioVolumeMeter"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\ = "AudioReverb"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\ = "AudioReverb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\ = "AudioReverb"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ascension-launcher	Ascension Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ascension-launcher\shell\open\command\ = "\"C:\\Ascension\\Launcher\\Ascension Launcher.exe\" \"%1\""	Ascension Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ascension-launcher\ = "URL:ascension-launcher"	Ascension Launcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Ascension\Launcher\resources\AscensionClientServices.exe:Zone.Identifier	Ascension Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4592	powershell.exe
4592	powershell.exe
3016	powershell.exe
3016	powershell.exe
6056	ascension-setup-1.0.102.exe
6056	ascension-setup-1.0.102.exe
1972	tasklist.exe
1972	tasklist.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe
1112	AscensionClientServices.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	taskkill.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	1972	tasklist.exe
Token: SeSecurityPrivilege	6056	ascension-setup-1.0.102.exe
Token: SeBackupPrivilege	4488	vssvc.exe
Token: SeRestorePrivilege	4488	vssvc.exe
Token: SeAuditPrivilege	4488	vssvc.exe
Token: SeBackupPrivilege	2600	srtasks.exe
Token: SeRestorePrivilege	2600	srtasks.exe
Token: SeSecurityPrivilege	2600	srtasks.exe
Token: SeTakeOwnershipPrivilege	2600	srtasks.exe
Token: SeBackupPrivilege	2600	srtasks.exe
Token: SeRestorePrivilege	2600	srtasks.exe
Token: SeSecurityPrivilege	2600	srtasks.exe
Token: SeTakeOwnershipPrivilege	2600	srtasks.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe
Token: SeShutdownPrivilege	1808	Ascension Launcher.exe
Token: SeCreatePagefilePrivilege	1808	Ascension Launcher.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 6056 wrote to memory of 3356	6056	ascension-setup-1.0.102.exe	88
PID 3356 wrote to memory of 4200	3356	cmd.exe	90
PID 6056 wrote to memory of 4592	6056	ascension-setup-1.0.102.exe	92
PID 6056 wrote to memory of 3016	6056	ascension-setup-1.0.102.exe	94
PID 6056 wrote to memory of 4464	6056	ascension-setup-1.0.102.exe	96
PID 4464 wrote to memory of 1972	4464	cmd.exe	98
PID 4464 wrote to memory of 1504	4464	cmd.exe	99
PID 6056 wrote to memory of 856	6056	ascension-setup-1.0.102.exe	102
PID 856 wrote to memory of 5832	856	DirectX_9_SDK_Install.exe	103
PID 6056 wrote to memory of 944	6056	ascension-setup-1.0.102.exe	111
PID 944 wrote to memory of 2196	944	DirectX_20190310.exe	113
PID 2196 wrote to memory of 2384	2196	DXSETUP.exe	114
PID 2196 wrote to memory of 4292	2196	DXSETUP.exe	115
PID 2196 wrote to memory of 1748	2196	DXSETUP.exe	116
PID 2196 wrote to memory of 1896	2196	DXSETUP.exe	117
PID 2196 wrote to memory of 2296	2196	DXSETUP.exe	118
PID 2196 wrote to memory of 5212	2196	DXSETUP.exe	119
PID 2196 wrote to memory of 3416	2196	DXSETUP.exe	120
PID 2196 wrote to memory of 5832	2196	DXSETUP.exe	121
PID 2196 wrote to memory of 2596	2196	DXSETUP.exe	122
PID 1808 wrote to memory of 5412	1808	Ascension Launcher.exe	124
PID 1808 wrote to memory of 6000	1808	Ascension Launcher.exe	125
PID 1808 wrote to memory of 2864	1808	Ascension Launcher.exe	127
PID 1808 wrote to memory of 5944	1808	Ascension Launcher.exe	126
PID 2864 wrote to memory of 5216	2864	cmd.exe	129
PID 1808 wrote to memory of 5472	1808	Ascension Launcher.exe	130
PID 5472 wrote to memory of 4148	5472	cmd.exe	132
PID 1808 wrote to memory of 3008	1808	Ascension Launcher.exe	133
PID 1808 wrote to memory of 2732	1808	Ascension Launcher.exe	134
PID 1808 wrote to memory of 4972	1808	Ascension Launcher.exe	135
PID 1808 wrote to memory of 1112	1808	Ascension Launcher.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ascension-setup-1.0.102.exe
"C:\Users\Admin\AppData\Local\Temp\ascension-setup-1.0.102.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C taskkill /F /IM "AscensionClientServices.exe" /T
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "AscensionClientServices.exe" /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Ascension Launcher.exe" /FO CSV | "C:\Windows\system32\find.exe" "Ascension Launcher.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Ascension Launcher.exe" /FO CSV
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "Ascension Launcher.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1504
- C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\DirectX_9_SDK_Install.exe
  "C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\DirectX_9_SDK_Install.exe" /silent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe" /silent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5832
- C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\DirectX_20190310.exe
  "C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\DirectX_20190310.exe" /silent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe" /silent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe X3DAudio1_7_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe D3DX9_43_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe d3dx10_43_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe d3dx11_43_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe d3dcsx_43_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe D3DCompiler_43_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe XAudio2_7_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:5832
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Ascension\Launcher\Ascension Launcher.exe
"C:\Ascension\Launcher\Ascension Launcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Ascension\Launcher\Ascension Launcher.exe
  "C:\Ascension\Launcher\Ascension Launcher.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\projectascension /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\projectascension\Crashpad --url=https://f.a.k/e --annotation=_productName=projectascension --annotation=_version=1.0.102 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.1.0 --initial-client-data=0x4ec,0x4f0,0x4f4,0x4e8,0x4f8,0x7ff6e3df219c,0x7ff6e3df21a8,0x7ff6e3df21b8
  2⤵
  - Executes dropped EXE
  PID:5412
- C:\Ascension\Launcher\Ascension Launcher.exe
  "C:\Ascension\Launcher\Ascension Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\projectascension" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,9007432701873189072,3321810274546886063,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1876,i,15168612052775414848,3970665824101875197,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6000
- C:\Ascension\Launcher\Ascension Launcher.exe
  "C:\Ascension\Launcher\Ascension Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --user-data-dir="C:\Users\Admin\AppData\Roaming\projectascension" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --streaming-schemes=app --code-cache-schemes=app --field-trial-handle=1872,i,9007432701873189072,3321810274546886063,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1876,i,15168612052775414848,3970665824101875197,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\Software\5fc67e1d-39d0-5540-bea4-248f29612f93" /v "InstallLocation""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\5fc67e1d-39d0-5540-bea4-248f29612f93" /v "InstallLocation"
    3⤵
    PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\5fc67e1d-39d0-5540-bea4-248f29612f93" /v "InstallLocation""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\5fc67e1d-39d0-5540-bea4-248f29612f93" /v "InstallLocation"
    3⤵
    PID:4148
- C:\Ascension\Launcher\Ascension Launcher.exe
  "C:\Ascension\Launcher\Ascension Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\projectascension" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --streaming-schemes=app --code-cache-schemes=app --app-user-model-id=com.ascension.launcher --app-path="C:\Ascension\Launcher\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1872,i,9007432701873189072,3321810274546886063,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1876,i,15168612052775414848,3970665824101875197,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3008
- C:\Ascension\Launcher\Ascension Launcher.exe
  "C:\Ascension\Launcher\Ascension Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\projectascension" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --streaming-schemes=app --code-cache-schemes=app --app-user-model-id=com.ascension.launcher --app-path="C:\Ascension\Launcher\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1872,i,9007432701873189072,3321810274546886063,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1876,i,15168612052775414848,3970665824101875197,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2732
- C:\Ascension\Launcher\Ascension Launcher.exe
  "C:\Ascension\Launcher\Ascension Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\projectascension" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --streaming-schemes=app --code-cache-schemes=app --app-user-model-id=com.ascension.launcher --app-path="C:\Ascension\Launcher\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1872,i,9007432701873189072,3321810274546886063,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1876,i,15168612052775414848,3970665824101875197,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4972
- C:\Ascension\Launcher\resources\AscensionClientServices.exe
  "C:\Ascension\Launcher\resources\AscensionClientServices.exe" --launcher-pid 1808 --token dc79e5fc-af0c-46da-b7a1-d1b112ee0667 --url-file "C:\Users\Admin\AppData\Local\Temp\ascension-services-dc79e5fc-af0c-46da-b7a1-d1b112ee0667.json"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 e8e16eb3556a091c70f9db49be62a016545deb98769cbb3ffdf8fc86c6087662
MD5 cdf87f01cd7bbb0328ab0c079165c4d2
SHA1 eb83f0c97c1bea9441ea9bc3bc57a796a829a999
SHA512 6075502f01fd8e0ccf67bbb721a8a657f89f6874290d09587cc7515007230b90ef10795d6545d1865844ddaea15ea9fe2b86f4a0d54c2e75965c7d3d0463b0aa
SSDEEP 384:m1eBIIH1in2GW14bLfoqxM3Q+gePor2PnlIAsF41948WI+FX7uErbfkwN8Xgf9:meLV8VWioEMg+i6dIAcC94IMKIbf1NH9
TLSH
T1BE72B7A8616FADC7DC9122B010D601E7FBA4E08CDF755198FE27C92B5C91FB79BA0520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AscensionLauncherSettings.json

Path C:\Users\Admin\AppData\Local\ProjectAscension\Config\AscensionLauncherSettings.json
Size 318B
SHA256 bad03fe501a79ad258a1795503c0879704f450da423dcb9d7bb1b5d8ad876075
MD5 5b9689077f5c2849778d2ebc87d9eda3
SHA1 1a75426a0e7c7b1f5f7d54a80660ad3652d934d3
SHA512 a396ab2197c3260fba3730aeb88fad5170f79950c056aa5d290496da29d65e9e798d1e49d15e2ec5ca9e949aa331b2dd16c8a07bb3a8cfed9002ff84189832c7
TLSH
T135E07D60EC1048B641F442DF44BC82D31E20CC270228343C69879E08030D7273BFAAD7
MD5 SHA1 SHA512 TLSH

Submit Download

Apr2007_xinput_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Apr2007_xinput_x64.cab
Size 94KB
SHA256 e7a09f8235cc587cc63f583e39fbc75008d9677c8bb4dcc11cb8d0178a5153ac
MD5 743b333c2db3d4cf190fb39c29f3c346
SHA1 26b3616d7321978bd45656391a75ee231196a4a2
SHA512 77fbdb86c79d7228bca2982a3285a417a365af980488a5ac2d470b532fa59fcc15e0e8dbee6eb1a3a5256fc29e0e3391529cd2ac13e0f72987ee0da136000957
SSDEEP 1536:CEDWhtT9OVcSEbv2sSXSf2rGrqZj64W/msrR2rKg+Yy9bMP+rGb2HtDZzmwG9rHR:It5OSvuXSf2rbZu4Kmsr4eLRwPC5B9G3
TLSH
T1449302D96E7BDA03EF0B5EFDA7D6A4087824DF6684E1701627EEA29C0C143C46532F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apr2007_xinput_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Apr2007_xinput_x86.cab
Size 52KB
SHA256 2acea6c8b9f6f7f89ec51365a1e49fbd0d8c42c53418bd0783dbf3f74a744e6d
MD5 c234df417c9b12e2d31c7fd1e17e4786
SHA1 92f32e74944e5166db72d3bfe8e6401d9f7521dd
SHA512 6cbae19794533ad9401f92b10bd9549638ba20ce38375de4f9d0e20af20d78819e46856151cc6818325af9ac774b8128e18fbebd2da5da4efbd417fc2af51dab
SSDEEP 1536:9cnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZT9rHUh:0wb+2eZonQwN9oh
TLSH
T17633F1D5880EE99EAED51EB0397DFA519C39D3C385B7211B412BE496088A3E0A304F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aug2008_XAudio_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Aug2008_XAudio_x86.cab
Size 267KB
SHA256 8f49b5d324b8677f21e1726c7b989b87f4f53f186d5f166a0135cc3a8ebe5a8d
MD5 23f6dbd04f7f8d6f5ec63342e9a5e3bd
SHA1 99b8327f6c82496293c2a4dcec676517257456a2
SHA512 1d976974a98901baca4bfad5ddb354eebdd61df6df38ca898b2acf7d75c7e004d13880447e8062fa860523914b0ccd2edd72e1685dbbedaf0eae54b04a59e812
SSDEEP 6144:dpX0oOVpRM/Ck9e9rTZF8en9IXBV/ZxlN2T20Sd8s8KgYe:dhfeCqPTLN9i3ZxlQ7sPgYe
TLSH
T122442384D82E2487DE9668B260F4E9C77C78E3D379BD0E1501DACC4014BF2FEAA4199D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aug2008_d3dx10_39_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Aug2008_d3dx10_39_x86.cab
Size 833KB
SHA256 95b15e93b6580c1a70cba1d8be95c19ef837a4d018e1217a3907ba1ee3a5ac0d
MD5 29a3e36d8b57cfc2476196c73ec5edb9
SHA1 bca2af7590a045a9ec3577798751306b54d90533
SHA512 255fd5723f16600bf981d22f92d8e2b5c1e687a01e2e5389a871bef19ecf49dad8cb1d5dfd289db5bfc050a4f1ba5680096d86dabcc8248e3790e22613805de6
SSDEEP 24576:x6Ih4DqlkwAjhr1mB+uYgrCvCZNmJ9ndKo4XYaHy:x664DQkwAj/oNCvCZIdN4IaS
TLSH
T1E20523B8927E5E506C0BCC4C10FDFAA2BC92D9DB0B7E757532188D698D13485BBE212D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aug2008_d3dx9_39_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Aug2008_d3dx9_39_x86.cab
Size 1.4MB
SHA256 490636eb27e929efd712f3c5028b2c1b2adbd1deb24f9cd6407b7add6559bb91
MD5 71669084c0c20df2ec0c193a170d85a2
SHA1 64e92a35fcdf8a0c00504730fc1d847213270a40
SHA512 9e69957f7a0a806c0044d1ab01efbe27c57bda6b2dbc584eae7a52b3b0c58f0182d182eefdc95a36adc5d802b42defb3b462983d860bc1ddb1579722b821b84a
SSDEEP 24576:KtDuVYfr3zZ3dHi+rHI8lVs1WutNXBoY4RbifcKly/kNwSh1mMbS8X/9Wv8TP:IDnr3zZ31lVsgENSsfcKaZAFF88r
TLSH
T1996533E6519ECD6159C61FB01A6EA207FCF83BC90983F36AE4136F50405E749CB2EB48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSETUP.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DSETUP.dll
Size 95KB
SHA256 5b4c9977c41f7c53c2574385e41c4c70bc407e48a9c9ac79c3a0964debb10f04
MD5 3a221f6a9e1a57dbb4724da320381d00
SHA1 86b9efe9e8c366512dfb787d254433fd62ea1671
SHA512 17ae3d57b9ac98d803d7a5534c4f62962c7f1969aa1cfa501bb6763fa94a2e1b212e139a368569d4141a7e2693e007407ab955e0765c58eaaa20cfa4a1aac678
SSDEEP 1536:SLtBqvGTWmOeR3+MPb3hzgS/1nJvMgqAlTJQs0MajclgUukW+j2c5o5INSkVg7XL:UtAvGymOA39b3h7/1CfWYcZ5x5o58Skg
TLSH
T172937D15BE50C072DCD120B916CCE7B1A6BEE1B00B2999C7B35447DAD9613C6AA3934F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSETUP32.DLL

