eaa2705f2a1443208de13fd33f45efd51e65fd376f2b7c6c86ad7ce83fcd0199

Analysis

max time kernel
299s
max time network
308s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Go-Live-Setup-1.0.2.exe
Size 91.6MB
Sample260916-2xa9mstybt
SHA256 eaa2705f2a1443208de13fd33f45efd51e65fd376f2b7c6c86ad7ce83fcd0199
MD5 7af4669f827ec67ef04fa2842883d0b8
SHA1 7ee1cdc9d940863370ad805d38ca570d6261a66f
SHA512 6b49981d680cc773a932017b186ed9fc5d2cc49eda88678d29494d0efe51459003d28f7cd418ae28313354dc103f976eaa626921f440b25b9ffa3920fab10261
SSDEEP 1572864:DKAuEstwfGit65jHFqCg3b1arQR+023wbwzCP01+c1VsldCcGkeDxixHPXm:DKAuEsQGHjHWb1arn02AbXP01+cUlEJJ
TLSH
T18B28338F58212019C3DA5EBA49FBA2B2244EF1E6955CB31FE1D994D130C58F579FC283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Go Live.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Go Live.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Go Live.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Go Live.exe

Executes dropped EXE 10 IoCs

pid	Process
3636	Go Live.exe
5024	Go Live.exe
4644	Go Live.exe
1940	Go Live.exe
4948	Go Live.exe
4440	Go Live.exe
3836	Go Live.exe
2012	Go Live.exe
4944	Go Live.exe
3084	Go Live.exe

Loads dropped DLL 22 IoCs

pid	Process
628	Go-Live-Setup-1.0.2.exe
628	Go-Live-Setup-1.0.2.exe
628	Go-Live-Setup-1.0.2.exe
628	Go-Live-Setup-1.0.2.exe
628	Go-Live-Setup-1.0.2.exe
628	Go-Live-Setup-1.0.2.exe
628	Go-Live-Setup-1.0.2.exe
628	Go-Live-Setup-1.0.2.exe
628	Go-Live-Setup-1.0.2.exe
628	Go-Live-Setup-1.0.2.exe
5024	Go Live.exe
5024	Go Live.exe
5024	Go Live.exe
5024	Go Live.exe
5024	Go Live.exe
5024	Go Live.exe
5024	Go Live.exe
1940	Go Live.exe
4944	Go Live.exe
3084	Go Live.exe
3084	Go Live.exe
3084	Go Live.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\me.nemtudo.golive = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Go Live\\Go Live.exe\" --golive-hidden"	Go Live.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1860	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Go-Live-Setup-1.0.2.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Go Live.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Go Live.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Go Live.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Go Live.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\golive\URL Protocol	Go Live.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\golive\ = "URL:golive"	Go Live.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\golive\shell\open\command	Go Live.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\golive\shell	Go Live.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\golive\shell\open	Go Live.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\golive\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Go Live\\Go Live.exe\" \"%1\""	Go Live.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\golive	Go Live.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
628	Go-Live-Setup-1.0.2.exe
628	Go-Live-Setup-1.0.2.exe
1860	tasklist.exe
1860	tasklist.exe
3084	Go Live.exe
3084	Go Live.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	tasklist.exe
Token: SeSecurityPrivilege	628	Go-Live-Setup-1.0.2.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe
Token: SeShutdownPrivilege	3636	Go Live.exe
Token: SeCreatePagefilePrivilege	3636	Go Live.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe
3636	Go Live.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1312	628	Go-Live-Setup-1.0.2.exe	84
PID 1312 wrote to memory of 1860	1312	cmd.exe	86
PID 1312 wrote to memory of 1124	1312	cmd.exe	87
PID 3636 wrote to memory of 5024	3636	Go Live.exe	92
PID 3636 wrote to memory of 5024	3636	Go Live.exe	92
PID 3636 wrote to memory of 4644	3636	Go Live.exe	93
PID 3636 wrote to memory of 1940	3636	Go Live.exe	94
PID 3636 wrote to memory of 1940	3636	Go Live.exe	94
PID 4948 wrote to memory of 4440	4948	Go Live.exe	97
PID 4948 wrote to memory of 3836	4948	Go Live.exe	98
PID 4948 wrote to memory of 3836	4948	Go Live.exe	98
PID 3636 wrote to memory of 2012	3636	Go Live.exe	99
PID 3636 wrote to memory of 2012	3636	Go Live.exe	99
PID 3636 wrote to memory of 4944	3636	Go Live.exe	100
PID 3636 wrote to memory of 4944	3636	Go Live.exe	100
PID 3636 wrote to memory of 3084	3636	Go Live.exe	111

C:\Users\Admin\AppData\Local\Temp\Go-Live-Setup-1.0.2.exe
"C:\Users\Admin\AppData\Local\Temp\Go-Live-Setup-1.0.2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Go Live.exe" /FO csv | "C:\Windows\system32\find.exe" "Go Live.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Go Live.exe" /FO csv