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DSETUP32.DLL
Size 1.5MB
SHA256 fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8
MD5 d8fa7bb4fe10251a239ed75055dd6f73
SHA1 76c4bd2d8f359f7689415efc15e3743d35673ae8
SHA512 73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4
SSDEEP 24576:CIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXi+:CIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXf
TLSH
T166759D31B1D40332EA7103B177128AB7F63EEB9DE119DA257DAE82552182B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSETUP.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe
Size 516KB
SHA256 d6bcd10c6f9d9137189de9a9b9f76f033b8e5022129b710a9a3091116cd45ec5
MD5 2cfd505070ee1ae30c70f1cc8b4a3b23
SHA1 4762ff4ef24eba02c751c4a9d2027e0a754d9661
SHA512 6a3c119805d580e3d729f789b5cdce1febe061d0f437426b1189b0f4ba5aa5eacaffb3d1d114ec9275c9b6afd1903bf2b91afec6e03ba9f49a1dbf5fd24823f4
SSDEEP 3072:3i6LKeIXbJ8nUc2nDzw0FWtj/WM0PSQ5lbSN2LhaM96rKmMH2/5Mjt4zT1mFDYkV:xZ2nDzw0FWdwewUM1Ws4VfgJ
TLSH
T1DAB41C1067F99225F4F36B386A7913964E3ABE91DD38C55E6314319E4A31E80DE70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSETUP.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe
Size 505KB
SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
MD5 bf3f290275c21bdd3951955c9c3cf32c
SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
TLSH
T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Feb2010_X3DAudio_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Feb2010_X3DAudio_x64.cab
Size 53KB
SHA256 832b6d48e169b4725ae482ea4d1c3360a09631a89b2fac3aba81a50805a50adc
MD5 db47136a200e326174ce790359596eb6
SHA1 fabca8c0aa28164ef4fdb7ee4ae8942a275b1713
SHA512 f3b04168ca14ad4586493ea985417cce43ee11f37aa1856e714f44e132a31dbb84934943b947cf0b2aa39344e183cba8b6f49431b4471bd0e623926def94cb8f
SSDEEP 1536:Tiqitrhuwa0YCXOt4IBAIZt7bwf/S7LkDVJoTYA95QT:TipluZ01Om+vwfZy95QT
TLSH
T1EC33F297AE89A80BFA3E9D30230CCFE36D30D683991AD515793FBD40128A7F089D555A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Feb2010_X3DAudio_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Feb2010_X3DAudio_x86.cab
Size 20KB
SHA256 acba5c4d4ac90e1df1c8404be5ff780e24238153cb410af909cd4364d213f2a9
MD5 88dfbb4c1876e80a1864265c61c7a7fd
SHA1 c6ee8cff225019a93308c896146d94b00fd5417e
SHA512 35e564aeeb6e462221a36cfa680e7e932333b0b92b0115ce5306ff59784abb13b8f7527fdd686737170425f2719f2d3a6901dc9822af4d537d9b5377b6bf89e4
SSDEEP 384:BbCiWM4cwP+niRGYZ2TrvF+q7yAfLORxNy+E1jYvzLXci2jXHUl:QE/wPRY62fFr2ADSxA+OsPMi2jXHUl
TLSH
T1C192CFD1AE3DD00EEDAE6CD592B8DC6B3E7D93C60936441F11DFE2C804A23C58B56465
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_D3DCompiler_43_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_D3DCompiler_43_x64.cab
Size 922KB
SHA256 213ad66ab9e469db1e6a49a646d082bfc3700db94172984e7e36801612af50c6
MD5 0109c2931c4442c8192539f1991b6985
SHA1 1b3f6cf35dc745ea8748dae910f704b124e69f73
SHA512 c60bf98a0fffbcf3966d7d8abbd12f2a7e6e85b1624d67e9c5d5bb686d41b8ad12761e6cd13439d90248d194888897d055d2d5f3fa4fa2ddd7d21f5e7070b147
SSDEEP 24576:Sww34eXR087AW7psiEut/r/eY5u6FZqLB5:24eCW7pvEut/r/eY5nFZqLj
TLSH
T1901533AE8F5A1752D01049D5E342F48226BF06D2032C48DF89F7DEA33509B9E499BDBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_D3DCompiler_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_D3DCompiler_43_x86.cab
Size 909KB
SHA256 417eebd5b19f45c67c94c2d2ba8b774c0fc6d958b896d7b1ac12cf5a0ea06e0e
MD5 f7f554aa613eccf065575b8c69717ef7
SHA1 8417886d47c19cf6892f4080ddd5aaa1a49db3e9
SHA512 618f6dbb5bd9d44a8f10d119f5ef644f168fe3d8db986994e8cce31d1f11ff9ac872b389d1f218a82ff8b397bface587f97ca21e8f77433dbadb2ac475e9e6c1
SSDEEP 24576:dOWjUzqd7URYQio4yGDUATxoWDYicd3qRbmXHphTheUB:dtx6RYQiL1DUA7EicSbUJhI0
TLSH
T1B41533B48FE9413741A6F8481B96BBC0C11DC9E574F22DD5367FF2860846B94E32E99C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_XAudio_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_XAudio_x64.cab
Size 270KB
SHA256 51500283f69e97f5beddb073ba2a9017de3d30379c0dcc4d11dd2236ce07b317
MD5 edeb828a8e54a9f3851007d80bc8dd6e
SHA1 358e429ac3b125cc7fe4f9ea46cdca4583cbb1a9
SHA512 8cf68e1a09c257f7fc29991331a128c159634ea86e36b6be8c2a0caf5ef1fda8e1c79639f099ba32650a9fcb26478f113227ee7ead84bfbd728665eb1a522537
SSDEEP 6144:dWPBT7hxRbpqP16WJL+HqvCsHjmNXgekqA8+6NIUyqI5Bv0:dstxRbpQ16WJSHaOwePFtKv0
TLSH
T128441245843B4480AF5379154301EF0D6CFD5BCAD8B8C693A0A7BB5F86D2B7D66E202B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_XAudio_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_XAudio_x86.cab
Size 271KB
SHA256 7b4332207563beba1103744b6db5399ad150e9e6838f9d5a71497e7eb3645ebf
MD5 9d2da3b1055120af7c2995896f5d51ed
SHA1 2df40d48c69d7cfb4e0c19f07a019f5f123303fa
SHA512 deb76247b3003fc59c0a95cc2a47d6dd56e2d75aec81c3ab6ca6c0c513fb054e8025c871e97b7d7f2c823df54a2fe8202f4c0caf677251070b8bce40d2db70f5
SSDEEP 6144:3UOaoaU0vu3c22wOuy54uw1VwjMbGATPt7vQQqy/a6m:34oZAwTw01VKMzWzyzm
TLSH
T1A74423A3C484CA07FBAD3DD51370ED5150316F8A58AE626D235CE9323D89BCE5B35839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dcsx_43_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_d3dcsx_43_x64.cab
Size 735KB
SHA256 cdbec7e3a5a0fef016eb294b036f93c75e45c6ead8d99397f859a32d23fe20cc
MD5 850aafddfefea671a2e1bbf1b65f2a8e
SHA1 9679e7f294ca9de945b6f4f3d775d739dc2f8cd1
SHA512 d87d8d123700e02caa6562c9f22a90e86b2d8277b20089ab9d77a885094aef22bb69d60405b366ebf8cbf74f4b53a17095c3cc93b8bd3766cef7eb02bc47397b
SSDEEP 12288:nDH/lxG7YZg1tkPRZ8m4a8PAWDJRZBIS8vKU+C4+MyPBtStjea7+BjD/Ve4tEua:7RRRKy8LJRZmjysBE8aaBjDFtEua
TLSH
T19CF423F2122E331D0BD219E0223FE2D0BC7664A2D857785FDA696C7B265336E31CD919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dcsx_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_d3dcsx_43_x86.cab
Size 744KB
SHA256 e2c5a2cbba7f211b6ca72ff8e5f69cba1f83be06357311b19e64f582fd3d14e4
MD5 44dba9557f956787b66f285776c3dccb
SHA1 4560c64f8b6bbdeedd85398f2e18404c389e4d8b
SHA512 25fbc95346bac890fee8d2a0805015af1eda5e0bb17b12d4eef52ca446775d08898fe5c13239e983a0f8c8dd13f8f2a5247a70e8e785e2bae42ff5ab1cca4156
SSDEEP 12288:u8Dx0/99rEneJVyrxcsaWmeUEEBTJNCK/FcZZXlewc3/2tqCyrIUl3z82ItDwh2a:jDO19AVrRfEHNZWZrs3+ICyco3MDISTI
TLSH
T107F4236B0267C746FD9A2C07932450D718BF32D32FB8795E529537FF0202F8A5A8619B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx10_43_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_d3dx10_43_x64.cab
Size 230KB
SHA256 efce48d425c07f1faad4a55d7061a01ed6245aac17f43163cf2a23cbc9a3054b
MD5 2d9586b276a561924ff2335fccaee914
SHA1 3b8114a8820a8df9df2321d6c4da8ea155ce736f
SHA512 d78ad87685eb71d2eb8c68e1e2c7fd5a90250f04059dd0016e4c8ca01bf53c02dea01998fe6de9ae3a3f76b2964d14a61e694546a2e6844bb304c315ae5b80e2
SSDEEP 6144:YpUgZAjzb+OfxD+CEQrzgL9j9E+qG6nbNxcR3bN8J9E3PWoJq:afZyfxZa9EjXbwR8J2fWoJq
TLSH
T1F33423C69C69D5646C5C7D59E0AA4C830D3C578C0C6B2279112FA5EC7F243EFABB2782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx10_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_d3dx10_43_x86.cab
Size 192KB
SHA256 a8cf71ffb80b683616d0621be96d3795b0ffda3877ed2d80cd958bfa393ddcfc
MD5 a89b98ab89e0d4ff9dae412d49e27c51
SHA1 18803d4bcc83ad39f25ff9f899baf136c89c10f1
SHA512 0b96a04663d2fbfb21901af832a5362785fb0270d1be0ef136549f07e2625653f8facd129889a5f3489fc8a1270abe474e4f1626ea630a3185a36812545b4dfd
SSDEEP 3072:ID2Fju8h1xkWCD/5e8U2LK1aQAMxVz2aoOxoY4+ApyP0EwMGvFas+8QJgdBvC09D:IwbCleyYagxVCaoV+ApcnG9aKQJadD
TLSH
T1181412DFCE488919FACEEDCE634ED8809CB816C30573D4458566F95039B13C85BE6E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx11_43_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_d3dx11_43_x64.cab
Size 134KB
SHA256 c1d0d56b83bfb09a5e1a89e1898bb74446a847b30a968f3664ec2d87368eb63e
MD5 96e7847a914afcb489194940b06a5c23
SHA1 9439907a1000b9dcb8989ffbd828e6294c277fba
SHA512 638485084884fab9d8952af17b24c4aef16dd026c75256026859bfe4f24d7f11fd2240cde8c5de0dab8968885a6d344da7335be257570e947bf5da8ac06f61ad
SSDEEP 3072:1luKA472L962XjyJ1b4mBfqMlafaDxbUmDSRP7qlt+95tP:1le4A9Vjs1bVSiaylomDSRTqlo3P
TLSH
T1BDD312D6AEFAC60AFE435C5206ADD8620DBAB7C677E5980B5137F2D50943780604BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx11_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_d3dx11_43_x86.cab
Size 106KB
SHA256 a58cefe822e371d078eaf89319f832693352ba7d62079320074397f0f3425961
MD5 758c5a459978cb2c68a300a60da153be
SHA1 66d12509137f2b5e1a668df39e6ccce6402822c3
SHA512 f33d6fd3354310e6cc4b483eae955a9652e7f71ceef7c444bdef84251ffa6ec0b89886a2344d18e0a1ad5285123ad808904372289e1e1c8d14242483f0426588
SSDEEP 3072:hXMVzDTlrM28bEHSqgik2ono4DQQ/7cuBFbb9aDz9on:hXMxNjG4gikye5FBtB42
TLSH
T17DB302D6A260F94F8D676CC79246E79359FDCDCA4A24944B386EE1843C033A25B0BD4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx9_43_x64.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_d3dx9_43_x64.cab
Size 915KB
SHA256 9b98a1269af7f3a0007bfdc73206a47a6ee158d34ba8a87009396c18186bb06a
MD5 063fa6f7061324eac1c4de0350c20e80
SHA1 daccf01b4b7493b88f04f9e50fe37c03846335ad
SHA512 3ad31100cbca4da52e46518e577dca94b595f9d47a3e9552cd764905ffc2876f9127b69a97bac44dbd754021e14ddec65480b7628a3768f03e53de8fbb08c547
SSDEEP 24576:mneqhPULh1ksCctVV+WOwy/vW09rabgcZhBeYCrrPe:1hOJY3+Lwy/vjkgcZaXO
TLSH
T1C21533859AADF8D55ABF0B0510912763267F33EB62F4F08BD5E126C05C30795438E7AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx9_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jun2010_d3dx9_43_x86.cab
Size 750KB
SHA256 fcc6cf0966b4853d6fa3d32ab299cde5a9824feaecb0d4f34ea452fb9fd1c867
MD5 7749862c307e527366b6868326db8198
SHA1 bce9f21cdb1e101c7223c9e62eca61ec22d6bb81
SHA512 b65a84535b749ade0f8ea1a8ab6239df8e82ad59cbdb07487fdbfcfcf57a565f493f56378e216859a081d23ddf7c671636f53ef821289d66452f09218080f02b
SSDEEP 12288:w0b5pTUIVIRxV+yb+HJFnXQRGr85UpzQ3VztxmHN8DMFy0BJ1lSIug3SqHAlzJYu:Z51NVO+XVLs3VztQHmYjBJb931I1NYIZ
TLSH
T10AF423432AA5348E8C523043E3669A2724B83557CEBDE77562A44B2D0CFD76F113ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dsetup.dll
Size 93KB
SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
MD5 eb701def7d0809e8da765a752ab42be5
SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
TLSH
T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup32.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dsetup32.dll
Size 1.6MB
SHA256 9db4910b99cfed2a5944303ac6ff0f609c335131c4ee3e75a1b4c61d3c1a6ce3
MD5 1d6b292da474d3f0f780664d6883257c
SHA1 5d85598505ab32331d2c880b03bf66af50f1eece
SHA512 b6d772e4606f9fd313134bd0d4120cb17f2c0ab27e36c255e9b5889b21faca987b9f255ba12d8f1eb7112b55aa2dafbceff19d4e12d45b5e03185f831b6f8fb7
SSDEEP 49152:9jxO/ZOOOOOOOOOOOOOOOOMiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXT:TCO
TLSH
T1A175AE35B1D40331E6B203B167128AB7F73EDBDDE21AD521B9AE82552186B8CC33E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdllreg_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dxdllreg_x86.cab
Size 46KB
SHA256 2beb76744844fa9acb67f1e497826fc87fbb5388f7ac4f450d38371aee6c6b4d
MD5 5c942dd9dc4e8b52cd490b5251ee6fe2
SHA1 a914773ec491ea40b477c90269d81e43fb749875
SHA512 15ecdf5d03e66e2fb307baa567ef0ce0b3f2e3805ca043aa789823742e436212be92c4d1afab50c03489d551e5351828c68108204afccf39df64c41b2ff68418
SSDEEP 768:vou07ZPtJIeYoE9nB6pG4Y/XkWPuYHEV12bpag93x/lTIDNoLNWNrU8Cy/jy:vUVPtJXEQG4Y/XkWPuYzR3jCaWNY8Cyu
TLSH
T10923E0C3EB2CD149DB172D6153ACCEC53C7CDBC289688A1A50ABF68E08667FCD65501D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdllreg_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dxdllreg_x86.cab
Size 43KB
SHA256 4afe0249a13868b7c4a92b4d53c998adf6053eb5e2c47fd81020fd8d4bb11150
MD5 4b4f83d1dd86314b65760f44f9c7a9b1
SHA1 d8d857ebbe2c0dd5b63e564bf8428c55ece55778
SHA512 91a556dee865f9a625a148556c289b287187d4a7c2814658d8b59a99afbf226dcf557094f43349ebfbd2fabc5628940cce942a22c29f5dbca086a3ddeef8e9c6
SSDEEP 768:47CbQVl8ORHNCNzUSWyEHNaNo6lc22V6yey6qoomHhPokDLmaV3QN7b6Fjpvh:47Cm1HwzUSWFU72UTHhPoknhk6F5h
TLSH
T16E13E1B4CD08ED409DBA2E992368FF363E78D99318703C5B46CAD78605883E58F6587D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dxupdate.cab
Size 95KB
SHA256 8158187acfea6e6d5f349568a3e1efab69bb425adcc1a025a638e2c32470c4a0
MD5 98af4ff243ea19b27ca43cc7a5414dbe
SHA1 6b8ab44085c9f36470a8255e483670e44792f90f
SHA512 bfa80fd7d1a0902f3d88675ff397015148bbe82344139f8f346da754cf32bc38d87f78083c94a33313d3ec25b5eb9d345bcbd0cfd348675e27d9c464dbeb6fa4
SSDEEP 1536:XeTfeJ544p/8+UG6I60hJijpy/Ykm3BSLcK/grku54tVEq8Cy/N:XefeIQhSynHL9uyz8Cy/N
TLSH
T1ACA3F1C2CD28318BE9475D60A69CE9A3FD795BC366208F22954AF5C11373BD56E3183C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.cab

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dxupdate.cab
Size 94KB
SHA256 e18a5404b612e88fa8b403c9b33f064c0a89528db7ef9a79aa116908d0e6afed
MD5 d495680aba28caafc4c071a6d0fe55ac
SHA1 5885ece90970eb10b6b95d6c52d934674835929e
SHA512 a25c647678661473b99462d7433c1d05af54823d404476e35315c11c93b3f5ece92c912560af0d9efe8f07e36ae68594362d73abf5d5de409a3f0a146fe31a10
SSDEEP 1536:JvknxJRHNYzrAzRstaRGk0jzphvXdy57XwwnNb+vnaI1eYpIKxozNlmn6F5x:JvknxJpNYAzRstaRkz0BwwnNbSa+vp58
TLSH
T1BA9302EC875DCF93D5622DADA168EA0B7DBEF98E891CD42580B5F20418627DCB2F444C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aug2008_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXA579.tmp\Aug2008_XAudio_x86.inf
Size 1KB
SHA256 f211a7d99b3ffa0180bd91f68b2c285564227e075d499e950e76fde04e7707e3
MD5 e0947065f559b93eb93a7ceeaa8bfd44
SHA1 39bb647363b00924c7c0b3792f8017d7c7d9e3b4
SHA512 620810dcd56857b2d3d5f1271c5d4979cc90977acebfea81edb472d02da8e6104e89984816a91ab57a2469253a391bcc378093f1adaeea7c0d35f7f1b794969d
TLSH
T16E3159C98C02A27177C4B2B37F5F3A8F57670816ED65510873D64ED96BA3202216C1FD
MD5 SHA1 SHA512 TLSH

Submit Download

Aug2008_d3dx10_39_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXA579.tmp\Aug2008_d3dx10_39_x86.inf
Size 1KB
SHA256 e83f8d48323887af89648c5bd7af713b42d20ccb757be34675f1fa527e6cc33f
MD5 baa493c7a361f1ac0c5efc94f1568f97
SHA1 16dd101673b96b54bc5a38c20ec3ed785c6bf7bb
SHA512 2e8db3d1ce2830caa9a0f698bc31e2b907e39a233fb056fae44062b3ff732b3b62f12fcb2eb948c1728df9b64c4d8ee873c0f95e56c2ad1727140236ecc71095
TLSH
T1B63105D9C9129030B6C9B6B2BB8F3B8F5A370407F96221587AD90890EF73751128D1FD
MD5 SHA1 SHA512 TLSH

Submit Download

Aug2008_d3dx9_39_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXA579.tmp\Aug2008_d3dx9_39_x86.inf
Size 1KB
SHA256 8a23d386626328f9519076f33d5c3b71c639f2347741442c3374974e6f61bd53
MD5 b28ef6e3eebceb622d1431fedd9f545a
SHA1 c6ae73cbbdff4632911dc1759a9ccdd73056ac8b
SHA512 4f2bfced9eedabd6ca807a1b88cc063d15a31ab0bd8e2b60c65d6daddac9a111c434a0fa7d7641813d9880612464351ea30368bf6f0ed9ffc69bfb4d51882d12
TLSH
T1873146DD8802E4347A94B6B2BB9F379F1627450BFA61310973CA0990AFB3341115D2FC
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_39.dll

Path C:\Users\Admin\AppData\Local\Temp\DXA579.tmp\D3DCompiler_39.dll
Size 1.4MB
SHA256 b99b655abc4ec45851cc2acdb7a348e739687200a4fe3be9c35d6738dd61112f
MD5 c4f1972497fe2ceb7d900938c97fcf91
SHA1 27c1886e7823813ac61c35ea0cd5b72ea0ea7dbc
SHA512 8d35dd4000e1d632d0924b594d6ef13454159f8c3b85636f180486ff794b76f8a84d7977e340ef08217f0f68747b593eae0b44824a20c12494007f4a40cc3d00
SSDEEP 24576:SiSiwPsW/CcMsGI+1LUtpbvaxvDgrPWvBG5WNixPQ/:F4/CcMs+LUtpb+bSPQRNF
TLSH
T109657D21E64E8039C8C612B25F5EB7E5252CDF31032166C772947AD89E357E26F3A70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAPOFX1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\DXA579.tmp\XAPOFX1_1.dll
Size 67KB
SHA256 5ab63c0f040fdf65e681eba4daa55ed83e89ea10c426dc2fc763da0fc94f3ace
MD5 d95eaabf5d277ef91d9ca70151209e56
SHA1 3d47ebbd6236045309d2222a696b7141c0957379
SHA512 6d2e73468485fee2b4007f1fdf16381cdd6c77edbe5530f63cbf8696646b14d06100fdf54a48547f29ea5775f29226b16808a5a1bd4c0778413855f80e5b8259
SSDEEP 768:A67GrYuRIzYVLBBnRuURo0fXqawZhOHCcV5LwX0lH5QHmO7VEameJImpHwuaU8Cw:bGrYgLzXCaLCcoXuKImuuT8Cy/X
TLSH
T11E634A42A9E9C3B2F8A929F1887E75A3783CC7C45B1489C3234446D4DDA17D06FF929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_39.dll

Path C:\Users\Admin\AppData\Local\Temp\DXA579.tmp\d3dx10_39.dll
Size 457KB
SHA256 613afdb8b44bb3bed945279229d9604a3cd553f8c2b9b091235cbab8cd00de61
MD5 e6c2f1d8b667ddc04cb55b9f0159ef97
SHA1 9dc5c2d54397aeb56deafb63ee34b641f7030ee7
SHA512 5cc39f19b6de99bad0be00fcbde9d498e23f29303c6ed4ba79c2b2bc63f259f9b617ecf6ac67beee8a71c03a0e80c29412e0159a5014a43a6168c37835bb0e00
SSDEEP 6144:3I29GOYBeuLc2EBqQp1gY01mZZw6OpXQYcYKdfcQ9HCIQeeaQeemQeesQeev5Qe:3/9rCeuLL5Q4mZZw6NfcQ9Hibj1Na
TLSH
T16AA47D11A5A41034DCDBD2B0A12EB2F9A1EE967747B029CB491C06E57CF6BC54BB07CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_39.dll

Path C:\Users\Admin\AppData\Local\Temp\DXA579.tmp\d3dx9_39.dll
Size 3.7MB
SHA256 5d29988cad858f754ecc62c3d30de555f82cc21b5b26c448b890295e9b7bee82
MD5 8cb3defb8887c4f0846db1fc1304d6d2
SHA1 5fbe058848db16117ce7cfdabea1f178ba229a6b
SHA512 4cb675b179d05ead18d2e42329e0d10cd1d520cf9c8c0681b89aca79ac9c814e82941b0086135bd57721b66b55b6feae00bd29af804f59a486e935fda413fc43
SSDEEP 98304:+DrWxsD/di4jmmtDTjPZT0kZKkk4Q1arBz8jNTPcCTtop+c7dQQ3:+XoyiomujBT0kZKkk4Q1arBzGTPXc2s
TLSH
T18306AE61D64B4034C8D252B05A4D73F4606C9B3267311BCF66A42BE8AEB57E2DF38397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdllreg_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXA579.tmp\dxdllreg_x86.inf
Size 724B
SHA256 54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40
MD5 8272579b6d88f2ee435aeea19ec7603d
SHA1 6d141721b4b3a50612b4068670d9d10c1a08b4ac
SHA512 9f1311803db1607e079b037f49d8643daa43b59ce6eafb173b18d5a40239a5515091c92b244ffe9cfef2da20530fb15deb6cf5937633b434c3262e765d5a3b21
TLSH
T15A014094CC039474B689F1B2B76B774F3AEB0917E9112308B3CD04499F6361021AD1BD
MD5 SHA1 SHA512 TLSH

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\DXA579.tmp\dxupdate.dll
Size 169KB
SHA256 7c9daafeece27095df9199c9642fef112f8c9295662615b393c55ddbe9353ead
MD5 651b61c845f93a67b2a714f477844eed
SHA1 1b88ce7291cd2735d7a97b0b8b8fee693bc507b5
SHA512 61e993414dd183c1e93d99e374aaa1a663e31fdafb74d59d870f4f8cb672b4deb5f804725bfa6b2bf0f8bd0bb53309300a42a571ba6d9a848c1f5899e04b1257
SSDEEP 3072:a+6LKiWwui/9SXBLTqgNWMPCydN0BMz/xYHWl7LdOIlkhuGzyZT25FnSyNKz:3wuaMVLUMPCydN0Bu/OHW5LdrCQGOZmu
TLSH
T1F3046C2DBB80D471C4E200F9650C26B16BFEA9B6072A80D7E3501BD9E8A57C5E53D39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.inf

Path C:\Users\Admin\AppData\Local\Temp\DXA579.tmp\dxupdate.inf
Size 10KB
SHA256 0ca6bdf41c88a4d5c8f2af7a7e032bd0eb884a2cee52ace7428f6ab21068aa40
MD5 f325787333d65d7a8a7417535c6bcd2f
SHA1 1fa71002479fdc0f447010ab8f13ea8171b1941e
SHA512 c35a4d8c912591493c6030b2e4c7c5885fc18262440ddde008b61b452b657478393cfed0ac89ad2979501150463e45ca536792a45cc83cb28df08ed228f6149d
SSDEEP 192:iXw6TiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJKjx:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDl
TLSH
T110225876B9168119F40EB3A11AAF3ECA5D3B004FB43125CD75EF11706B2E1AC62BE468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\D3DCompiler_43.dll
Size 2.0MB
SHA256 2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
MD5 1c9b45e87528b8bb8cfa884ea0099a85
SHA1 98be17e1d324790a5b206e1ea1cc4e64fbe21240
SHA512 b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34
SSDEEP 49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
TLSH
T1FBA59E11E705D0B2CCCB00B16A5DB7A6647C9F30432096C7B2947EA95D72AF35F3AB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FEB2010_X3DAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\FEB2010_X3DAudio_x64.inf
Size 815B
SHA256 68351f03f4ef83e4b8c359e3e130441081690a1866b838a1b35d64674ef3abbf
MD5 49460e9297b0faab5a5d73e7aa2caa67
SHA1 a7e211f3d4ae808f67a798924c4d3314183df873
SHA512 92c4c0751e9123e1eb09da312bc44041d13262e26cefb807dcd1b354c5bd12c0d7197f1d3d457ddef89714b77ffe45db9c717332963c6daa507ae02a6d5fc941
TLSH
T13401829ACC03D5327689F1F17BCB2BCB5B27041AEA316518B68A04C8BB7310051AC1FD
MD5 SHA1 SHA512 TLSH

Submit Download

FEB2010_X3DAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\FEB2010_X3DAudio_x86.inf
Size 1KB
SHA256 d4da3e530982812d1e2a31570b80af541fac1b13c72997d2aad7ea3bfeaf4a4a
MD5 e84adf38d499ae39090ad60fd76d76e3
SHA1 6af4d58bc04aac2723e8b97649f1b35fb1aca84c
SHA512 6714992e7aee7bd0798fbec68f92c97ee502127580e21e1b6693ed6737312b44dbc9fd9ef579fe552590e9e5a4904df94e4116334265a34699a04aa76ab87c24
TLSH
T1FD21269ACC0294707685B2B27F8F768F5B670417E9612508B3CB0E94BB73701219D1FE
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_D3DCompiler_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_D3DCompiler_43_x64.inf
Size 830B
SHA256 3e779533a273e3395109c7efac13ba1c804c01b3ddb16938406fbdf90d851216
MD5 6494a3b568760c8248b42d2b6e4df657
SHA1 700f27ee4c74e9b9914f80b067079e09ec7c6a7f
SHA512 2bf68b123d7823ad7182e132d9e55f8de7580229e8e1b3b40030da50bb9bdeaf67bb9727ce2171fa83b7f804c24d9728ffabb44cb5017b16b771bb19e62b1b42
TLSH
T1B901AB9DCC02D43277ABA5F23B87674B1763084AED1125487D9900D4EF63304117D6FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_D3DCompiler_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_D3DCompiler_43_x86.inf
Size 1KB
SHA256 5dd568919e1b3cbcb23ab21d0f2d6c1a065070848aba5d2a896da39e55c6cbbf
MD5 1a86443fc4e07e0945904da7efe2149d
SHA1 37a6627dbf3b43aca104eb55f9f37e14947838ce
SHA512 c9faa6bb9485b1a0f8356df42c1efe1711a77efa566eee3eb0c8031ece10ffa045d35adb63e5e8b2f79f26bf3596c54c0bd23fea1642faae11baf2e97b73cf5e
TLSH
T1883114ED8916943077D5B2B2BF8F264F67674406ED65214CBBC908A4EBB3701126D1FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XAudio_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_XAudio_x64.inf
Size 923B
SHA256 1a0f1b929724f8b71d5ce922f19b9d539d2d804c89af947d5927b049ef0fd3d8
MD5 dd987135dcbe7f21c973077787b1f4f8
SHA1 ed8c2426c46c4516e37b5f9aac30549916360f7e
SHA512 f0469c94219b4df99d7b9b693161a736fa8eec88a3f6c7f2cf92fab2ade048dfe61fcde3a4cf4f7a2aaf841d079a46b17259dea22cfb02831983f55bd7f61899
TLSH
T1B5117D85CC4382337789B0F2BF872E8A97570416ED212248BA9A15CD9BA310652AC1E9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_XAudio_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_XAudio_x86.inf
Size 1KB
SHA256 d786d06a709d5dc26067132b9735fc317763fcf8064442d6f77f65012ba179da
MD5 31d8732ac2f0a5c053b279adc025619f
SHA1 c8d6d2e88b13581b6638002e6f7f0c3a165fff3c
SHA512 abc37922307f081a1ffdc956ce59598c19ad1939ecfb6ea3280aa6aa7a99c3eba5462731586ca262f7d7257d7d2a74ff57a45abf6b93521eb6f1c9f22f8eb244
TLSH
T1D7317CC9DC0293717784B1B27F5F3A8F57670416ED61210873D65E9DABA3202216C1FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dcsx_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_d3dcsx_43_x64.inf
Size 815B
SHA256 5289b5ad22146d7cc0c35cdb2c9662742693550de8f013d1ec40e944288d155a
MD5 e1f150f570b3fc5208f3020c815474c8
SHA1 7c75fc0cf3e3c4fd5045a94b624171d4e0d3b25c
SHA512 a53618ed6ebcd50ef074b320eb3ebd38af4770a82caa808e47cba6a81982ced46cf954a1c5a383f171006e727d8211b4fce54c9faf27b4c14a770a45a09037b8
TLSH
T16001CE99CC03D03276CAF5B23B97674B2723081AED12258939D900D4EB63344516D6FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dcsx_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_d3dcsx_43_x86.inf
Size 1KB
SHA256 d5200b332caf4fff25eb3d224527a3944878c5c3849512779a2afcfeae4c3ca1
MD5 cf70b3dd13a8c636db00bd4332996d1a
SHA1 48dd8fc6fa3dae23cb6ca8113bc7ad837b4570d7
SHA512 ae31a9e20743a2052deec5d696a555460a03d400720679ed103759241b25d55e2fbc247170da3c0c0891f32b131ab6a6845de56c2d3387ad233aa11db970b313
TLSH
T17E3106D9C812E430B6C5B2F2BB9F674F6737041BE955214D77C908A0ABB3751125D1F8
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx10_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_d3dx10_43_x64.inf
Size 815B
SHA256 a65f370a741d62c2be0ca588758d089dd976092cb910bb6b1b7d008741e18377
MD5 13c1907a2cd55e31b7d8fb03f48027ec
SHA1 ca37872b9372543f1dbe09b8aa4e0e211a8e2303
SHA512 545aaf268d141e2aae6800e095a1ae4eafe6bfe492d95dfe03789ccb245cc3ef3f50f43b10a41a3b0efdc7f8c63621b437323e133ba881f90a3b940095b80208
TLSH
T1F5018E9DCC03D436768AF5B27787674B1B271806EE5265A87DD904C4EB63204516C2FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx10_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_d3dx10_43_x86.inf
Size 1KB
SHA256 4d4263cbb11858c727824c4a071f992909675719be3076b4a47852bf6affd862
MD5 53a24faee760e18821ef0960c767ab04
SHA1 4548db4234dbacbfb726784b907d08d953496ff9
SHA512 8371471624f54db0aca3ea051235937fc28575c0f533b89f7d2204c776814d4cd09ee1a37b41163239885e878fb193133ad397fe3c18232ad3469626af2d2ed1
TLSH
T1D83106DD89129430B6C5B2B2BB8F374F6B371407EA51216C7BC90CA0ABB3751125D1F9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx11_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_d3dx11_43_x64.inf
Size 815B
SHA256 2c4cf75b76203cba6378693668c8c00b564871c8bfd7fbda01e1e841477b2a3b
MD5 590fe1ea1837b4bfb80dc8cb09e7815f
SHA1 792b5b0521c34c6b723a379dd6b3acf82f8afb1f
SHA512 80bee8f1ad5bfaba6b3ac5a39302a1427dbaa5919d76c89b279dc753170ec443924eadf454746ce331a6682ee729ab79bd390a5d3b55db8d08fd6f4869101f53
TLSH
T188018E9DCC43D436768AF5B27787674B1B270806EF21659C79DA00C4EB63204516C2FD
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx11_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_d3dx11_43_x86.inf
Size 1KB
SHA256 3925c924eb4ec4f5a643b2d14d2eda603341fbbd22118cdd8ae04aaa96f443c0
MD5 fb5d27c88b52dcbdbc226f66f0537573
SHA1 2cbf1012fbdcbbd17643f7466f986ecd3ce2688a
SHA512 8aa2200f91eca91d7ee3221bc7c8f2a9c8d913a5d633aa00835d5fb243d9cb8afa60fe34a4c3daa0731a21914bc52266d05d6b80bfc30b2a255d7acdf0d18eb5
TLSH
T1E93137DDC952A431B6C5B2B2BB8F374F6B370407EA21215C77DA08A4ABB3711125D1F9
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx9_43_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_d3dx9_43_x64.inf
Size 812B
SHA256 272650a2d9b1cfea17021f4bf941b21f2206791e279070d4e906ce0ce56ac16f
MD5 ce097963fc345e9baa1c3b42f4bfa449
SHA1 e7624afc3a7718b02533b44edfe4f90d1afda62a
SHA512 f3c4f00eebd9d465bc2415d59c417bca0f5a07c8e13880b28704f770763609a653d4b06f53d98325b66c2c7094895190900c47980f81463215e919f00966ee7b
TLSH
T19A016B99CC02D43677DAE9B27B8B274A2767050AFA127198799A01C4AF63240116C6EC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx9_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\JUN2010_d3dx9_43_x86.inf
Size 1KB
SHA256 6b33d32da02f664092d44b05237990f825b4062c105a063badcf978648b5e95b
MD5 a11deb327119b65bacce49735edc4605
SHA1 0be2d7fa6254b138aa53d9146cda8fedbba93764
SHA512 b0134a3d6f2d576e5fafb601014ab66fef91d661013acc8a7a9129940369a1d9ed5c0f228bb1666a4e891f09b4b18e83f0cb2080047aa84fa45ab663e5739a31
TLSH
T1A73146DD8C02E4307B94B6B27B9F364F2727450BEA61314D77C90990ABB3341115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