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "Go Live.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1124

C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe
"C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe
  "C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1780,i,7090270824110207072,10107670005466132924,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5024
- C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe
  "C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --field-trial-handle=1780,i,7090270824110207072,10107670005466132924,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe
  "C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --app-user-model-id=me.nemtudo.golive --app-path="C:\Users\Admin\AppData\Local\Programs\Go Live\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1789599079081874 --launch-time-ticks=595948822 --field-trial-handle=1780,i,7090270824110207072,10107670005466132924,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2576 --golive-version=1.0.2 --golive-system-audio-exclusion /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1940
- C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe
  "C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --app-user-model-id=me.nemtudo.golive --app-path="C:\Users\Admin\AppData\Local\Programs\Go Live\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1789599079081874 --launch-time-ticks=604965796 --field-trial-handle=1780,i,7090270824110207072,10107670005466132924,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3664 --golive-version=1.0.2 --golive-system-audio-exclusion /prefetch:1
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe
  "C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --app-user-model-id=me.nemtudo.golive --app-path="C:\Users\Admin\AppData\Local\Programs\Go Live\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1789599079081874 --launch-time-ticks=605042348 --field-trial-handle=1780,i,7090270824110207072,10107670005466132924,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3672 --golive-version=1.0.2 --golive-system-audio-exclusion /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4944
- C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe
  "C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1780,i,7090270824110207072,10107670005466132924,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3084

C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe
"C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe" --golive-hidden
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe
  "C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --field-trial-handle=1764,i,8575523954489607196,4339110118511755151,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe
  "C:\Users\Admin\AppData\Local\Programs\Go Live\Go Live.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1764,i,8575523954489607196,4339110118511755151,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Go Live\chrome_100_percent.pak
Size 163KB
SHA256 0d27d5591c72721ce399133e104114aa802caf3070814570ad205987a51a8ff7
MD5 5020d2dd753982c72f6a0ce6e672c4f2
SHA1 d8130a00ddf7126e2cf0c4b4c5c63a6f557013cc
SHA512 434e9b34105186d9b673d12eafa1fd03981920493612ed2124fa4a643bd568a2cf81d4d2c80b43854b03c11699fa139852224f25662178a9b2a0d3049fb927ae
SSDEEP 3072:d4PisCv+/P9NebGz8LI1TwuLjQBHe7YAP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:+YWFUbGz8LI1TnjQBQ5K18Gb0OV8ld0Q
TLSH
T13EF3E0D3B3F4ED7DCA974AB793560171ECB30B2D0792124A5A8AE4752536B88D8D83C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\LICENSES.chromium.html
Size 14.5MB
SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
MD5 b5e57572cfb5efa08f55f46772a42ded
SHA1 51db84dada057af72e2fb8acca3ee4436e4bd3ed
SHA512 288bcbf48f928866a0d2910fe57cfbc040f23b533bbdf4ef6fa43631edf6035d689ea41643b3afe833cb7476ecb2fbb932f137f3734df8462898c4837f6096eb
SSDEEP 24576:6eBHJjZ6vobjZ6Mt3jK6DCHwR2auHxKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61J:6er8aeUSn8mMRx5
TLSH
T184E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\chrome_200_percent.pak
Size 252KB
SHA256 fa1fce57396b3e21776659e50fb1c12fd4c010c9f56f161be6f4437207d21241
MD5 239e222da07ff7603b06d27e150723fb
SHA1 843a373fe4d1f770e497586fb84c292dfe40f0f9
SHA512 c87f9f5586d6b35b451fe8ecbefb7ed88ab110a6dc40feb05f4c3d9363eeeeec1c8e6e08cb8c62eabc4c9c7f2feca41f31fe86c225cf44bcb68865dcc4db9ab2
SSDEEP 6144:uGQ+N6uSZQDQYakvyAkcjQBQugx5GMRejnbdZnVE6Yoppx4:uQN6uS/fkvyAkcjKQa6edhVELoXx4