X3DAudio1_7.dll

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\X3DAudio1_7.dll
Size 21KB
SHA256 288c701bdedf1d45c63dd0b7d424a752f8819f90feb5088c582f76bc98970ba3
MD5 c811e70c8804cfff719038250a43b464
SHA1 ec48da45888ccea388da1425d5322f5ee9285282
SHA512 09f2f4d412485ef69aceacc90637c90fad25874f534433811c5ed88225285559db1d981a3ab7bc3a20336e96fb43b4801b4b48a3668c64c21436ee3ea3c32f45
SSDEEP 384:hd8NTutwAV7uTOJ/jUKdiAdzJWZuW8lLXci2jXHUcwVP:hmAV7uTO7jzU8Mi2jXHUcwVP
TLSH
T14CA27C55BA7DC112E9A819F0217EFC873C3DEB944B1282E3119270DCCA653D0AFF9666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAPOFX1_5.dll

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\XAPOFX1_5.dll
Size 72KB
SHA256 becfdcd6b16523573cb52df87aa7d993f1b345ba903d0618c3b36535c3800197
MD5 8a4cebf34370d689e198e6673c1f2c40
SHA1 b7e3d60f62d8655a68e2faf26c0c04394c214f20
SHA512 d612e2d8a164408ab2d6b962f1b6d3531aed8a0b1aba73291fa5155a6022d078b353512fb3f6fff97ee369918b1802a6103b31316b03db4fa3010b1bf31f35fb
SSDEEP 1536:YGrYa/nsaXTeizHgMK7DaCsVtqqXtF9rHU8:pY8saCizgMKXaCezXL9o8
TLSH
T1D3734C01A8E9C2F6E45828F5E4AE39973C38CE984B2085C3635845D5DDB47E07AF93F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_7.dll

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\XAudio2_7.dll
Size 514KB
SHA256 d1690b602cb317f7f1e1e13e3fc5819ad8b5b38a92d812078afb1b408ccc4b69
MD5 81dfddfb401d663ba7e6ad1c80364216
SHA1 c32d682767df128cd8e819cb5571ed89ab734961
SHA512 7267db764f23ad67e9f171cf07ff919c70681f3bf365331ae29d979164392c6bc6723441b04b98ab99c7724274b270557e75b814fb12c421188fb164b8ca837c
SSDEEP 12288:Tcn8HWZeKA6SKE8bZiCENnOgQs/WIOPtm:T98+hIBENODs/WNtm
TLSH
T145B42A12B0418275C5F726F185AE333B27388B8557411AD753E899F9EEE22E07EB01DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apr2007_xinput_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\apr2007_xinput_x64.inf
Size 860B
SHA256 0d6e1c0e961d878b319ac30d3439056883448dcf26774003b73920f3377ecac8
MD5 94563a3b9affb41d2bfd41a94b81e08d
SHA1 17cad981ef428e132aa1d571e0c77091e750e0dd
SHA512 53cac179d7e11c74772e7b9bd7dd94ffbc810cfc25e28326e4d0844f3f59fd10d9089b44a88358ac6dbd09fb8b456a0937778f78ecc442645764f693ccd620b8
TLSH
T1CC118CCCCC0290327789E2B17B8B3BCA5B6B0417E961225C35DF4588EB67145A27C6FD
MD5 SHA1 SHA512 TLSH

Submit Download

apr2007_xinput_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\apr2007_xinput_x86.inf
Size 1KB
SHA256 1c798cb80e9e46ce03356ea7316e1eff5d3a88ccdd7cbfbfcdce73cded23b4e5
MD5 e188f534500688cec2e894d3533997b4
SHA1 f073f8515b94cb23b703ab5cdb3a5cfcc10b3333
SHA512 332ccb25c5ed92ae48c5805a330534d985d6b41f9220af0844d407b2019396fcefea7076b409439f5ab8a9ca6819b65c07ada7bd3aa1222429966dc5a440d4f7
TLSH
T1D42126DDC8039435778AF2B27F9F7A8F663B8406E951221C73CA4994AB73341126C2F8
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcsx_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\d3dcsx_43.dll
Size 1.8MB
SHA256 b46a44b6fce8f141c9e02798645db2ee0da5c69ea71195e29f83a91a355fa2ca
MD5 83eba442f07aab8d6375d2eec945c46c
SHA1 c29c20da6bb30be7d9dda40241ca48f069123bd9
SHA512 288906c8aa8eb4d62440fe84deaa25e7f362dc3644dafc1227e45a71f6d915acf885314531db4757a9bf2e6cb12eaf43b54e9ff0f6a7e3239cabb697b07c25ea
SSDEEP 24576:/j0ZXvi+of1/z+uQ5Da3Qx1fF4dEQMtqVC43ux:/A9i/f1/z+Zce4dpMATe
TLSH
T13885F515CB115AFBD5FD02B249E31B24777290A37EF312B3CF0946255CAE388A6319B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx10_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\d3dx10_43.dll
Size 459KB
SHA256 56fcd13650fd1f075743154e8c48465dd68a236ab8960667d75373139d2631bf
MD5 20c835843fcec4dedfcd7bffa3b91641
SHA1 5dd1d5b42a0b58d708d112694394a9a23691c283
SHA512 561eb2bb3a7e562bab0de6372e824f65b310d96d840cdaa3c391969018af6afba225665d07139fc938dcff03f4f8dae7f19de61c9a0eae7c658a32800dc9d123
SSDEEP 12288:cFUDOgwNvArf8r3bK9s3kW3CG3vQ3sad/QNbubxu:5DOgw6fYbK9s3kW3CG3vQ3snputu
TLSH
T1C5A46A91D5505135ECDBD2B4500D31B626AEDA7353A1B2C72F5C6AEABE38BC01A343C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx11_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\d3dx11_43.dll
Size 242KB
SHA256 492e960cb3ccfc8c25fc83f7c464ba77c86a20411347a1a9b3e5d3e8c9180a8d
MD5 8e0bb968ff41d80e5f2c747c04db79ae
SHA1 69b332d78020177a9b3f60cb672ec47578003c0d
SHA512 7d71cb5411f239696e77fe57a272c675fe15d32456ce7befb0c2cf3fc567dce5d38a45f4b004577e3dec283904f42ae17a290105d8ab8ef6b70bad4e15c9d506
SSDEEP 6144:8K0GaAtQlDJCSB4MvfIeDRI9Z7IJItblSwJ7FnH4fa1wlMjb5:eGjQlDkSB4MvfIeDRI9Z7IJIRlfJ7N4w
TLSH
T1C7345BA1EA00513AE8F6D2B4211D732151F9DE3007F2E3CB165CABDAACB56D18A347D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\d3dx9_43.dll
Size 1.9MB
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
TLSH
T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\dxupdate.dll
Size 173KB
SHA256 fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
MD5 7ed554b08e5b69578f9de012822c39c9
SHA1 036d04513e134786b4758def5aff83d19bf50c6e
SHA512 7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9
SSDEEP 3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq
TLSH
T133047C19F640E871D4D20178311C6B3119FEA87017A980CBF3472BCEE9A97D5A67E36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe
Size 68KB
SHA256 34ab99536ea59ad60ba6efda3ea6d18291ef096a0bab3664248d6045805da0ec
MD5 45d4dac07aa361bcd77aa815d1724a16
SHA1 3bbdf7da5d51211ae269572961b5ebf508ada28d
SHA512 d940002a8e0112a3b56a909008403b447e9cbb80e38b9bbd508f40aa68224f7e5d9681e1039e747ae939e0829a25be2319b9f9d0862cebb042e4c525ccbc20be
SSDEEP 1536:dSKL6bzRYK/ixmu3XyhJRxjWhKfLXJ/y/Fae:dSKL62K/u3XmxCAfLXJ/y/E
TLSH
T1E8637DC3A648407AE0BFA53486F15B23F7F5F854033953DF1A1489290A67BDC2A3D74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infinst.exe

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\infinst.exe
Size 81KB
SHA256 8c62fe8466d9a24a0f1924de37b05d672a826454804086cddc7ed87c020e67ff
MD5 a7ba8b723b327985ded1152113970819
SHA1 50be557a29f3d2d7300b71ab0ed4831669edd848
SHA512 60702f08fb621bf256b1032e572a842a141cf4219b22f98b27cb1da058b19b44cc37fb8386019463a7469961ca71f48a3347aaf1c74c3636e38d2aea3bca9967
SSDEEP 1536:uOPXfyLm7r2P25504T+kGvNcD9QeZu/FOfNlpaJrxO1wh:usXfyLm7rGo504TzucD9HoIfND8xO1wh
TLSH
T182836B9933A410B9D1AB927CC8E24B05E7B2B496473693CF0368469A5F23BC55D3E733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xinput1_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\xinput1_3.dll
Size 79KB
SHA256 8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7
MD5 77f595dee5ffacea72b135b1fce1312e
SHA1 d2a710b332de3ef7a576e0aed27b0ae66892b7e9
SHA512 a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746
SSDEEP 1536:TVeqvNS6T6jxeEsU6b0xZtDDVb9X8u9JA7zitdrz/R8cy/FaeBD:TVeqvNOeFgxZ9DVVtRBy/EeD
TLSH
T199835B107480D236D8E361F806FDB714763CD66513A559C32BC4BBEE9EA63C26E3069B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xinput1_3.dll

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\xinput1_3.dll
Size 104KB
SHA256 756cad002e1553cfa1a91ebe8c1b9380ffabe0b4b1916c4a4db802396ddfbef8
MD5 bfb3091b167550ec6e6454813d3db244
SHA1 87e86a7c783f607697a4880e7e063ab87bf63034
SHA512 ce2ead2480a3942081af4df4baee32de18862b5f0288169b9e8135cc710eb128f9a2b8a36bda87212c53fd4317359349c94d38b5da082638230dcb5669efede9
SSDEEP 1536:S1ea+pg4i1fprOwSGiExJ70MBzLrPbYMGsJ0OXrLSkfmrxy/Fae:S1nz1UrGiEPg0LH7GNO7LSkfaxy/E
TLSH
T15DA3299AF25991F9D47BC07886D3BB26F6B2B450073487CB2764466A0F13BD89E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xinput1_3_x64.inf

Path C:\Users\Admin\AppData\Local\Temp\DXB6AF.tmp\xinput1_3_x64.inf
Size 669B
SHA256 0d411d9424128f19fed2daa95a2983b4b29197f022a754f59d0c7740ad654cca
MD5 c9635b7617d68d95f9113282472218c9
SHA1 e3da3f2600a0f5cd0e28722ee313e04fc29dfc60
SHA512 0481e008619d3b3a45d0a90825b576e4c03f27668b0792762cb9165b15955645667392f23eac5e5c4eb8a7fe6fa47cae4c319323b02225289af0cffaf1ca8c83
TLSH
T1A301FE6C93910B88F4CBBA00244599C3A5AE01405685209A75FE8A84FB72284D7BC4BB
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ospb2yyb.1rx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ospb2yyb.1rx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\LICENSES.chromium.html
Size 19.4MB
SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
MD5 f18ed9a25df7c7951cb7f936ca9feeea
SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
TLSH
T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\dxcompiler.dll
Size 24.5MB
SHA256 9feb01af5460d69042b715dd2dc8d23faa3a409b07b811e07b7195c044aac1c7
MD5 738d9cdd6a94cff9e941326c6c2ad734
SHA1 716f6bc8a11dd0940f1b36196ad0a1e32c52a886
SHA512 6e1e188a6a07fef8ee96e106ffcb90a6dc13ff6fe6b313797e4c746a9a4fb7a0c795a3365a9fcf0a1d8918d1fbd07ff9f583bb4acd17d883b09c8b5348abff97
SSDEEP 196608:dWxkDUHlgJWwgvYtoexSGkJ+ccXP2BPUNkiAqAN+nNtbR:dEkDUHl4Wwg2xSFJ6XP2BPUNpQN+zR
TLSH
T14A4729122646D49DC099C879C7678B268A6C30E73FA7B9DFC0F451252B79EBC4B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 568b4a799381c45e34f7ecdc73d7ffc4340688153766f5e6d15b7d99ca8a47ee
MD5 054e6f1d8554c25cfe74cd8c625b825a
SHA1 f50b4d25ecd8ff11a148bcc52e51831130774b84
SHA512 2b1a7341c09fc75477d62b43a56506bc9417a98db413cf57235f64850138bbe34a9ec30147cd55be648134cde56100524f9a32ab90c84a3b084fdc1ab1f396fb
SSDEEP 49152:YD4JOs9bUAtjcqOEYcvDb199aPLKIbH7k6Q4gNoJqFfwYd7f:YD9+UAdcqbvDdRNoJ23
TLSH
T1F0E59E02F6D651DDD029C03497AF9213F631380A4F205AEB1A905A263F67FD87E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\icudtl.dat
Size 10.4MB
SHA256 c5da2fc389d1bb0ecb13fe22a8e069b7abc491f8aa5d16eb65d4ff32c85a46b6
MD5 5b29b82022f9697b3010b05b2a71535f
SHA1 eed88ddce48046b1a5c5fcdd19cd9c5a81d8c4bd
SHA512 bffa945bcb95b13e69a438afdcbd6d5a490db902896ed4380c7d7c61a4e53b35d73d44d75eaa7debae65e308b01b287411f168ea4377360045afe8a6b9cfa09c
SSDEEP 98304:D/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndP389o:D/cBhORok2HiXUxO/RJk3IWhlYntjdqo
TLSH
T179B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\libEGL.dll
Size 496KB
SHA256 6f7c54b18fd4db3bf1b6ecdb0a013c557fef8b69d3ddc58c1413015830833436
MD5 78360f358707e3bd23200f081a10067a
SHA1 7221e6335e9871fccf2986b01da65c343dfbe698
SHA512 8a2b88e7e49ef83f99950604be644a1eee13a35b98d7bc381226d40b479c26e51a2f3ffefed9cb8f73fbbae13b82add738fa3ee172b3aecd9176b88eaf96509f
SSDEEP 6144:pVjuHfNwVk2IcwksKrkL6xIdjZwL5/Q5Tmcql3JeLBo6IXtOqoQ09OSM:p1WFj22k86x+U/Q5TmcqveL+6NaHS
TLSH
T151B49D15F3E946A8E07AC1348A538643EB75B4820F65FAEF03E052752F37BE45A7A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\libGLESv2.dll
Size 7.7MB
SHA256 4edc26548b5d22ff932257ff59e468b9119d6f4c691fa4e1683d94b25d5b46ba
MD5 3cb1a278552d7a3aa46e2beeafef93cd
SHA1 899ac3687d79a752ef23e7e8629bbea0f8d7eff7
SHA512 cf44782513c28e616683bf010c33f14399ab9e5835cedaed3712c670c0db5eb97a9131fe5ea7d23241028e27cc8b39831ebac955b9a8085790e632637a72c007
SSDEEP 49152:RLe6/cUFf6P7ql0XwFExC3QOvRF5ZCZupBkPm6VsYywolfcIaqp03zTUmxuPblQ4:RUUMWNMCpdlfC80n+dYYGuOkq1+Lnx
TLSH
T1AB867C03F69641D9C05DE2788757A223FB34B8450724B2DF2AA457152F6AFE0BB3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\af.pak
Size 605KB
SHA256 dbf68bf3227181d7c047161c6c704ace32d6880bba6ea02bfbd33475f3356e91
MD5 a4eba95df91c6061061cf1c99f1eb484
SHA1 244dacd0fa028d7d9385105e49db42e55be49d2a
SHA512 aaa137e5e819df16efb41b772620f07ac78ab9029d60a1da4d05bb4d74820632d3ddc087c7d579bd2c255a30a77a7a47a14c81149de60f6d2cf4a2f3e27dcd3d
SSDEEP 12288:l+Ifrr9xi2tfxgtRGt+TkTnPxxNtEKY+53GANAn4H2JynwN+kgnALzcGfozvhpIv:ZvZtfutRGt+Tk7PxxNtEKY+537An4H2R
TLSH
T1A3D41B0AEB91173D05B07696FB0945B7FB9CA26CC770B2BADDA982310566DFC10BD0D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\am.pak
Size 983KB
SHA256 8d3d5dfc64acfbb0c35036d74561d09ddf3b22058eeed0f8d26a2e9c0703248e
MD5 ca12f04a04bc27a3a5fe78789091ce51
SHA1 eefa0606bcf3aa65edc124978f731336c60811f9
SHA512 07fca45e2c99ab93eda0346550f083c0e0fc7abc50d9610869ed9f558cec399a0b88434b4d8cb5a838acdec7e8b3e7a2a6c9b1171050293647977b15fdbdf109
SSDEEP 24576:Ueb6TG1orqThTCKHyK6ax0hHfjnNWNT5zaAfX8j5xi8bVdwZtPBE:lI
TLSH
T18425AA547DF9F7570F8E8A1994320E4EA594AE4692803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\ar.pak
Size 1.1MB
SHA256 3c253eebf4207c416fac047f1f0bf425a7d9a12fe63714667c69841d2550b89e
MD5 fe6b9d34548806f9faa7fba231ac1250
SHA1 34106c26f9023f38e26fcc0e73473f9763167f66
SHA512 b7eec1bf08c303dc793bb958def3f9e8a03d12247cf1c6e5d30a8cd2df200e7f9cfcd9ce46e320107fe014dd9dcd6fc9340e24bfafa93993bfbe5aca510e9870
SSDEEP 12288:5k9562BGop7mNo2GEeHwjdggzP3v4Uzbgkb2QSVMNjXEioHDAi:5k956dEv
TLSH
T1FE358BE21B2984720B56DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\bg.pak
Size 1.1MB
SHA256 2789212aac5f2133ed23c1f84623bc64eb4cfbd93aef7af751d1221e27a21daa
MD5 ea6519b0214acdfe80b9ceb590ea4dce
SHA1 49d14345b6baa6939055d7f50bf0984791481706
SHA512 28a1ddd55b55e792db5a114fd305ec3631579a3e8e5507a629144769bd25c4e2de6ef9e969ddb037f7945330be02e4951a5ba8a27881fc5e413c2a33c436b84f
SSDEEP 24576:0KWulJLYAgCzQkEC2U5Vb6IqSsl373ZWmKf3p2KuUfVDrzQE74uOVnQxRfkn4wxI:0KWulJLYAmFU5Vb6IqSsl373ZWmS3p0g
TLSH
T1863535A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\bn.pak
Size 1.4MB
SHA256 e72b72977b40fb10472fe1a3fcffcda8b434bf52e2bb2da2935faa80da224812
MD5 ae6da45169b7a3fd99da8218c92a1e2b
SHA1 2552cffa1f63012b2fa7ef6209869f3eeae207c7
SHA512 8328e598f9c30636d60547a1d31e909b46ab6f92b3c210274c95886294af7ef20552718a536ee55c0a58d7947d2932061fea8e3113b8b331b4ca084501f51c4b
SSDEEP 3072:Y2M24emMNfpp1pomjwuquXCg/V7hq2XOUU9qygEfK8tRs3F+IBEBbaUqQsjkwgw0:Y2q+Nfcm00yg/V7hJF+IBEBbjwg/H
TLSH
T10165EF209C6E81B6A8C5CDC9434C6370C523AE9B9B65F74DDC17A24538ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\ca.pak
Size 683KB
SHA256 bc36a54e977f67a09090d5565f2c5664d5e01dcc4fa01a9b418fe55f32dd9026
MD5 30d06b7ecad8c2396e12ae2e3830dbb1
SHA1 2e8bc2fa26ed82ee8da9972d709dc7540c487641
SHA512 9f3e55d247b76f2874342cdb5325e7b7681e1fbc9cddb7529e58f0e3ac7488dafb8b83d476964a166052af53a3e592baa271cbd47890cb5d00df913dcb6b16d0
SSDEEP 12288:9mpmaIM7hjzlCiG78lpGa8D5PsF4N3Mw2juwwPR9zejm0t3l7C7ThALDq9wTLX/X:gEajQf0LApMZ5M0wrJhXs3
TLSH
T1DEE4F8239FC93B7704D2330EFB46C253A48CA9847A16D254F4AE1B1622CCADCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\cs.pak
Size 709KB
SHA256 7c7e7df2664ef1a37609f43306e06c332d2cdd6983b7c519fd70f208626641cc
MD5 29c069b20f0e525205e1850a514e999a
SHA1 b259dcab959fb9c776c1bc226fadb354b6aa2142
SHA512 b7f6329980f14285189475e8ab889e79ab29753724dcfca5242f11338a368a2dd668bb2cfec520ac9c5b9d1721240f73975adad10176d1f4528ae16ed4befc5b
SSDEEP 6144:m+v0B4P6opX+k8ExuVSG15ADF4+AP/uzBYcZ8OlJSBs98Qv:mybTCVz15AD+kzBYcZ8OlJS+
TLSH
T19DF4391EEEA36425584002487FBE4128BD5EC3140B6EE9AB7CCF9D912575B7E8EF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\da.pak
Size 637KB
SHA256 c4a4bcb72297be145525309494e56ef0985be3e4e57df435a65ab7fddc78766f
MD5 4e70e5f04bda66e22130835efdee75af
SHA1 bbfa9015ee263ed35428c848648d6b8269e74a51
SHA512 65c58ac2df17b89b2cc3e3ea73a71f89893bff0099b824711727c363c8dd9fedf4ca90c4b5efd05d385997df14f60bb07a675ec6ed9f47758b8c11fb4a61ee78
SSDEEP 6144:tmit+F0m/OQzVY2/QD5QnOXgRVBaFLxE/ene2wlzqJwZBIEbPKaSpuKmEgqYscX9:PtyuFXeRIAAmjfseP
TLSH
T1CFD44A4BDC9CB32FD9A94725F311CDA7DB6D443CC684264F65D8953A09CBCA092BE2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\de.pak
Size 684KB
SHA256 7fb0ec938ace5ddc1d094c7877facb94ed33758652d0f4262e2fb1fd2bd34c8f
MD5 f2020120d0962b30a3bd8a3f666693d0
SHA1 990e1aa43342610fe85e0d1e8274be282f6b7cf2
SHA512 ac7715152d47fc98463f49e61b10ec3f81d936ece09ca157c13baf24879efc8cdcd52cbdf95c410e332dc4c38a595ed422f925dee9da3271f1dc6800908b4022
SSDEEP 12288:GVlPHTcT3K7UpVhg1aG3g9LKVLePU6ApCgW:2lvAT3K7UpVhg1ayg9ehCgW
TLSH
T150E40803ADDB625EC786B3617705CDB77B19E36BC346322B84EDD027654B5B283AC422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\el.pak
Size 1.2MB
SHA256 3ee2e46a5a569e411ccf9d77ee4f356e1833bfccbaefcc5e71b7c1517206ab5f
MD5 b5b01fbf52e566a2042c2bf019a6fa1c
SHA1 d6764bc102d1819f48724be1d14e1f6d547d2724
SHA512 35c4d5668f9f5a1ccb25df0f36cefa9c3f3b134a0af4b9b460af5b073eb1257b131a272505b0f2823d9b0a4c21cd8ce76128fa6ec088de539980499d941c9f95
SSDEEP 24576:NRzn7HWFbrlE5Yp9Ck2twZuwxJXDsSSEumUaR67ex2MSPgL00O5B/FCyjlHvAdQ/:bfHWFbrlE5Yp9Ck2twZuwxJXDsSSEumu
TLSH
T12245CFEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\en-GB.pak
Size 552KB
SHA256 aac3b4904d021d58d053bdea2d8056a219ecda1e341d87cb70070aea2cee418f
MD5 121461689d08e6e0d1e0ad4e6c695f7e
SHA1 113ec35be3b54ebf9e2b064181475bb82dda2670
SHA512 69b0d1d401aafd2fac6ed86f3c51de4889ebda123c6cfbe6267e83cd9271dccf7db2627cfaf31bf5713efad48845662763106ef26da09803a1580fa04c7416c5
SSDEEP 6144:D1Zf+l9GJBIvNBlxIxhb5E43FzcieMaMP9zQ49lfaYHEJjXCYDcBcnR7K:D1ZfqsJavNBPIxhbQvMNQ49UhDc
TLSH
T13AC43D1FF784126A05A311A2BB0AA5A2FF23D07CB35112667CBD811C33B676583777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\en-US.pak
Size 558KB
SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
MD5 6249e6f03590c631a2a873b3e79058d4
SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
TLSH
T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\es-419.pak
Size 674KB
SHA256 97322b7e206b017f3c95733be396df40fca9d68363d8aa4d092c5dd8d1056f14
MD5 f84aec3dfbe42e5be61c20febc385a17
SHA1 1ac0f9aa071806cd9b7783df65e388433e3c0d68
SHA512 769faee2b995882c114616f193cceae34761daae52b5e90682d09f99847fb394deaf57c48d03a4136d0323d11462427975d78bc67b04fb7c7e4c492a7e8b21c7
SSDEEP 6144:h/zCeShdWSX92I22lgXqoOZsMYngsoZNcNTkJkH5A+UnNyz7:BzC1RtB2ugXWlBmkJMAPU7
TLSH
T1B3E40822BAC81F6310E3A348B743D753E8D89545B408D29BE4EB876522CCF8CD967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\es.pak
Size 670KB
SHA256 cdc1127ed91118648d10a2f3ca71bf1c26ba99ab134426de3f1d1058ca2eccf9
MD5 ce521f4628e21e6ac20bdb071723c0d5
SHA1 3b21ea5ac1d793ac32a2b4ca36cb82218444b08d
SHA512 a4e93c434e066c063960a8aca9d0065c900cc27b4189dddeea8e7640c83a9b4ac45f8756db2c3d6cce43a720993478fb815ecb7f8e3766b9adbb14fa7a0a327d
SSDEEP 6144:m747CvmAj+MQ1VPRuogNBM+7I4naYwFd8jw9MOJTev+JETiZ6PZC+t:maCTjFmRu9KGaYEd8jqxJSveyitg
TLSH
T134E4F726AACC0F6350E39349F743D753E8D49549B408D29BE8EB866621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\et.pak
Size 612KB
SHA256 ecc838878412cc9f28dda9efed2fc60b67315f5fdf64e912db33cee7571a5939
MD5 0485794b4810c277d1215c5fc9a69e3d
SHA1 c0e9b7feb062df79ec3a1c94115efa36bc14c72f
SHA512 c694c4d2badb1c22638e7ca652ba4d801b1cf1b9f63c3f492b651c2a41c03e5c6a2e41310d129f70dbf7278fc4b6b68227e5882b86ad9fab8c8cc31f5e21dd0f
SSDEEP 6144:STM5NSzkgUaqY93DL+cfFnyN0GnFajtRvfZdkUmPOTQyXgXmjVOlvuCCn1qyzXiu:STMOzVUN8jfF8nFajtXOl2CC1qwP
TLSH
T170D44C42A27D771B182412F9E737E923DC9ED3D8B4000D9668974A1971EEFCC38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\fa.pak
Size 1013KB
SHA256 43df61ce1b39a00d5d638d1b9df8aaad9b3a970b2bedf18129ff4d34e0688ccb
MD5 4cca39713811ffd41db61cfb64540754
SHA1 0293d1c849509448427163d040f14b6915e14ece
SHA512 d4d66a8085f09d92af72365061172a285f3d0303024e518424e6a8f3860e84043b5d3eadb67b68c1cfd19d78ef72df86b87fbad0d6d9b8ce1e585666737a71c2
SSDEEP 24576:wBKj38u313uyqoz+s42ERmXnloTUoXtCfGk62Yhk826JfikW0MX41OqlUSHkI02l:gl
TLSH
T1BF25B1957AAC9AB15747CA0341E33834C773EF12D349FE40ACA1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\fi.pak
Size 623KB
SHA256 18d904efd7d15a49ef3638c45a40b3aa604e5ec4b68e017ab3f568e6a8202fd4
MD5 3d5e89e58a263b94ac4f49e4e8c76adf
SHA1 1d4d5c23c74c7e98ad49aea4ff1e67424afe6245
SHA512 10a1b6134dcf59d01781e59f7733aa45d3c24e76182f1da6d25921a98600571be1a3b904430dc64707b6bcfd43238929be8df37576c86df10bbcb35dac5672f7
SSDEEP 6144:8c+vwr1RbX48u19cj80ar6NmSFrGkAgoFRjPVOEmHbeaq5pLx7wvpVv7IJprWaTK:AvObX4x19C1a8GtaRvpVDIJprWa/gL/
TLSH
T138D45D915215C32237C4D29E7DB0903AF5E5E3DC8C284D9AE843C7D849EE9887DB276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\fil.pak
Size 706KB
SHA256 95ddb0e14b0811476d5d636f0797f3ec7cafe77719b5b4e1140d5bf783556061
MD5 385561134147ae1f45715dc2855a35ed
SHA1 7e11cf61b5aef333a541d95ec4a112e49c1711c7
SHA512 4064954451c6b951f9eda5e4771ad078e6ec9b85852af313c028026d51d7b6f02e00f64c47974bcbcf8b137faae3661e7ce55c1b9381040545d60d8bfe0dd714
SSDEEP 6144:9DvfkV+hakrNcqiKb8yzDQjGXa+Ea3o/VzV8H68v6/C2oVHA11EW:hS+5NFnvG
TLSH
T1E7F4C616B7401748DBC352E56260682F6AE560BC3F81786E0FFF268B7BA7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\fr.pak
Size 728KB
SHA256 83ff7dcb48d70e5d3d4880eb3aaa3abebbde6b84e8524fde415701a342946cf0
MD5 68763a0ec006031b45b6883f5b9da90f
SHA1 0bd4acb85d6213c454c557735151c1b627eb4560
SHA512 691278daf78735baf7a0a393b8b1bac4574900f1e2e9cd42a4b5d96b0476681bcf9266cad83df44b2e8eba818b6700560ff4c53bc37e0c5afc27f7712c4ab3f0
SSDEEP 12288:EFirR2sPNZLkW94S+bvZZiut6QuargVCcm8N+bezEh0y4VoZuYnYw8jw2wW3S1XG:s2H8vcVezmh
TLSH
T1E8F4F76FBED431CB19C60267FB12C663DD348248F215E344D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\gu.pak
Size 1.4MB
SHA256 b207f2046791aa8150015ca78f9f76f2f6509953a00c5e89b155bb40e3a26474
MD5 7daaf6a5370eb04dd0e1d1df08d35f15
SHA1 d861655e79aa6165e9101d7de18f940b5f9ae976
SHA512 051dfe0a1ca3c09dce67456d75bf595dc36d1ebcba5f5003a1effdfb679531cd29593ebe524612c54104bba0e8f442e3588da966f74ac1655cb3fbeae501c18f
SSDEEP 3072:KD8i2t5BaX1eq0o5KPjAwREJKVMjNiT7llj63rAulfcSi5NnWsWi+/GQoynAzl/q:M8DmFT15STsPffC+1KsP9
TLSH
T1BB6508D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\he.pak
Size 887KB
SHA256 60513280b46bd34c559bd47ea852ac9e9460e43493e5ab767376883eb26232c2
MD5 90a223744b66718f00f08f8655cc92e9
SHA1 32e817b199faad7d411e2a1fa609a3c1b788165a
SHA512 326cbff65d6b55442c951d33fb23112cf4da7c5c5bbd09b35fad65bf45b71bf65394a30720558fe9dfa4453c4d5bbf9f0929fd8638ea65003e2ef9406028434f
SSDEEP 12288:lEQ4RtmhMPBBAomTm8dUulrYyIQDAlCWq+/8OrguckANXkxeQCaj6Tyi6jcAf5Oj:lNcw6k
TLSH
T1A01599C4B2E492255131AAC39FA4FA285FF3CAB53CA27512CB14526CAD774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\hi.pak
Size 1.5MB
SHA256 25277d90750849791096845b912b1820bb2d3b1766ed8d751ffc213d1af74b32
MD5 b426f5cafc77e795967215bf35d7ef1d
SHA1 da18412a62d179e7893c75692ee455a0d081605e
SHA512 6c10603ac17491ffa2368607b3255c2d665f77cb6a512e4bc48b500627b7ee7ea1f325471dfd3a421d5684577676c1faa9f900ed104764d23eaecc9c42738163
SSDEEP 3072:uAFAiEHnTcguYebMa6jkgp+GZodsTntPV/B90ZV1dWuGlqv3oJEdtDVejnPs4f4u:jF/Gcgu/bMa6jrisTjaT4ROdbPk
TLSH
T17275F40CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\hr.pak
Size 682KB
SHA256 704dda9c632246402cbbd12b0c71ebc60b0e53f1af8ba54903d33a50bc7e6ee8
MD5 1ea6d2cb08872786810a5639977e8477
SHA1 2bda50c23d6a8f20ff72237e476f1ed3ac2affde
SHA512 a0a10bb19d0c815878bc8df514c30af7ad7034a20ac3b9c146183a36482958f3f93741828fd64c6b4304f7fa5ce53835086ce7a4678e9321d51eafb47d926745
SSDEEP 6144:7hS9VJwKC0Z188hT5ja46TzK6bhyoE6pOWOYwhdbYu:FS9VJrC/6adHJnOpku
TLSH
T155E43B7DBEF3570A0897B24AEFAA43547DBE08DCE56497B7684F522E0003F4C6AB4149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\hu.pak
Size 729KB
SHA256 b83fc60c6d3ce3a04338ea16ba4627d6dfdf81f4373fe4921ac01c7c9558bcb6
MD5 9b7c0f6446817764f33fee01e82db019
SHA1 40061f4276cdde875303b709fe783c2d52e2a60f
SHA512 ea1ca65c71b5a216865cebb7cfd82774f0f8184a09dc0943321c9d5d44d94ca8858e99c11ff66c58cf35f943ac75ce82b917594ab21f53e1049b26a047bf42db
SSDEEP 6144:dzgVHf66Wfsxn/3BLk5dnTpJ7yHlEx+XlH2sSaa0zA4ttAuSU5TT78bZ49JxTYhW:dcHjKsx/3ykJA9U5T38e7rROyr
TLSH
T144F44BB793B6944ABC6C178778643F55592E481BAB2B31FB2883846D34A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\id.pak
Size 603KB
SHA256 97f882b538710dac7d3af9518eedb30f680447bc465fcbcf505de776c54c7571
MD5 136e0e349a1194b81f3c5a49ed2fce70
SHA1 ec45ca51a1d953c7839f618839c60d2ab53574e2
SHA512 de0ddc240f8894e9904b4a77bfddee6d6686baf3923ff14078fc7dddec0eb1fa06f40b25db5e86cd66bf7ab5860978316950996b2d5510d008f9e04e24375449
SSDEEP 6144:sBZoAJDoV4MHWmh/aChCNBL71yJW37ffpTFjlFKzmBHCY26kkz68jWOBZFm2iTvS:8Zoc7KW5BLAiNTFjlFCmpCc685vX
TLSH
T1D7D4E7632ECD310C094843D5B2DEA91E7CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\it.pak
Size 660KB
SHA256 7e6157c84b655e0363336b89518e64ca15350e81101dc9829d2dc8efd9015b3d
MD5 cf0757f656de49dbc1e306849bff1796
SHA1 c0de0b7430134d2c8554dc40aa140510342237a4
SHA512 0f084665008306bd4f3014360b456833601227a93f39ae554a2494991bb17172be8488ed0c2a0288844e6f6f3f0b7c309409ee43e5edc120f1e65749ea9e1bdd
SSDEEP 6144:x3iE+0oXN17qF3ikJd52N5zVX2qlSfqBCfEs61ltu/whOea1yIkYMcrFqpzSj9f7:xyE4bTEF8d0gzP1nbGlupc
TLSH
T17CE41C3AA5DA252519876359E611F085FB6EFCCCFA41721CC99B131C22CFE80E1ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\ja.pak
Size 804KB
SHA256 423b2562b1ed7c5af8fc3ecd495af1d2437e70d27bc6fdde2d5eec6608ae7151
MD5 0148e5b243d755e3961b1fa5ccc1240b
SHA1 dcb569f87cbb7dfaf92c698712249f226059f38e
SHA512 02ae5e0aeed768844d164d61e9de906740b0070b24eb267124a8345170e67131e3f586f227b28ffc6bd42f137c9126da9f277c65dbc3989379654c5cc2ce0240
SSDEEP 6144:Dqs4ba+HBa84EQH1oZJMxkZrQ2TMhDeabRAbGVHhsV9:mjt4tH1tkZrQ2TMdeaIGVHQ
TLSH
T1E405307CE3C569369D6153A22C4E36E17506AC9BFCA23A3A443DC074BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\kn.pak
Size 1.6MB
SHA256 4ceac5506e0e3f045fe4bea3cff571b44df8d637f40814e9e4fd4cad49955d9a
MD5 eaf4d63e99e47ebb7e84eb3f57d45e50
SHA1 710b71ae2efcceea1f7d4d99820c0aba1d079c0e
SHA512 6217cfa8c9121f97f85385ee6fd45072f600c3e6192c0d9b07e29afaa072117f3699df068d29dff6b8b4cb40bcd8c7d7ef89561e2d852e507ad4d0f6b31ada9c
SSDEEP 12288:1DOwzDwQNSWJjQgYPBQvwT7N7zSAMW4QHyGEV:h2tMl
TLSH
T17175CD18ADBA7D301BD5106B24EC643ECFF16BE29CA907C2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\ko.pak
Size 684KB
SHA256 471d660f4099f066ab5cb3b262932645cda59f7e47731ec9ca73381ca49398e3
MD5 d690a63d4cad097276e0425642fa16d4
SHA1 932a8f355fabe891f6c7248de81eb721a42b6a00
SHA512 04ef3ce6aec6df71736fd98eb767feb1c1c9b88d72104653d8691361dccad98437bf78dba4e94e10953023885f5d9374589f6bbefd1e7db2535dcdfd7d87ed8d
SSDEEP 12288:47FguTbckpM1WNiPszcbifYj4ZGRyzDRIE1zHFQgC0lIJ/xESJGRG1KLhw1Lqc2n:wxIQ983yyOt
TLSH
T172E4B5F23CDF63C91193CD82AAF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\lt.pak
Size 742KB
SHA256 0c755ce72d1b71e77d58ab014228458d8ce2b0c51a9b00769635c6609255c9f2
MD5 1cf07cb33fe89bc96f45994a0ad98a62
SHA1 b8a9c25eb8fcf9f606f851b61a3e97cb2bc0524d
SHA512 2d9382136b3444b8130317ac658c04ab275a20d0e684420709840029c3c50ef69ffe19e51f6ada312439d7d2fb4a8c8d127e0202987d55612e7923ab323dcdcc
SSDEEP 12288:GXBwFUg40MQ/u3qhD78baD0dRyN7UJiuoE6SSH:GXWrMkbKQ6J3oV
TLSH
T1ECF42C0069E3AEFB9A4467C981A4CA78DEFD50009727BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\lv.pak
Size 739KB
SHA256 911f922f6ab11d04c4913b04088619276994104979b2c5f132182953fabc24a9
MD5 797904d9b8cc446bfdc8823f8efd249d
SHA1 178b5ae7a875e50646cee8a9c34be60bf68f3ade
SHA512 854a126b5a7dc48513729d476c540608d557de3049868b2329e507451beb9a73d38a68a2517a41d9a85f2b1970087630b334323bb307af1a58d49052972f920d
SSDEEP 12288:HjFJa4VAWdx/N5g/1qrcxm29c4TloHD+oB:DFJa4VAWdx/N5g/1ucxm29clHCoB
TLSH
T132F43A959EC68FAA4D914DCA733AD133A8CCD700FE07E112DD798B3A550F52822B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\ml.pak
Size 1.6MB
SHA256 9ffdc8b432d8fed00bad72740fe2d1f3836e4a06ff584d460f8773b7f02a072e
MD5 e2b97c6abb54b90eafc1fddacf25629f
SHA1 2b506450fe0e596b21fc57d32e3212cfbfe14244
SHA512 2fdbc6b5201034fc08de39fbca3833cdd996d65305b0e5dfc33f29de0c83a8fa64f05edd5e16b40fcd09b31cfa624fb5e945c0f339964d215a3b54e32a992f2f
SSDEEP 24576:kOEP/oZAuuxyYl+9y9XBkx/9tYFrKfijHeBRJzXtK+v2/idf3AaIH3F3u:b3
TLSH
T1F7859D5BA036CD3B0FD102167B4E2FABCD5B9FD140AF668B5869B2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\mr.pak
Size 1.4MB
SHA256 1971da05e4868841c9d9f78be5e17ab09178af99b86a6c07df385015a0c9d9ef
MD5 626fbf6ed8eca2fa44e52ae9cfc8b856
SHA1 c4b8fb73e8dd22f1adc75a609fa15b917e98a049
SHA512 83534bcd0014c7431599e49da7f1c18fbdf4176085bc170c78acf31965fe375dcd1a0d2814d4374cd7509a4bd5c07859e811262bd637ef341ba822aa8a3887f6
SSDEEP 6144:VIU8ZtwrTSAld7dSCyiWUIsN00UH5rCS0mOygEb:ewrWS5TGXH5rCS0m/gEb
TLSH
T1C565D24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\ms.pak
Size 636KB
SHA256 b60c552a9ced5d0e1f4ed408f65a04068acad7d80db7cf88528fbebbcd337e23
MD5 a31481e751f6bb180968b2381d793d05
SHA1 a8b197bfe937469497c53e7df3796d11111b6024
SHA512 5793f68de93a896b689fb52ea82e2102c7d89550236dd108758745d22e68db055c577634dc41f1e2cf80bf4954d4167a84607dd282daf98210882a996685044f
SSDEEP 6144:njqCnjw23rq9CrUOP1dXvkSLxEHuqwa528WN3wcDiGPUlw+CV9hD:njq6jwQUGX4HuqwaSZKlwp
TLSH
T113D4B5579EDE3118085843D9D2DEA91B3CDD3332B705AF2B4DA08FB0166E7A53316B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\nb.pak
Size 608KB
SHA256 cb50908b03c77263297e63ff75d4d3c58fb0cb491c69a8964239e787c762f52d
MD5 d1ee1aee9d6944eb8ed7a658333cc91e
SHA1 1faad08736d478e7d25a144dc906147781e6de5e
SHA512 66d6741740d59d442fadd734ec4285cdb15c6559b448bad513bd9aa08062487acaa36cc0c88c289d37e64c89ffa05cedaa70f4473046b20bd6d3f850e5fc0c09
SSDEEP 12288:4FzGCp19tcd2Ql+hB/Op7fmPYiGkJcKb8B0Uim2r33:4FhX9tcWhn3GkJcq8B/gr
TLSH
T1C4D40883EE46B72EF6A44394F519865B9B7D942CCE98199B54C8C23E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\nl.pak
Size 634KB
SHA256 756cb19043f21eefa77f64d274d950412ef7b0a7d3012da7f12f6821c6eb4c67
MD5 68ce8b1551a425142169dd11fe35a57c
SHA1 e102ee002cf990ff58f10b4fcad570315a84f576
SHA512 c68ac6ba255e15a4dec2569f13c904730af6e8579652ede7c6582155a83d8b6df38f3ecc16b2a4086707b6575c46a1a48a8cff0eb95e3e4fd6ed368efdb52149
SSDEEP 12288:EUod1/YLplbJWQuseUBW/gISzdaFFyzn9qHgG48J:RlbJWQuseU+Szdavyz9qHgG4U
TLSH
T1DAD4F917AC4E253E59C0A349FA098FBBBF2E832CC26CE67D94DDD1341443F6891AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\pl.pak
Size 708KB
SHA256 dee5b710ca72425cd4d1236ce260f8d68b41bfdfceaeb2f98c8e89217b24208f
MD5 7a5ab308647d031a3cfa1311dfaa3ad3
SHA1 b7893bcb9951b554234f9b3fb60441617aae3661
SHA512 a5a25d3971f16ac49a20d8506a0a05de7253308cd5befdddfa232d9bbae9b5356e5c5ee02b69ce740440ab332c55f1b99c33bf327882e6b84377f294dfc7d673
SSDEEP 12288:cOQ2r1eDw9OjK4mZefQfuzSJabZ2bn6jP6CUdwe3m+UwDMSmG1Qh8PNRNGoliJSd:XJ5hwmX62DM81Qhnm
TLSH
T189F45B0E56E98A4E8CA008E6F6E70B7CBCDDC818F108D35FE45F4526719B19EC9BD584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\pt-BR.pak
Size 664KB
SHA256 38fee1950ec36b95160aee6a30e76653196afefad085274a77d47746a5255db1
MD5 aaa5ea52d747da7dbe13aaab45e3715e
SHA1 16da5490e69aa8a0c4a9137f9f8e650bef2a3cd5
SHA512 a61aa59e00329d0fde2f6c5950f2a58664af2bde792f9ecc443f96bef88e81e344c851adc7c5b340134455b6ee2ab496bf2dcb4b3afcbd6e9cb7bcd15a02cfdf
SSDEEP 6144:AMi21laMhCUVvRHMKMhvNBXBLWPV4NvyFEXEbL0oNNsRGU1pl:M2LvlVvNMKl4xEZjsR11H
TLSH
T13CE41B2E6ECA136605225350B74EEB43E5C90645FE0ACA87DCEF4F05A3DDE40D933AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\pt-PT.pak
Size 668KB
SHA256 8ef7b3105657e21db66cc07a41cb06addb859c788e0f038797c5d08cbef29eb8
MD5 fd4d1dedb40d35469e42710c37672f94
SHA1 1f52f783905d4dba605b58262e2a70f3139864ff
SHA512 999528eb5ef887dde31b13337c239897129fb695b7a2ef592703ecddee628684cc0a0a2e039c09111aa1f5728c53e7e7131a330d64a2fb8ec18602d3b8f31f2e
SSDEEP 6144:bqTinh9n2dW92pVNuMBieJVJJxhTIjPNaWfwgYnbioBcSRhI:byih9napOtYnbDcSRq
TLSH
T1D4E419296EDA136605135341770ADB03FAC85685F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\ro.pak
Size 693KB
SHA256 16b11fb73ea0c5d0336de453d3e2abd2de69b3e6c66dcd72bae318666525bb18
MD5 9b2ffd81518422f5377295885d980161
SHA1 23e2177172bb965b5faf4e4667ef000d5a60051f
SHA512 2426e87b53dd8c4d26d34aa4ff685449edbb2547c1f1ccb17e4ebb53e4372896748ec05bb89ccd7880cece4e176467b3e2c18c53694e93ee2e99e96a7ebd9525
SSDEEP 6144:1e0qK3JQ0EghDYnnfwT9o0PBciVgzD+NrF1tcAGLtOVmdO547HW2wsQo/Mr/j:1erKOVDnngo0PBhgD+VB3mw5OWsd/uj
TLSH
T1BFE42C23A1C41A972E5152B2F73924D3E88E105DF641E2CDA4EEC97910CDDDB852EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\ru.pak
Size 1.1MB
SHA256 03bd75e603d68c3a29a55f5887bc6d0b921f4365e266f25d579de8810953e823
MD5 e7c3b5ae73f5589272f022d0f371a275
SHA1 454c52d167c7e832983b4575c8c1316d0d7ff93e
SHA512 bd610ba115b3c960128a0cd18217dee2484a8d2abe87395e769e2495ec4cc8c6f0ae20bb080d4ed5e9c197c997c5607bfdf8436a6fd3f890dd8a1f9bc61d0ecb
SSDEEP 12288:VL/kZFfQeRo4Yegsp2zJ9sF+oa+UlZHO6HzW/ZqSv4sqCz6kE0LR3Q8Nirh2YH1C:VLkZmpoB/
TLSH
T1A8458760669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35219A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\sk.pak
Size 720KB
SHA256 c033373575cc83d84dff00116d504f7a66bdf7ae019c9d5c7c6907b2c808b662
MD5 8a8c7a9737e4ddbf8ebc70b79f8f5c44
SHA1 4e1cfa8d57808354e520df4981a739eed453fb42
SHA512 18cbab1992f7f9c922cb2015abe9ed5df69d65b5924143831974a58ce6322f342339bd62855a192aa192fa5868b5a7511ff79b06711af1cc55e9c35db56e6472
SSDEEP 12288:HqSr8kmKWjowk74V2AI9+bioNWTnjzYIng9pTjsxt9we:tdLN4VG+4Yzktae
TLSH
T14CF44D3FDFE7181E8E8D0148EFE57110FDBE8650864EB0A6944E374724E26ED8AB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\sl.pak
Size 690KB
SHA256 69fec14840de7543eccf21c8a77b7c6dfaa0d807b013d61a3fd408a22d20869f
MD5 c68bf6ec7e102421df63b1f4c0df24e0
SHA1 327a5f2ab53886acf3f74b373b31e7fe97aa7902
SHA512 da6d199c25843b4a4d3a6a22d4b73359f8b3f80b9b9fda705cb04e6a6bc72e85705a5f02fec37f8d89f65b3c8580c8c7c3b09d9097342c2a0cd966561e5e3227
SSDEEP 12288:slQs+kFT8cB2BynEltnWHDoiNi/fzoDKql/af:9eTNEltWHDhi/fzoDq
TLSH
T1EEE42B397EA74E0F0C9AA2CFFEA606007FDC044CD256E6A1EC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\sr.pak
Size 1.0MB
SHA256 ad0053df35e012ceebdee5db5d39526107cee2d5bce8696d129e782ceba41b66
MD5 9cf23dcc333c3cda3c0d0075e78440aa
SHA1 758c31988703238110baf32c7e1262d5795291f0
SHA512 d64684cae4b969630b86c6db4176fd6348e436857864a254fc9ac0d1f585dca2d00d298e9d9782176c8d619bcca48590bce04b422fc3cd78c641364a5d706a55
SSDEEP 12288:95rOow4nUZMFI83SS0dR3Ckdi4B/J1rpb6h5PCHxYX037XKue9/k/z:3OoX3RC+a
TLSH
T13F3546A19B9E64DB0501F41BD808BE493DAF41FE3FAB975211601DBD34E10B847BA39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\sv.pak
Size 615KB
SHA256 db66a75f740289e14a9e9c93085818cef7f3e006c4b9b66ea0e1d1fb1b353755
MD5 2f74877e1dbd32b5e08cdf0dc6085526
SHA1 46ac731222baba20a3018891f266fbf38edbba68
SHA512 8fc7b06136a0ed2690e53a6492b5c975c12c56f2d64163d2cc78b1187379f0d49bb1a770ead2afe956673f1938e69e33efe6af3dd1b2bd122c2838f2d4f5080c
SSDEEP 6144:x8AxMqKuOIi48viS/ZQ8lUJbcpjwdux+xzL8lGswiLOVRFcz5RtGmqeqMWkSMXty:CAKqWIizD/q6txyHipg9
TLSH
T18AD41B038A20F526FB72530DB609115B0AEDE25CE7F2954EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\sw.pak
Size 651KB
SHA256 114da3f568ab205c196cfe44908107929026fee9b28457f53f589f5397685793
MD5 663d01e13988320ba94c7f3750c7b747
SHA1 7547b64633b11ab301bca940b79ec9a87fa39fab
SHA512 6a1345c00b20374d39666fe054d38eb2070ea79ad134c96c993f96f352cfec8f54d3e3038a233c6c186088c2598cf4e86e7a2f144988a3622a6c5ef594d2c857
SSDEEP 12288:c55pYft7byxGH2qDOKd9zGILd5NmedqNGjRdpiayX1jt3hFinSLThYFaKI3z9i98:c5IfNFFYiL8T
TLSH
T126E4D5629C71D1191222618503DDFF332BDCED5C693B2DA35A46BF0F218F88C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\ta.pak
Size 1.6MB
SHA256 2c5f8aaf21c9a035f71d763cfa9a20886892fcde7cf71878168a9df0faa6d417
MD5 db51dae96bd76c432ed4c0328bae8378
SHA1 93ca9f691f6949015c3cf8983d5df0c93dd173a6
SHA512 359e9c9da19a15320c37523aa6c4b5f1ffb03f62ac56e1f9bfb5c26dc0b7cc2bed32f55bbdb0c776281bb77cd07bbe1c500be0cac08c69d9344ce536747ef936
SSDEEP 6144:i0JoYKj15Y0ykwuiGP2wqdtRAwtm1vYpiMyx:ZmY01aaiGXqPtm1vYpiMyx
TLSH
T11C850CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\te.pak
Size 1.5MB
SHA256 30de9d8e6eaa7c418b15065d6e4b1e5066f81d2b10ba09305270a463a55e6105
MD5 d36a7c11713bc3c4fef00caf248f44c2
SHA1 7517b17d62a6fbdafcbd765518e294def6835616
SHA512 97be6a9a5b62c094a9e4c58428825690716d74ee90541fb4ed9756bae0504597383d3fd23580fc9bc267a3629c788b6acf0be42c172d7ace89edb755e7b038d3
SSDEEP 12288:oCTkU7MZKN/ywG6USF602/LDgIC8ymoQRT5qbDM52CMYRWOB6ym3p1FW1OhEaC/7:dTkBescRq
TLSH
T12B7592023A6AD310DBE60273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\th.pak
Size 1.3MB
SHA256 0684a30ec9e0fe9baeeb215840b6c6b4f04e11c9afbcf9d18687af9a685e0927
MD5 1a6240fb935bb399527b5eb98b26c285
SHA1 686ac2b2fedef38c98255decf1213e1c1f2f9894
SHA512 0b1d6ae59b3a08bf6eeaae801f87d4cb72c43dc670da36add0ef44b671df63b6c0db3fac70162f9d7d5e57c983652986379d1ec10ad2dd50cf9892d13ddf891d
SSDEEP 12288:ZNJ3gnv/N9LyZYAhzYL6Lys6o6hCQskJUseOPsO5eXwpbDFDS6Sud2mKHlojghv8:b+bnsO
TLSH
T1AA554CB37247DDD479441B5B262A7789672DAE693F73F8E000C9215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\tr.pak
Size 663KB
SHA256 e427e99465f1fb5e6628868f550d845db79379ed4cd58994d2e5ea3b1881ee6b
MD5 b94ff33be5b2698f2b86bb4292d11cb5
SHA1 6e65e104f6794713473aa82c942bfeb631e42852
SHA512 df6de80d52a6b3aae0c705d1edeee0b34042111fb1dc2260113066b57b83975f636fd6c175df478de86b841b24d371297fc06492115ce211a441d0f42bfc73f0
SSDEEP 12288:qXZSejMg449otgVCD6Hz6sgwhqfZF4MwkN9epd4+R:sR4Lh9PN9q4+R
TLSH
T12FE4E98178EF282C8BB9278BD6E94666F89F0766B331F446DB168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 1fafb514e4380b430b19b9031b30249e93aaecd71109b125e5b6d99c2be60b43
MD5 7f68531e18eed19e11dcd086ef0fad64
SHA1 983daa2fee351a8fea6bc8595f00fe531e7a2242
SHA512 f1e268b8161b3f52e6061480c33a6961a0bc162d8ca2cd289c32af1cb55b8edc6e8f24ef9fec33a7e71ac9396e904fdb19363c127cc9677953308677ab7defdb
SSDEEP 12288:lc7S9JSlH+QKjbCI5wkO16UgBRrsSr+UznS7BNb7eBPSlMXKNnEUA6QzAz8Pi6N2:ys68PG
TLSH
T1E545A9A1AAAD54DF0105F05BE94C7A0D7DA740FE7FA7471625A43DBF28F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\ur.pak
Size 997KB
SHA256 0c1cfa61d9a9be6338b0a160b43ff362a982003053ae5be3b3ec867e78374d7b
MD5 6cf3c36a589dd5dbfc00b19cd96ddae4
SHA1 2f35469dfa15eefcce47f35231b4c19b0ca5beec
SHA512 8eab2e970a05171d3acf514566bd5183155dd6bf59dd26d4a909deec18bd67d4bf9e375c85608233879ca8bcfeca93b5cf7daa8447dd53b151c465b5162b8f3f
SSDEEP 12288:KYuEnE4YoPL8P5yzqtdQeMnyyK32By98qsE8dGZOv5dQYr4KYjwadcJKwUlubcoF:duEnBLGcb
TLSH
T1F82500D2E6B896B35A21D92780D33C34CB735F13D34AF281E96246C54E9A0135F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\vi.pak
Size 789KB
SHA256 bb7d0d58e3807d102b25cfbf3aa951bbe529f956e06a2f943e205f610d1a891a
MD5 9fe8db6b02aa8cb6480826d754d2ffce
SHA1 dcbc1ca0e28a7db4687127d2e65a78f04eb65e9f
SHA512 b1c740fa49e21d68f1ed46135b67c870e732e667887cdd217a0fc4e2fafaa983bf327a18777197c2403628c8d5863ee82045b169f5247b96301f6695e6027d41
SSDEEP 24576:T11s+ce5Vg0LMuoVbE7KHJlFtiZGfoq1ljP:nXotiiT1ljP
TLSH
T1CF05855216E1302680AC553EC6CD540D6FCAE42FF7C18FE56FF429787A221A45F21BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\zh-CN.pak
Size 564KB
SHA256 157222d970a2cf1d51a63860bffb6d71f0a6161472a6f3eca3b08fe681ef075c
MD5 8625ed1e0b9a0090823d604860473a44
SHA1 c7a0751d0b580e54989e30daf62de4f8bc4d9e32
SHA512 d40ad1f698d9a89b133332abe371a68b84f3da4c38bb40852e78902cfe551898af5d5905a2544931899d9a90f4c5037870578d5002e6640dd05446d9c1c005ab
SSDEEP 6144:+bi4uqprQ1uhqT97cDc+QmYnE7MpUckcojddwTQZyzU4YoDMe2ZHtNKEglu:+bNlQcqN+QnnBpUckco52Uk1YoDMtHPH
TLSH
T13FC47CA820F9BDEC004650E03729613D7C40764BF667AF366ED248ED1AA6FAD0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\locales\zh-TW.pak
Size 556KB
SHA256 37d183b679fe4a5a0a204ac3b8e5f3e0110e99a784ed0e20ea2eced574142b8f
MD5 0fa6ddef5c193bf5a2301f1c00874be5
SHA1 aa21ef62a54ba1073b8f403fde44498ad0412c3e
SHA512 990c03379a3c84e732d83c2c3ee079d6f46da5a945accc6baed2c7ce8003e1f8513ecec22980911c124f8636d123972d418b17e8dd69f3e71a6f08d40b7285ef
SSDEEP 6144:gqgFSAGtrlVLNCyODEYuVJoOk6a2iu4oryn8w7HLD5O9B2aUmzTq:cGtrlBYlOPiory8w7HGwH
TLSH
T1B3C46CB618FBDBEF0901F484B7CD513ABC8B382DDE377636FC851C982E6AA5409A1145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\resources.pak
Size 6.6MB
SHA256 74c4be8feca65976312f9ddd6ed8f06b669f6a551c91c9b67f9dc76d84e7e97b
MD5 918b877465c1089d08dbb671c76a6ca6
SHA1 76a7b9ef9b58bcc5ac4f20133d2df9293551bbdb
SHA512 41c5d734200bdc276b6a7410bc4b5eed23babcb88f4095696c3049e6885efe7766a9066ea8e3f48249f6588a81d78d67875bc5849e479e2dd5363bcb26b60ffa
SSDEEP 196608:AsBRgrfB5GE3u4bkriACmZnC3gEL34tYrW:fTI6AkrDntEoYrW
TLSH
T1376633D267D2A81FCD80677A85488F35599C6E2535D0B1A3448D6129EEACFAC0FC0B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AscensionClientServices.exe