TLSH
T1F044F1D773B8AD3DC9670AB3A22600F1FDB611290AB2115A569FDC397955EC888CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
MD5 1a7544f942a9a9de9354e7a0f9060e3a
SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
TLSH
T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\dxcompiler.dll
Size 24.7MB
SHA256 d8a6ff71c310c934cc859e3e9b1a2c34b0f38253bdc258c1476cbd9ccb633e37
MD5 da07043f07a01969dc66b66e2c9021c6
SHA1 84f4012019684aeeee29355f64d2bbec6ce47d41
SHA512 aff96ee5a79b0156677938f8e01495fe1c37f92bf272c33ecfc5c889226d94ecc0be007f76440f05084874a5c4c42549fa6825f9865da50da942d7e6639ae959
SSDEEP 393216:epLjH68inXc/GE+HiCt+2xwuQbgjvMCWT:yHiEFapwuNW
TLSH
T1684719122646D49DF059C878C3678716CA6C34EB3FA678EBC0B461152B7BEBC1B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
MD5 360c2ec3a4114840498e4b0f45820395
SHA1 d5d4a71933fa25ec338cdf18d7a03281fe814d7b
SHA512 257d1443341792587b0259d658a706dd8797a83644e451f2bd6d5b292d8259ea11c5d1b176541747a5470a2562615edd44b147e6ad752b4714458db28b07f9c3
SSDEEP 24576:4Y+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kab:FiTMYxy0Sy66Zh7Sh/cyvS5Z
TLSH
T185657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 5c8c4804c266b3c0bd1517c42f9dd310c3733fc14c363fc151306166295af238
MD5 2c834f16e319c48813a7366cc42d9c62
SHA1 8caa32bbda1278f7e9c01fd4319a2af7fb3701ec
SHA512 1b54edad363360ef99968ed2f38ecce0dbac5da8ffe265797719832e2245b17fe5f4f696cf5430fa42338c4e4d2a5b921e76b9cc8c6130bf8d1d98f36441ff65
SSDEEP 49152:BP7qY4ctjNE3KrfHEh1UBi0L//+eKVmQbJhvTxDUG5t9xi2QMJxUVlEQj0Ey4oB4:BThPD41Uge//WPd5t9xi2QMJxUVlEQjz
TLSH
T101E59E03F6D650DDD029D57097AB9313F631340A8B205AEF268089253FA7FD86E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\libEGL.dll
Size 492KB
SHA256 09dc89e7a401f272d29ef445f1825f4ef4422c6844892a6d8a56108b47a69504
MD5 e795c02f5692460c2ac566d5d53972bd
SHA1 80bafe27b2af747e768ab36cf7fa5c1f072ca530
SHA512 400478284147691a25a6eebbcff4726dffceb4e7ef4e5a77ee170cc9fa1c3831d11138dac091266c017d2c4c65f93fd5141066839e80b05e001ea6b21f2d883d
SSDEEP 6144:FUfgtSXLx7WDlUD3ntOb5EkMNvutTutO8PcRWLMJ85IeVeRAKx/b0:eZ7olUBObyNkutO8PcRW8mIegzb0
TLSH
T17DB49E15F3E545A9E07AC1388A434602DB76B8560B65FAEF03E093792F37BE45B3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\libGLESv2.dll
Size 7.7MB
SHA256 e5d96fb54dfbbf676b0b37c7915bcd907ff28f2ba63b49a72736a43ba3939a4e
MD5 e83cfc0b54e74499d3aece7ecd449edc
SHA1 cd18a077a977912fc16f6f9d77477bc1291b9b5e
SHA512 22f00196d2905d50f62636e6c628efacec3cfba69981769cbf44806fee5c0bdc07b0c593cb0177ff94433eade1a7410298dcfd5a074abaf0f76fe256e0902104
SSDEEP 98304:tsGAgRCWeWU4Wvy0jgjZQegl99ZmD3w4r/KlX26M:S+ervqggMqgUKpN
TLSH
T17B868C03F29640DDD05DE2B897579227FA34B8450734B2CF2A9457252F67BE0AB3EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\af.pak
Size 562KB
SHA256 92aee8e4924742bdd18340dace4d6b20c8b0240e0b884848f83f3de35315efc6
MD5 4eb435b8d50d5ec6092aec94c10b07cb
SHA1 3d07db014a8c70f90bd7f00e646a45ad59bd4385
SHA512 e23e7acc70527fe50e1d5f25f70ea243849f2bda8dbe2cf362c9557851c926882f95f528041541bc16ea9d197d41078a0339c46bc12cf238f8c25b24bdf74ff0
SSDEEP 12288:KaUyJ2eRPBxtRGtGdnNDRwvNS8Fq3G8zRFo4H2JynfN+Bn8IPUYo0vhNIAgt28V9:92eRPbtRGtGdnN1wvNS8Fq37RFo4H2JO
TLSH
T127C41B0AE781173D05E076D6BB0845F7BB9CA26CD770B2BADDA9823105A6EFC11BD1C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\am.pak
Size 911KB
SHA256 7b27275b82628536c73bea71007303dd433508bae4f9961f6894ae53727f41dd
MD5 2f8693dd8831dc6d93c1cc5bcba8a1a9
SHA1 6f0a975f4f274de2f4150c2d242c40bc1599bb7c
SHA512 d881c08b14e8a2847ceb77b2c6e5221a6abd0eba90799ef2ce980e2e97ced367e07d8000bdd501a85855789893fac98adce0e6f5357d589087940fb74cc7ff7a
SSDEEP 24576:XTOfTs1z2hTCMDyCDxYnUkjKtDCzddXvu55o9iNxVYq+XG/6aZvPpW:X+5a
TLSH
T1A715BB547EF9F7570F8E8A19A4320E4E9594AE4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\ar.pak
Size 1004KB
SHA256 b9650f157136de5f9c2b3d76d31e1c9df95649b8ad97126ff790c64cc3062b77
MD5 d8c3a6d21d7ce112e7e2cf59347946c4
SHA1 6e4aadc358baf43654599fb84661e065f2fd9db8
SHA512 abb435635c881142b5f6a222026cfa8014a63897aa63e371c629ad8d72cfb5a1dcc550fc9886067c6a8e423c2b2dfa0dde09838a76faadad8d381b863d105e8d
SSDEEP 12288:XLJnyjkiBlIgrkLGjSj1+Afdv4UmwaRkEGS55NoNjpZEYY1y3l:XLREk05eEg
TLSH
T17D258BE21B2984720B56DF0FD1E23668E872BD23EB4BFC3124934A2156D7513E78E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\bg.pak
Size 1.0MB
SHA256 b6bb97bd3d4ad76e78031222334236bb5a8e9f6c06f7c4a2b41eb5c4c6172d46
MD5 7f157c7a1b911a0e8eb23975ba5b4e4b
SHA1 a4d0fa07212274e9432418e176d0e3178f9923c9
SHA512 3c5f77d311132b49908cc21e9f193d5bec18b9fa3e8da1d5293f4aa8cb76651110699a5be568d7108a52af5032eac11d3e23feb1f910f0237429e765549a7d15
SSDEEP 24576:lDoe9WoebLYyzQkECtUfVb6ex2dS373Zoz32jKYmVDYpz74u2VZ4EE5edkFjtJch:Ce9WoebLYf6UfVb6ex2dS373Zw32ZmVd
TLSH
T1DC3524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\bn.pak
Size 1.3MB
SHA256 1d80f9bb725dd6ba0cf1ceb8a6f2a6f6cd59b40a41067dab664cbc53ed454f83
MD5 e48125f3d10b288191d164db237d3075
SHA1 49010cbe236466d41e715b025d49ca1f680ced46
SHA512 b0cbe4f390b001b30cb079e118fd53ad4554dfbb14946857172911cccdbdfe1558e5aa7f0c010fed27d12372e2c83e9ecabf75d6b0b762db3113f9dd99715786
SSDEEP 3072:TbiCYiflwyO8PwmhzGiwL50YJSz0rxXZAUv2X/rGochf1bGRMKDJ+yhZBbx3Qd5r:TbxeyLwQSiuZ9/KDJ+yhZBbY5IwD
TLSH
T16055EF209C6E81B6A8C5CDC9434C6370C5236E9B9B61F74DDC17A24938ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\ca.pak
Size 633KB
SHA256 01790fcddb7dc1a570ef117db5cb77747256430093e3b113d7bdf901f481ddeb
MD5 4b062909f1bf2bfb8f143fa6c42ffede
SHA1 0c95303f35ae51bb446d22d406e8004661dae647
SHA512 bed725819d4b97cabfc51704c9516f9cb49591ae75570b81eb147447ffce8f56b9693a9c855386939bf21dd7cffb993d2f4e0f796dce2ab1664b0cac6c5193b1
SSDEEP 12288:721x7hjAlCiEuNDQU8v5PsFBN3Mw2juwHzejm0t3ltb7TtzJtPw9Lr/fnWyFlxQD:7l5GLyEh7YMNyNO+5f+hUZ
TLSH
T1E1D4E7239FC93B7704D3330AFB46C217A48CA9847B16D254F4AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\cs.pak
Size 654KB
SHA256 185151025bf72a123adcf2b2e3acede08ac596e2632d5a2c5fd331e241de2fc0
MD5 75c9c79a65e20a72f985c050cdb8e606
SHA1 7b5d1e55faca742199775121d12079eac3167b2a
SHA512 0d4fa2d8846e031cf5cf2fdd00437d53b2c562406ac01ea7fdf2168abd343ebecfd86c6f56be6157da3fb3285a7a00634706a58c4a5c0d1e0d84599265f07a9b
SSDEEP 6144:e1BkVDJsXS4QU+ZU2L5AzRPWA9/O5xzm6wZ8OjaJSBsg8Qz:e4DJH/XL5Az5a5xzm6wZ8OmJSN
TLSH
T10AE4491EEEA36435488002487FBE4128BD5E83140B6EB9AB7C8F9C91257677E8FF4D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\da.pak
Size 591KB
SHA256 9b68edca19dc9ee7e72d8f7eeff05bf25106426432e2ea3bc095cea2442ade89
MD5 7b2b266ade1a83e4fed234196ca97df9
SHA1 c221fd302f3a7735fff9140d99faeb5fe9d8138c
SHA512 a14131385ae4138f365b2eb4264ee508ac2ef49c9af4b0cf50f9bacacd02fa331b51a55b5782d53b927efd549583ea95224d48743582ae697c2c2171602c2458
SSDEEP 6144:UIJJ6laaEAR9RMwzVIH52Q1JrE/ecJLwlAfdJwf/ob/dGaan5djVK5Es/hJbd4dK:UISlJ9ed1kJO8a5djw2sN7
TLSH
T161D45B4BDC9C732F89A90724F611CDA7EB5D543CC684264FA5D8943A09CFDA097BE2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\de.pak
Size 633KB
SHA256 adb4867bcb54bc67ba386e1efd2186d70152a3c422ebf16ed47306787e4e5fe1
MD5 670d760fe44cd2eab55fb9c1c4889103
SHA1 e2b9dff09a207b6ab7d1be0b9cd045512ae8fb29
SHA512 93016842517ac065924c6655fb49dde6ca935320db12f226b5a09c5a52786f1ca03b09a0ee2489ae98c897263f8bb66a79facfd0ccde4f955b1e3e5910bd82cd
SSDEEP 12288:rp2aqSGZ3H3K7UpjgpaGCC9TO659/M6U83FChu:rp7cH3K7UpjgpaG39j5NMUChu
TLSH
T1FCD41803ADDF625EC686B3617705CDB77B19E36BC342322784EDD02B614B5B283AD522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\el.pak
Size 1.1MB
SHA256 a36d5c5ae0a11052fc8a464879abead927a0898e0ed3500f55855c8b3121c4b8
MD5 e98a72f37df808989a77443c70b58d6f
SHA1 0c5c1ee5a904c4a884f41259e93169546f9fb19f
SHA512 0a3e593edfaf73a57b29b76bdef223e0585ab1c6d6e581fbff6572e84e4ffc19aaaafb7ee4f402013f929b00101033db73a4459f727632b849974923e6ea7b61
SSDEEP 24576:yHWFbr4gsYP9dk2tDZuyIJXDsSPSmH25gpqO2gBXZWtyjdHvFzuVoyNJdIWYNQ95:yHWFbr4gsYP9dk2tDZuyIJXDsSPSmH2n
TLSH
T1DC45CFEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\en-GB.pak
Size 512KB
SHA256 4b453983009fbb5166cdd82561db4d7b5445eee16678ffe697513e79fc799d7c
MD5 b6b7991cbbcfb254401bbffd856bad00
SHA1 8dc03f694e2388a30d081a2125e99eaa41703f56
SHA512 ab29d9afb66915b359b8a567fa312f6347e0058547d8ced084342095eb0c5f6aff068dc51a438a2e60eacaa4308dd67fc18866e3752c18eadb3dc8dd024eee4c
SSDEEP 6144:Pmog+bKCs/ef/GJEFGy6JMP9UQqq3faYob6jpc5b1D2CBcCRkJ:t3dYJMuQqqkD55Da
TLSH
T189B43C1FF784126A059312727B0AA662FF26D07CB35116663CBD801C33B676A83777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\en-US.pak
Size 518KB
SHA256 185fdd6a77aa2d6a9aeb63dc0cdabefdae38bfffb759c3d0401947cc8fcde6d1
MD5 b49d08b937f0c7385e17eb1b00014054
SHA1 d57a0d410c0f0f0fb0c7ce2d74aed5b6a6353f4d
SHA512 4d9539a69185312b8ed6249e4c5f7c498f23d3ebd6e6d0fe440a746e6065b56b8260c0319eb9d334ef6fa18a708a0be722a53be118c6f28dc5b063c8ea542b37
SSDEEP 6144:e4j9XjDxtb6JUtbKhMP9JQZtOfaYPMUAdB5PXjm2ngH8/Xfwf:e4BXT65hMvQZtaI5PjLwf
TLSH
T1A5B44C1FF744122A059352A27F0995B2FF36D06CB35112563CBD812C33B6B6A83B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\es-419.pak
Size 624KB