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\resources\AscensionClientServices.exe
Size 14.2MB
SHA256 ef8b2b3f75e43a2c076de1a9944d02ee0eb64db531efbda5877542d34a7d9b3d
MD5 8a0c6b7930696a70ba30a6ed6e7262e6
SHA1 cc88c0b69fb352b89577164140d245974053e6b7
SHA512 3dd3595e659edf8a8f5c2b9ec9466c060093216226677b259ef81e5e133fff1fa605b10884dcc02244e1e7b24e6a453ae0537c697a871940344680479392b8a1
SSDEEP 98304:guc7oAjvEBwoK+uYRUztzz6lENNlU5qnGmw34iAzKAIGLEHPydLoQ6+ZQp+9puZi:fcUuk5roMH4LoQ6wkMk5I
TLSH
T126E64B13F6A291E8C16AC074835A6233FB727849073476EB5BE08B213F66F906B3D755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\resources\app-icon.ico
Size 352KB
SHA256 61cab518e76cb62e2af16b01e793d530424e77f86037a4a1ab5a02b2dc31526c
MD5 ba6f897fce274f0edc2d0d20bc122227
SHA1 fb3589f4f54e87844a0ef9c3b85d125820e19254
SHA512 38741db8a832e5eb9953ebc8caa5520a39e9edcb248e38e74767de9e9005ab13144a07de41c44ca161d62861efe20ed1a760b4d7d0466df09140d2f3897994e4
SSDEEP 6144:rKzOSrg2xR+YZnC0LgZGg2kK8Dhk7gDXXW8OSPBLJZvQWU:0dgw+YZnCYg0zgzWwBLfU
TLSH
T1EA749D60366ADD46D28277F9C598F3F1049E4F80E91286938571BD9BFB38C4BED50A8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\resources\app-update.yml
Size 117B
SHA256 d69dbe6c2847b6426d9786d720791701191ca852fc49b02b0f45156cd6cbb65f
MD5 de6ef18eacc1e89d0c875c307262910e
SHA1 d611ac7ca237b7f8217b41181a730ba73fb43426
SHA512 960a3a63966caec1607dd9898e5038c76e8ffda8a5930893e325ae85de49ed587cab6e51f0e451e07a6083395eb7d2fa15a5459960875dab35a789232b40638f
TLSH
T1B2B01271C341C113637509A9FECF9A30E2BF538CF243847BC0D65025811BA415E5B09C
MD5 SHA1 SHA512 TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\resources\app.asar
Size 14.6MB
SHA256 c6cd21f4f4588c0a6b90e0eae6284f1f919ab88bee665dc989f6872e2c3f4ce7
MD5 de35fbe997c0945b1cdce3f6ae5310ee
SHA1 944545a89d85af2b1a1ee352e2fb1e687c47c85c
SHA512 1f5f2423c2aef30af0cb110c8d1ca81b4bb44f0010f87d7d6629b654174b1c22b08f66d3a8f8f856f163734741374fee7ec507551d1e9738e8e37f8342c933ae
SSDEEP 196608:4fU1WXNNEE7SHq86dFmHthkUBqnb1Vmn5O6o7BmxXsI9gcDY:D1EEEgZ6mLW4n5O6YBmNsI9L8
TLSH
T1A6F6D0427394D637CE6703F581BF620F773708443F0BC30AA5AD87292D62BEA8D9A955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ascension-client-services.node