SHA256 6fa4188f7ab85e923bf90df361534b0a87825b989c85e8d41649f643d7fc022e
MD5 82b10a50319018a767a8830f654649e5
SHA1 b19d0b40b9a137afde7ced928d95f0557ba6738d
SHA512 c4ee4f991311992e150792cdd5c4e5fbeaf34d7bbfdba1ad18a849e138739d60bcbe9cd6f358a3061c9f26aff62ec33860e1c0f15dd2e52f592c1c40c427107a
SSDEEP 6144:0EPhorPZ6rHj7CYOCgoZdDu5ie5r5A82lsCl:F50YBo5ieTAnl
TLSH
T1D2D40922BAC81F5310E3A388B743D757E4989545B408C29BE8EB876522CCF8CD977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\es.pak
Size 622KB
SHA256 6f60b7e158097ad33e5c799d816dbdd8aae59989d6ef711ae9dfa29f5652bfe6
MD5 9e6db935f127161e84598be2a1e6a991
SHA1 1fc8a404e64d555cc5d7e1b30877e765d1febb7c
SHA512 9b54b5717a01499f2cbbb9feb371f30b72f6d67dec1563819d4c356cbe4244af1743521b7ce98a129328cef90f181096c74e809c224d1f964b07ee14fbea2ad3
SSDEEP 6144:bLOpRW/JEWO1MT/NNgIuw+zi1yBJnu8jf5JRtAJE8vJWyi6PZOW/:ARWxv/NPV1yDu8jf5/2JXv4xo
TLSH
T12AD4F726AACC0F6310E3A389B743D753E8D49545B508D29BD8EB876612CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\et.pak
Size 567KB
SHA256 8fa218930eb1e2191880de6ce4f6ba453fe8156819ed30454119e1fd017f5460
MD5 b06351c8e42e6b0acbf8c8b4d276ddbd
SHA1 9260c64b91ac4352735c58a4baf7718a92257000
SHA512 ad8947733f7d804d10ac284caa46f36dcc03c47b004a9bb76490fd74ac8b0c57ca017a920e613b6df1c6954c74ca0115ff1323a406aee1cc83efc97652c9c447
SSDEEP 6144:0p30Kaf9tCi+UUZdy10wnFt1zNdNpNoaOTQXtgPjUim9oOOwhl5myqmZwiCKMsaQ:0qKGUZOnFt1zptA1OOwhl51q4r
TLSH
T18AC44C42A27D771B182412F9E337AD27DC9EE7D8B4000D9668974A0971EEFCC38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\fa.pak
Size 933KB
SHA256 80549816f4f987147f4e121d8a8dac37138148fe09bacc10435941c2044bf57e
MD5 ead8d80570dd6376c13ff7a7452449b4
SHA1 21d33b442b6df2c297562ae7f10737b313130543
SHA512 9ee2310926200dc26187e6b45c77efe02bc81f70f2f4b177e4e4e780006bb1583459cc5d54d5de7d9e3d648a8339ca2f468ab591b90b8bc34b038d808e8c4a5a
SSDEEP 24576:4gmaN8u313uyqoz+sL2qRmXXloTUOmdAQifaQ2XxFtCfGk62Yhc8aiL8MX4OOcUW:55Ix
TLSH
T19E15B2956AAC9AB15747CA0341E33834C773AF12D34DFE40ACA1076609A5B139F5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\fi.pak
Size 578KB
SHA256 93e49c488e2e5b17150dda2f58bae778628eb9a0bb8bcdda7be81269fef428a8
MD5 7b7c9bf413269b5e0d6599ad2805ba97
SHA1 f16c0f5cb2542dcb2f75c97ed1a582d8e75ceb26
SHA512 cd4024ee2373ce61a2cd09484c7f36aa329f7130cdb18571a10b9d1d5aa781883eb47fc2667d2bd1ab478efb5bd6b741d8ea908108c744fd9a5461b84201eb13
SSDEEP 6144:FB/EMnTVi2G519c48SXaOmSirjhg+esr0+OERHU/aQ9Lg5Zh0dUH0RIIp/WaIh6E:H/PhS19JLqj8ab5Zh0dUURIIp/WawiNG
TLSH
T1F7C45DA15219C22137C4D29E7DB0903EF5E5E39CCC284D9AE843CBD849ED9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\fil.pak
Size 655KB
SHA256 a6b5dd63bc28882fae77d2b0eec1381192069b80d66dbb449d0f5d6619d567de
MD5 765cc73bdaee08b31d208429cbae16bd
SHA1 9d4daa3306cea67e8cd6e30b547388c3a70c9a7a
SHA512 96cdf00758d5160ea9c62f58edf99a8fb93a5e6c62f623f513abbc69cdba872013edab6f513664796a119a750ac3c67383c19cebd479f421e6759ce00ed579d1
SSDEEP 6144:Zfx+LJTQ/7jXN6Wr4hlr3PyiDQrVvBmtzqhnA9t55wwvdRosoV6A1VOO:Zfx48H96jGc5rv+
TLSH
T1C6E4B615A7401748DBC352E55360A82FAAE560B83F813C6E0FBF269B7BE7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\fr.pak
Size 674KB
SHA256 c97f530552e0053058826f9bdae820fbae2ad0d0203e17ffbb3dc40b446bde23
MD5 19fa160c2f375ea1d24e3f980769e490
SHA1 cef1ed902245ff1beeb6f5ace2d15cd85f1cd8d8
SHA512 2e269e56238cc1fe7aad584eaabab4f4bbd025b6ce98117cb948c57e260aa48bd025c7df30d943d72e309ebe2c23b634bda06b20249f05e41c43d27cbf067021
SSDEEP 12288:CpG1NZLqma5FZb2ZCh6QuaaV/LBxezZO6UiZjYnY6D8jw2wTq9DznmJxUm40wCA3:kMbVpjH5be
TLSH
T127E4F66FAEC435CB19C61273FB12D663DD348248F215E340D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 3caf2945f233d578af7c93a95c807a5169fa50801fc9ed6b8b6fcdd2a2f08c6e
MD5 952e76e51ec7f337e5a911e861f44d41
SHA1 749c09b2bfee64d83c4fcd55116301f6fe716dde
SHA512 b97fab68114fd1bd251b603129034c54c410bdc4c74ce49e76e3b24f9099767b218f0663fae8bddedb0c3891f603805d960fcd643f477227518785b9b8b8ed48
SSDEEP 3072:GTsPAaIVXGtcxpUCu6u/Wy/4RG+APTPjAwREJKVMjNiT7llj63rAulfcSi5NnWsa:gsPbYVpu6Vy/4E+Bpsqm5qADCn1Kssw
TLSH
T1A95519D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\he.pak
Size 818KB
SHA256 e0bb2086bf4c51653d3bf94b809a2674c4b0b66dfa2be34cf7eaefd66bcb804d
MD5 eb0ce9c7e139db61d0a73fbedd3671dd
SHA1 084682c610b80b5d3a84e6862788e2efb9928c4d
SHA512 b8ebd66c7eebf9a451bf83816ac83df4ba2b12226f4d37a962fffb61736e180fb672fd6cd0f346999d9aa8644916a767cf1aef3b492ee247ad22b615dfa7303d
SSDEEP 12288:uF1LS2chOFKxTTmBIr6UIgVAl9Wq+/fY3AcMAwWXu8eQCajv5RX8A6xgzlk5WOm4:iVt5h6r
TLSH