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\resources\native\ascension-client-services.node
Size 3.2MB
SHA256 4b18a26d1fc7001f4a16c3de8c1818af9ca3d6617c517925eacc001856213cd0
MD5 a621babac60a424c4fa98760cba113c5
SHA1 8d998ba3e20e778665e78309d777aa3a0764f554
SHA512 bc66099fd1e92b0172149e45db9eb682db5fe4528b8d6777b15ba2efe403505689ef5c9b9b4bcc28931ebf20a847631e467cfd5b611424bc2b7d82cf191a1729
SSDEEP 49152:a7L6QqfYk72M/x+OA86nsJ2fxTd3JdiJUAiA:qKYKRJ+I8JZ5diJU
TLSH
T14AE56CE320C166DDD566C57E4353FD3FCA8FB8394626A8FB9050E3226D16C463629F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\snapshot_blob.bin
Size 338KB
SHA256 df9a17d5d9929ec6eff408acb080ecd0f2a3a6f4b093a760ef962ec47ae91946
MD5 3c5d6f64b57e1c9e4673f2a7ed03163f
SHA1 482cb796847779c113702c2a56f2a9d844c8f1ce
SHA512 16095e228f8daa59e6afe259f601bc9c3fe0c8c82a43c1819d02fdde126b9b395588ec9fd6aa647d69098ebbbe095fb2cd87677de84aa606c3329dd7b06b84ba
SSDEEP 3072:7uOiXK9Ot+xbRt2FJRkl7jOLPCayN/4+No+upE5HchGv3U/P0cA/9:7u5Xzt+HwQPM3e/fNo1icwsP0Pl
TLSH
T1D774EF12F749CA26C8B635745EF98B942E24B2CD9D89AF573020437DB4796640E2F38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\v8_context_snapshot.bin
Size 704KB
SHA256 a04efc1404d85595fb2c9c00268f6d49aee41cb63897ecb9ce5408a68dbb041f
MD5 c3d05cf39d1bc037f972f75244b4c04b
SHA1 7f450d2b750cf55dfbae7a6a62190800aa10e6b4
SHA512 049967ee513c026c83c43f157441bc7fc686c41303e3bf42998b4f21a2f0be2e3e8593e617d3e8a3e5614f6162002a1f40b65792fc5c13e35f2ea9662be463a9
SSDEEP 12288:D15XrgG4nwB2NdOeP8POqYUdEMH+jURWYS:D1n6C4H8POqYkEMH+AtS
TLSH
T19AE49676FB0ACA26C8657A7D8DE74B063A34B2DD8EC6EB077011937CB4B86544D1E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\vk_swiftshader.dll
Size 5.4MB
SHA256 6be6d3b872a55209e842aae41584d409db3596c72911356fddffc405c3754887
MD5 9bc747deb179c99a3bbb5eff99ec15b9
SHA1 22e8a4ce4ecc39276f2f4a62f4242eb390dfc8f6
SHA512 c136a564ba3e900521e4caceb6ded4889a0b3603ff65b5aac611dd78b246baea3652c5bd1396636ac338695547803cc2deb7ce08d2b42f9be753939bbc5fc8c4
SSDEEP 49152:YixHPC/InMj5kgotyssEw/Ga8irpnhQMjQbw9mhBljAAV+afo81gP8XCEQdtXDxP:LxHPdNPnyFslWgr+DXuEJ
TLSH
T17A463803F28681E9C06DE579875FA623F631F8850B2276DF56A00F192E66FE06B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\7z-out\vulkan-1.dll
Size 932KB
SHA256 1c01a7dc24b5b6b9cb88026adbdf5e99551e091fbdd9d552e6d472d2692a6aa5
MD5 183fbc4aaa5d5c59b444698d56ff4d58
SHA1 cbe4b01593e726f39f6ccf9c7c3a408fea82ae41
SHA512 a4b2daa3bbb758f28ab2f9b1a8c6d5b6532f4aea79fb3e18b5e121e1608ebd90dc739c84ab996d11c1e780c4cc7b5d91c3b9166bffb35cd995b278a29d79f407
SSDEEP 24576:9g7xfpW1F35jjly/ux7te3MDSozK6Z5WzcxDYsHkDE6g3P0zAk76oOHbRK:iFCh5jjU36SozK6Z5WzcxDYsHkDE6g3c
TLSH
T1BC157E22DA948A69D676C074D8D18A038AB074811712B9CF07B81714BF6FFF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX_20190310.exe