T17D0599C4B2D552255131AAC39FA8FA286FF3CAB53CA27512CB14526CAC774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\hi.pak
Size 1.4MB
SHA256 3a493b80f4390c68eb039f36f9882ff71349b4947e3c2894a484d58ccf9df42d
MD5 4e9fc4cc430ed61b5f143909eb779553
SHA1 1f128c0d986ebb7a340a19c0916600e8b8e91911
SHA512 e986585c012bd7f86db427a7c14d9215f039e772529b205c051ed0c04d22c83fda84bd85acd0c39d4248572e4f93a64875575985d4f59768900f161339e405a2
SSDEEP 3072:MiQIPlFmMOFuKLcp4ukTIIbsz1gGmmV/B90ZV1d3uGlqvN3dgwJEOTByntDPtDX3:MrqlFVOFuKLdukTbspgGwUv5p5ldRhCD
TLSH
T1B965F50CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\hr.pak
Size 631KB
SHA256 3fb7e29e4d35ccca2948c862ac5b3e1177a5f4f9fd4d670159de3ea519d076fc
MD5 e5fc0a2b26eb0f5a747da527cc4cf6fa
SHA1 9aeaf730dd952dcf328cf9197a4c97c2b04784e2
SHA512 4b81ac34af9a7129d78256ccff6e6c523ac63058827be431848dc52d0659c25e8fd5f80b1d5d0622f80fd72d7e21d6daa4fd53324d06da2ea9bcac3182cd3bde
SSDEEP 3072:4kaMUcWjB4QM7pLUQ0sPJaLV08N0cy+wHjjzWBk22Xk8Y2KzVQSOSAqYnpsks60F:ftaMtLUQPG/w6iKnCCES50ACOablyzpJ
TLSH
T175D42B7DBDF2970A0897B346EFAA43447DBE08DCE52597B7684F522E0043F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\hu.pak
Size 677KB
SHA256 ead4f6ca8342c394f1538b9ff2e894f6f8269d749b7c976668738b526c0c099a
MD5 257172279b2cf342062a4a729123aa47
SHA1 974fe3265df692cc2ecd4009d79d12686a54bc8d
SHA512 5aeb140922518096369fb93073af70fb68b063bcede86df31b89ac18bce1789eb924a7e1ae811f9a4f86a186cd02fe1bded44437e6911b1d6fc1087bc207b252
SSDEEP 6144:o1i5yAd/LTUHk7QH6wRbA46tsu8U5kTT8QZ49FQYhHEwgnOe/2InjDl54Rxn88Rt:eQjIA0U5k/83255QaO
TLSH
T1DCE44C7793769059BCAC179378643F15992E481BAF3B36FB2887846D20A178D0D83CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\id.pak
Size 559KB
SHA256 291a27d81105680c04ec453570e8a3161b0beef4e05bb433e4b8912140d7b663
MD5 e372acc2bf3eba8e7b799eafdc086ce1
SHA1 f63b3bb1ca4ea7091d4494fa0efcf68bd4abf9e9
SHA512 817350e8f4aa41a18ee4716bb744de8aa2c047f72f8c304ba431f74c42c731f954a6be389f8de3530e1d1924a30129cd38ef63d32f9cecfafd3bd37f9581bb6e
SSDEEP 6144:m+GHNFkzwOH3vZZBpLuWJfjlTFjlFUXmBzbkBFJ/5A66HROBwcmIiTv83yHV:mjFkzZZZ7vTTFjlF4mVbe5A6644V
TLSH
T1A3C4F8632ECD300C494843D5B2DDAA1E7CCE233BAF05B76E8E748F7055A67682716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\it.pak
Size 613KB
SHA256 c0613eac80790d838815ae870f483d4713e03ed730efa38511f18932fe9eb74a
MD5 8c809db8c98a351ca97035c440dac191
SHA1 a6e807bbd59be7c2bac789f49005ed7770d78ad7
SHA512 4c51645f8530d802a3ba0ee6de0e66473d5b74d119ed0139bae2cffb472df3db18b572bf4c6d8213c6668b61b5a8c166e6697756cf2c619eb93de08a15060385
SSDEEP 6144:UZ5l6Rhwc76kmiX9S22Ni3nSIqBRRs61wts/RT9TbOzkg79CYrvAqpzSj9f3wBY4:sX6RiwF+ZZUg8x9A0Ghz5XlSl6uf
TLSH
T1E0D42B3AA5D6212519976359E611B085FB6AFCDCFF417218C99B031C23CFE80E2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\ja.pak
Size 746KB
SHA256 875aaf699bae58275cb054db7f96782a0f36e6fce15178ad2dc68251ab8707b3
MD5 34c5f7c6dc0262d54f5ea0c6909df15d
SHA1 083378b46ba72889584db2949cd7abb737613051
SHA512 e64aa28525c8a1b29461dcfb9db409d69a7dad9c4c25ba9ca206859bfa13d7bd17b0cef563b7ddc3d79b5433e935fd0f7fcedd319dfbb9b47550958d81c9b7ea
SSDEEP 6144:bE5RkHSDDPIZuV8nxX19bOZKQ2Ypj/3bS5zmjQmpzV3:bE5RkHSQZuVgFOZKQ2YpzG5zaQmT
TLSH
T1EDF43F7CE3C969369D6152A22C0E76E17506AC5FFCA23A3A443DC074BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\kn.pak
Size 1.5MB
SHA256 4e642d8c65daff6957ab8ac91b9b903180102243ffe2dfc52ebc92c6fe7232cc
MD5 511c9a38517a6b45eaefd7ed092b36f6
SHA1 394200736c5bbff876780422fbaf464a46aa12e5
SHA512 061e281c767bef62b311165de9bb77ef91a04b73a9fb96b55bfc9089054d76cc6e94353dbe74d0e98de90bc898b87b9e216508542a4856a09a2e42262d8943ad
SSDEEP 12288:SwRfGKaP3OlzVHEkSJs96UuEiMyY7n5wojMf4GJyUWi:gPQR5dM/
TLSH
T1CB75CD18ADBA7D301BD5006B24EC603EDFF16BE29CA907D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\ko.pak
Size 633KB
SHA256 5351c797808ce357f86308721b0840d56db6b5a76fd06858db34e912aaaa0169
MD5 6e0fe3fa66244551878af31cb38805ff
SHA1 0eeb5af42253aee4cfbcb0211f1b4669b75bf3be
SHA512 ed72948d807708486affe0f05008e0ed1a4a899e0a11ff61f75fc529097dba51661fc32e68a490c1900e0f6ff81930e133a19658ee436c9a3cca5b52fdaa47f5
SSDEEP 12288:y6TRDu2k+nB8gN5NifYj4ZGRyvIeYsga5JHdTCJaIA1xWSbGRG1zLhwOtyYt8SnM:DDfnBQIQWI5g3iAuI
TLSH
T114D4C5F238DF63CD1193C982AEF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\lt.pak
Size 684KB
SHA256 a9c89dc09206734232f9d6d472df1903aec1f6349c3cf0042af1ce82f8e3b32c
MD5 9edac797a16a52a7977ab253dbd174df
SHA1 e0c11565ee8804c7f77c20f7c4292e7e7389f2dc
SHA512 1cedda64a811abb0a02bdfd813007c6aa351d12307d1974658534c99778a46cf0f7d9d85e467c332a4f63c813e36a944b72c66024f624411fc9aa22422da1a7e
SSDEEP 12288:P3JM94BMoTnAPqevWWSto5j7r7IL0P6StA:PJPMFV+o5D7w04
TLSH
T174E43C0069D3AEFB9A4467C982A4CA78DEFD50009767BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\lv.pak
Size 682KB
SHA256 6034eb70afa90f68d1b8a55581dad81736d843180a2ddeb27e52cdb11adeed7e
MD5 a2f0f02e88895652766fdddae7e20675
SHA1 f81e6a7d76e564e8fb46ea42e90b368a255b9ec7
SHA512 e47677f6e38cf0480b5471ffc048aaf8dad8fb7b3576721637f33ca4f0b9b471d363bf98bde1de7bb43ad109912ed697800282d49b27b9611a5ce1d4e9121bd9
SSDEEP 6144:Z8ICaHQn+xeEq2eL28/E0xukfN6tVFxu9qyHjbxWZBgVbORM5rmNnaLGc7T6GH13:qZEaEOcMFHvuCIRM5Ec7T6gQdx5S
TLSH
T169E42A959EC68FAA4D904DCB7326D123A8CCD740FE07E112DD7D8B3A550F52822B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\ml.pak
Size 1.5MB
SHA256 a4985c323539d245d84518c77a68dc15d010270e5226a8a4d248cb6e597a9dea
MD5 ed6330975c8c49dd0e6d21f543ba0107
SHA1 d23cbaa348cccbe550920360565dcdb3953397ab
SHA512 7c4d89cccb5675b55a6329110d79aa421f1451d806e3bb693da0db729c4157d14b2f5643e49762bde2d5a8f5e506492a13324cd20b97578704df8b000f36f709
SSDEEP 24576:48+7+9y9XBkx/W8kKfVBR+zX35+v2sit83/5IaWi7C3a:T95H
TLSH
T134759D5BA036CD3B0FD102167B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\mr.pak
Size 1.3MB
SHA256 07229490b866850aada40565b2cb9dbd2f5621ca66d4b7422a9a8a8f40892218
MD5 69cfb24c6a2ba7da08f8be9b8b0522f4
SHA1 40975ecf3f5dd22fb199e7c89bf923d77cf1fad5
SHA512 db5ff6fff1232d80ef55d13432a076a8697047832e5df5c3bc3d0cd3105973b36705ca1a9326fdbc18b0f0b4a574123f94f8723827efb4e4d12293764eff9442
SSDEEP 6144:/Q1EauYS+eDDu7wfiWUUn01H0GTPO5vm2Kp2:PH+e37z0p0GTPO5vm2Kp2
TLSH
T12355D14DF7BAF3685DECBC8E36540D3BD8FD21B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\ms.pak
Size 588KB
SHA256 d3a830abbf8eab0a8722c9de2d5795dd2a3e8c0c0c3df54b682a58402f858b5d
MD5 b946d6636337969f251229dce70fda29
SHA1 a7f240a1b1e76462ad941755d066e1ccd4af181d
SHA512 0a79cb3953960993b640b0c047585ce5055c068f82c3c5ac8d885798a4aa470b7b9e2cdd7e9d2c16ef7e20e290fc03889c813e56618fabb6219a5c26d275e08a
SSDEEP 6144:4TAoE6q38Q0f0L999Hxbbhj/513hHuqw5PCFFTVo8Z5bYKVl4I3BDMT:4Trq38Q+0LtxnhvxHuqw5EBZ55l4J
TLSH
T197D4C7569EDE3118085843D9D2DEA91B3CDD3332B705AB2B4DB08FB0126E7E53316B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\nb.pak
Size 567KB
SHA256 8b6156c8055fe401146a1b6ca412d272579cb26326c73b7034b5736b5fd18ce9
MD5 084f8f143700af4c26e44a0e134462a1
SHA1 03e9d612defdf8a204beeed4a45a27adcc5527c0
SHA512 b40ee4a984e6ba518e555c2b3d4917015c85f03e95c2471f76c143e699904063776454fd2261a0bde0bb506550503885a7dc1c323c91760d0fc1d8199f0079b8
SSDEEP 12288:bqdW67GQT8LgjOp7fj4uzM4gq+5wB4BThEeOju:bqdrsLjFM4gq+5U4BtDx
TLSH
T10BC4F883EE46B32EF6A443A4F51986579B7D942CCD98199B94C8C63E0CC7EF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\nl.pak
Size 588KB
SHA256 280eb00b177816b8c7f48ed8ee7c8a5ea1a1773e8ea1bd1dcf690472e49e5942
MD5 107de03cc3e43663162226505dc2eff2
SHA1 71220332057dbef2214d325eb9f95674bdf59de2
SHA512 e0c8e622b8c2ade966dc24f341435bf4ebbe9c671573fcc563d20c21a866aea5a2692c2f9938de91788cb4ec813cf97d712a7d9c862426f926cfa6704a9af4b1
SSDEEP 12288:hLqvp7LlbJWQusSU0n/ga5WGFCp5btOyPWgqHnGDDTF:qlbJWQusSUO5WGFCp5bwyPxqHnG3R
TLSH
T196D40A17AC4E653E58C1B345FA098BBBBF2ED22CC26CE67D94DDD1340443FA842AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\pl.pak
Size 655KB
SHA256 774292edf5b77028e3f68eded218dc8a24129a0871ef14db060c83710f90e24c
MD5 ced70483e16b00796748124e4711989a
SHA1 593bb96b3aed4edadae60db765001dc17aea39a2
SHA512 dd234bbd9bc3cb5eac52707e36d2d08cc443fa4306b827e5c77153dbe3f63d51357ec7abb3b43ad0ce554a5763b188e56f03abdd74540123c74d2967e5696fcb
SSDEEP 12288:MXVQTWoOBAKmd1wfQfuzSJabZKbegPPpCUdpe3mxULKMHmm1Qh2a5RMqyolKr1T:EVId6gaKMX1QhV5e5
TLSH
T1AAE45C0E5AE58A4E4CB008E6F6E70B7CBCDDC808F108D35FE45F852A615B19EC9BE594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\pt-BR.pak
Size 615KB
SHA256 d747b8bf709e8e114cdad0287e4a7ac242460cdede9b7f5b7ec2234fc87e7861
MD5 36ffdb69cfcb3541840b04bf84e65a4d
SHA1 867327fe6c94690fa127ba4226bd310943567423
SHA512 e6ddf553d74985f5ea320a9726de0499c561c707191db3801830742bcc6f9d1b0ec18d203b9094cdb6f0f259e41693925111756d0b2767f5ca270d4ca38fdd54
SSDEEP 6144:nBGRJpuZP/nMeNBXBLp9XfyRG5KE1dhggFsRqJCeM:nsJs1nn5KEa6sRcCV
TLSH
T122D41B296DCA136614226350BB4EDB47E5880645FE0ACB87DCFF4F05A3DDE40DA23BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\pt-PT.pak
Size 619KB
SHA256 cc548db7e5021d36cea5d10851cae6d6df1563508d2d08edf8e043fd3cd180a7
MD5 ab49052aa9a15910eb2e8fb2f6d87e9c
SHA1 a5483bb7fb661cb6e34d64877566d987762111ff