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\DirectX_20190310.exe
Size 6.6MB
SHA256 feb83edebe4f9776a1c3d1e679e13bbc9be48b4e0f676c54a86ab733ceefaea0
MD5 bf030940dd820ed9f8b9a382746c6ce0
SHA1 4e10a0c8b0ecfa2db08d121b3b110d803cfe359e
SHA512 afede7ff3e2c87913177c41c967034f1205709e7ef39b307f0db6f5c9923be25f0fde75f0510fc28729744f3d1ab31a82528eef42a514a09652f16c865dbd215
SSDEEP 196608:Sgm2Vre/HWcnhd9mi1PrLXQVdq1qj+ZtwZdO/3f+Hy:SgTY/HVDRPHgsqqZtqM/3f9
TLSH
T1F9663343EBC3863DC35126365247968104BF23A31B79A8DF57A91A1B3E2038E537B75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX_9_SDK_Install.exe

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\DirectX_9_SDK_Install.exe
Size 15.5MB
SHA256 4414efaf78c592ce41cb1995da0ba2f50c129d5a88b5823381d26b0314d2e785
MD5 e990d6f537e62e0222e33bc68a853785
SHA1 c2b7b5c5daad384c9dcfb5b953e0db658c7ca0c0
SHA512 27d942abe690cffe0e3ac5eb249640ce2a50fe6f5135426e2fc5083e864289b4da8715b8c29350966c8f30ef8ec7ab315ae9c7cfdf9250bfe802aa15de194d61
SSDEEP 393216:gg47JpNg7MoZjhlgve65QCJEnPIR38AvC8Cw4qtUYvRpjyE8VShwDtiPeHoGV66:+QZwvX54PE8iC0DzjyLVShnPaoGQ6
TLSH
T1A6F6339570FA9DA9CC8369388089B363D8F2FB8FAF14C6D771409E604D181DF9B35A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\modern-wizard.bmp
Size 150KB
SHA256 9f6f3b9c6eb1295c5ca067f0d95a5bb46743de2736ef970b65f22c17e9038de2
MD5 a3b37963653a0d575cdeecd5d23869b8
SHA1 28100fd72efd6efb34df1637b5cb42a32b0a04e7
SHA512 68bb1de7a253bdaef7b5a97b1137f32dbd3c3ec5e2a788a4c44b93368eb1b8b857303a9d68e7ef1a8073c6d3c2befe2e9cfb77d0123aa505d7bf78d41ebfc498
SSDEEP 3072:Vg3yDaLY9X2Jszap3RLeuL8Ud7XTO0MBEbZw8mDMHrsIlPh2P:VgcGJPBpIgLS0MBRDMHL4P
TLSH
T10BE3CFD992100E978E781D322B44F4DD336A6F13B6848B964F2CB69D53F2FA116D4E83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD691.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.acl

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acl
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

8111b9d0-fce4-4f7e-8c30-f99beb36a77a.tmp

Path C:\Users\Admin\AppData\Roaming\projectascension\Code Cache\js\index-dir\8111b9d0-fce4-4f7e-8c30-f99beb36a77a.tmp
Size 48B
SHA256 53aec55d9c8b33e3a8c4861862764e3d56253275dbe853787b9b86f8e683d3b2
MD5 9f385823c9af9adb38049d7e133bca19
SHA1 339f3933c734e2e911957942e6757ae5524d2b12
SHA512 7cf81360b5c7356114edec099eb9d3a8dd95b7a8bca47116862906889052ac669382d18890430f7ff203666fff8fb7f472b69dd3f749af25b9d8b09071f60e68
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\projectascension\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 75ab90fb87b0b5ea8265c699d635bec51595aefc363b9ccd8d1162a83499f8fd
MD5 232d6f3e3be657becad41608bed5d9e4
SHA1 2a1e6a5aef990d92379dfa9520188aa2015895de
SHA512 7b9b5cf7ebc764734bac5b498dbab395fabf8d3213f12d9415261e8f7f72157a621023567ea432ccd04f7adf3e872d98a101568fce5611e79e25cef2aea25b00
TLSH
T1F801FA84835C900CCFBB0D7BA1D57F20B5B07AB81717EE036C4247BA2A00F4E6C4249C
MD5 SHA1 SHA512 TLSH

Submit Download

15623767-6133-4e6e-a61e-743c50cd305a.tmp

Path C:\Users\Admin\AppData\Roaming\projectascension\Network\15623767-6133-4e6e-a61e-743c50cd305a.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\projectascension\Network\Network Persistent State
Size 270B
SHA256 1e4199ead17936cec19158195318c386a3f1dd0a80625a92933dee81f842ee17
MD5 9a1ea2894e7824f9e2fb2e5d669b769f
SHA1 cdc35ccb6d6a3a72070adde9a7f93f441ce4a70e
SHA512 dcc703361cefb771e942aa54fb1e34d9f6c0cf1dcaee8a80c8970e03060d2988b256d6df546c01a9b3caae445f1fc10b86753d95bfd3390d5577087637322172
TLSH
T11ED02BF68B7419FF4321C3F04D146E23C6FE0005134C9C678594BB1E47725B9540054B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\projectascension\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\projectascension\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

ffae3d47-7eb7-4ae4-88d3-f81aca816d02.tmp

Path C:\Users\Admin\AppData\Roaming\projectascension\ffae3d47-7eb7-4ae4-88d3-f81aca816d02.tmp
Size 122B
SHA256 de7fa14d82f1ebdad82cde28b58b7023743bf35f56d9c123fff99260aaef1861
MD5 7308eaac2d9e2ea2dbc5431e6aab4c16
SHA1 02eba210816166f807c5d124361a4ed5e8c0e216
SHA512 51c90070b80119ace95f602670836ebaa0149dc95ae284abfc3559c3806f99a3251e78c4d82da5fea1909c233da9207de3b89a30065f458976fb8e04480329f7
TLSH
T1D9B09256283178B24E9FAA36800E786A98B500209E07195686D83689893B51E0897A4A
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Roaming\projectascension\sentry\scope_v3.json
Size 23KB
SHA256 d1013bd504961f8117ebc79cdaae4d6f6ba663e09f06febd70cd741751f25174
MD5 21f212f56d999285af0ae2d80abc1635
SHA1 c3ef7ffc92e3a17d835e412ba9f6d796e2c360a9
SHA512 139a02e2de127793de35f4de4eff1a756f71740037f0b5848a9f69cc393247fe3bb6467f4e06e3a0e027ea44b5a7e7a41f6ae91f553390c6519276e56cc6dca8
SSDEEP 384:kWKWtWGWAGWJK2LWCW4Wc3eWNLuji07Ra07uFlF:kWKWtWGWbWcMWCW4WcOWNLKR7Rp7uF
TLSH
T18CB240516EA8BC3D6EF6F39C85C51D15C2B6B101EA8C2C874EB0E938982E5E5310C97F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 48KB
SHA256 76566bf1d31ebaf2a310461a279a306f0fb77e54152bfddb7e08819497761cb7
MD5 dbef4ff38a9e6df867f44d87fb0a83dd
SHA1 a1b428bda69b62bee07f626cb3e20b007efddc62
SHA512 1358b87aa5a486f9ca017957f7845bcc9667c51353a5aa2aab7f04f381a44438d1ea745734dd3253794c1061610b497cce3db48105d5c7d361a6b35be516fa5b
SSDEEP 96:Dmn+mSVuzWyF3pGGB/qwYDzvYIPCFIjm58SVJJ4DXbHHcUllZCvDPYPIQzZFQzpd:DmnLjDEA8EPJsXy
TLSH
T119238ADDB89DD8B4F819104D63871DC1700E126349B61238A79EC3EEFA29756885F3BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 17KB
SHA256 8ed2c6ec1fcc04d5bb4be9a1222e4a26f6b7e31de3c908317837bc438c415774
MD5 6be5787f1926e6c39af4367e68889522
SHA1 67103073f602d6e6b7203cca6014a50f2d39bb80
SHA512 f73e926b7611b787f5841f143c737ed2ed32d174f4935fe8ba25bf736522a2074bfbdafa6e3969ab54f524d7cc792a95c64b69f3683e62c528e3857a2a9eaf80
SSDEEP 96:Dmn+mSVuzWyF3pGGB/qwYDzvYIPCFIjm58SVJJ4DXbHHcUllZCvDPYPIQzZFQzpM:DmnLjDET
TLSH
T1B38247DD689DE8F5F818544D63476CC2740E22638976123CD38EC2EEB698B16885F3BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAudio2_2.dll

Path C:\Windows\SysWOW64\XAudio2_2.dll
Size 497KB
SHA256 9c7897b4ee1bcd190b1c0b7b77e64ee731d234764683a1e2286af70d86b62753
MD5 50f4a0d5e6a0bafefa78f353533b8e06
SHA1 d370434eea3a557ed77b2363dfac720a5ed98666
SHA512 7686b893996b76a25ca7da971ca3a10400dcc682a05e8317a9d159a9317537de0bc20dfdef643e85e6ee548d7893138497fc156f77534124a8eb3e3ce47f0cb0
SSDEEP 12288:Pt6JzrSlO3i8zRHaoJQ4obpFNbntcgR0jNg5:P6rtnJQ4oxbnqgRl5
TLSH
T1FAB43A12B1528275C9F722F184AE333B2738C78557451AD713E899F9AED22E03FB05DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-3046-0x00007FF9028B0000-0x00007FF902BE0000-memory.dmp

Download

memory/3008-3155-0x00007FF923C30000-0x00007FF923C31000-memory.dmp

Download

memory/3008-3156-0x00007FF924A90000-0x00007FF924A91000-memory.dmp

Download

memory/3016-68-0x0000000007980000-0x0000000007991000-memory.dmp

Download

memory/3016-64-0x000000006F850000-0x000000006F89C000-memory.dmp

Download

memory/3016-67-0x0000000007A20000-0x0000000007AB6000-memory.dmp

Download

memory/4592-41-0x0000000007450000-0x0000000007486000-memory.dmp

Download

memory/4592-55-0x000000006F9B0000-0x000000006FD0B000-memory.dmp

Download

memory/4592-33-0x0000000005E20000-0x0000000005E42000-memory.dmp

Download

memory/4592-32-0x0000000072E90000-0x000000007364C000-memory.dmp

Download

memory/4592-31-0x00000000056A0000-0x0000000005CEA000-memory.dmp

Download

memory/4592-30-0x0000000072E90000-0x000000007364C000-memory.dmp

Download

memory/4592-29-0x0000000004FC0000-0x0000000004FF6000-memory.dmp

Download

memory/4592-28-0x0000000072EA2000-0x0000000072EA3000-memory.dmp

Download

memory/4592-40-0x00000000064E0000-0x000000000652C000-memory.dmp

Download

memory/4592-43-0x0000000072E90000-0x000000007364C000-memory.dmp

Download

memory/4592-39-0x0000000006490000-0x00000000064AE000-memory.dmp

Download

memory/4592-42-0x000000006F850000-0x000000006F89C000-memory.dmp

Download

memory/4592-35-0x0000000005F30000-0x0000000005F96000-memory.dmp

Download

memory/4592-48-0x0000000072E90000-0x000000007364C000-memory.dmp

Download

memory/4592-46-0x0000000007490000-0x00000000074B0000-memory.dmp

Download

memory/4592-49-0x0000000072E90000-0x000000007364C000-memory.dmp

Download

memory/4592-50-0x0000000007E80000-0x00000000084FC000-memory.dmp

Download

memory/4592-51-0x0000000007800000-0x000000000781A000-memory.dmp

Download

memory/4592-52-0x0000000007870000-0x000000000787A000-memory.dmp

Download

memory/4592-53-0x0000000007A10000-0x0000000007A3A000-memory.dmp

Download

memory/4592-54-0x0000000007A40000-0x0000000007A64000-memory.dmp

Download

memory/4592-47-0x0000000007750000-0x00000000077F3000-memory.dmp

Download

memory/4592-57-0x0000000072E90000-0x000000007364C000-memory.dmp

Download

memory/4592-34-0x0000000005EC0000-0x0000000005F26000-memory.dmp

Download

memory/4592-38-0x00000000060F0000-0x000000000644B000-memory.dmp

Download