SHA512 8c323af5ee4f29f95159a84e4c56e212e43d97358113b8e5d2b71df36779067837e66d195deeb92c30dd96ada0094c70544e7e316280a021d2740d4e37502e59
SSDEEP 6144:Mw20ubmNHOKieJVJJxhTv7hfg2fEqi5knv/s7USR3d:Mw20uyNHji5knvsUSRN
TLSH
T1FDD419286EDA132605136381770ADB03FAC85655F80ACB87C9EF0B4672CDF94D677B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\ro.pak
Size 641KB
SHA256 03794b26bb4d8d78f0fb0feb7ff4ae226431017c40ebc50815c1e4c05cbb0ff1
MD5 cc9a077110e40b650fc931edc0c6d75b
SHA1 d404287a5e3d7bb6a54895af06df3a88f8aa1394
SHA512 7e58a2cd66833a8382f39bf829d06617d8c479e95662b2c717fe3dc8c3d37131fbf56bc07afc463135a3a991cd8ee4cf52d8cd3d14c8427c964093f4af7eccf1
SSDEEP 6144:tg+mf0mEUXo9wK9e/1oBPvgJyntk+wpG0J5v7sJ5XtQW279a/grVf:YmUXo9e/1oZEwtDmJ5v745dko/Mf
TLSH
T12DD44C23A1C81A97199153B2B73624D3E88E105DF641D28DA4EEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\ru.pak
Size 1.0MB
SHA256 9cacb06a5fe811b62b06eed747a31a29a207563d4c7c9b7116c069f7de8efc33
MD5 c7f0e64d9ef6350936e21fd203a126c8
SHA1 521337bae9512b50eb6a4bb219371884e978c3e2
SHA512 b11e01a78d197bef0894f7168a84cc794bf9bd7db1686485d77d862cd130b7c645e01102c3b2a519f78416ca64ec8182de16aace11577dd1f9bfd143c7d7c80a
SSDEEP 12288:czZnn758VffQeRo4YwSsps7zJ9hF+a8anDX86HzW/oqSvus2zTFcvgA8NI6dwYH7:2n98Vxwx5WoQv
TLSH
T19F358760669E64EE1101F01BDD08BE0D3CEB45FE3FAAA31619642D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\sk.pak
Size 665KB
SHA256 4e6942f0ff4898c61c22a1377bb5d105a63c27a1dc1f3c357aea133cd777a58f
MD5 150933f6fcb222b433edaf745f5ddb58
SHA1 4b50ff3092571c3e3757707a0533938bdf31b5e2
SHA512 b6ecc4dbc64ad79888985455a4b5b7555275ff44fc4307941afa7df72333ef48bc99cb98140e092df58e0c5fc71fe2d047f876e30f32986551af4b852d637175
SSDEEP 12288:K/zxpPZ3qkA0B4WAAi+ikbG5Bn3JpY4QqEpTjsxt9oe:K7d4Ki/5ZYgHt+e
TLSH
T191E44D3FDFE7181E8E8D0144EFEA7110F9BE8650864EB4A6944F334714E26ED8AB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\sl.pak
Size 638KB
SHA256 967490b89e93001015f8160e2300adbe51af40c9d5dd29a7710237f204c3c35b
MD5 b9a0bcada04e50958773e6a85660503d
SHA1 4f90f3fcb0786e3ead267824a88ec83d1d3c3dd6
SHA512 6f9a2499bb3df92bab088af114f754f02d05122e0259d8f683a9e0e2b81f8c5b1241195791a7b199ee3bd027f35f2044deee0e48ec4eaf24f42a9d1dd8fedabf
SSDEEP 12288:HzlQmQJ2+JXO8/cB2JIh46W5+GHyjWOqKzyi/fzPDJql/ad:RkJ2+1O8Q46W5+GHyqi/fzPDj
TLSH
T133D41B397EA79E0F0C9BB2CAFEA606007FDC044CD252A662EC4F336D5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\sr.pak
Size 981KB
SHA256 80b5900434dd4ff73f72cb473ba43cb1622e3a68911da4b91e8620585f0c21d2
MD5 508e3dce9019ddfad986d371d01c3b51
SHA1 f23e6bada96e79b890be036fa91cd9ee378a2231
SHA512 8518325cbb28d21b790721ef36087d0986e5010d2afb468be7309073ca7db95d6a05b51446f0ec530dec369016f48607c30110eb1147be1afd0a3647c7aa4032
SSDEEP 12288:uhVSJWkekZ3KIVFlSsd4nisi4USH6vU5Ya1/XCvxEGh37yMuNU/k/D:SScDDlH5PCiT
TLSH
T1502557A19B9E64DB0501F41BD808BE4A3DAF41FE3FAB975211601DBD34E10B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\sv.pak
Size 571KB
SHA256 6599aba4dfbdd72477c1bea9f872913121547c35e520b011c73988378e590b21
MD5 bbe24ac071562cf3b3735bea3cd25e24
SHA1 1b41aa4c2e06f7a4750a0e23caffdb37917f4a02
SHA512 ae17e45ad5c5695e3fa9283e0f6722c1fff8b45c0b75b4b3ebadf77855a48467e926a86362d1604c72795f764fc5b4e0f92abf2b280f2ac86c6783eb19aef610
SSDEEP 6144:t4cBfkZBcpgsVQZHFKKOKTd2DxPXjlVcBLTVRFcz5RtGmP+SM4WxFMNySOCc5AlE:mcnp1OZld2hG52i8IXX
TLSH
T160C41D438A10F526FBB2130DB509115B0AEDE25CE7E2958EB8D9883DAD8BD5805FF347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\sw.pak
Size 604KB
SHA256 6a11dea8ec8e08c06fc3c2fdae7a9f174ce3c5692feecd0de3dad793557cd855
MD5 c0d5dffba257b3e8b4c294680c849f82
SHA1 deee9d18efa5e60729d5ef74921c87a938112c76
SHA512 e7633ae3c6f4e30850ef495baa82e7dc495b6c7ee38967c647a4ef0b61ad7e591d5682b51d87a44d5d3302c6a9a2f1b864548aa67b8054e2bcd772300b2a9411
SSDEEP 12288:WDy7MKxGN2qg35FmedqNGjRdpTb57bQh4FCaoLCzPFCcSeV4GFeNANUi7PgtBLKY:iOcGFkiN53WF
TLSH
T1C3D4D6629C71D1191233618603DDFF732BDCEC9C292B29935A46BF0F218F58C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\ta.pak
Size 1.5MB
SHA256 c53532e5ed353d9a7ef7d066295396165c714c0e71f25acdb670c6d1581e78fb
MD5 a45ad4a22bd3ed4331621e38ae4d6be8
SHA1 b558fc6af6157328e69153b7d77bd9021addb911
SHA512 cd6e95b24814758336e1cc69a89c5649fd709ee4f0781c0b73402e6c2ee68f84d370bc1db0ec463ac4a8e7a0c7a2ba3a4132e39e5fa3f6f6cb45430517063388
SSDEEP 6144:b4ENUJikemkd1P7GP6J5OqstR9utm1vYpiMyZ:7TJ7Gm5Oqdtm1vYpiMyZ
TLSH
T18B750CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\te.pak
Size 1.4MB
SHA256 85163dbfe6e7ecc2e34ecfb970567cce82a311cb288b1553dfcbdcb512bb64f6
MD5 3599fc20054826d0a354f405a94f147a
SHA1 c767ee2d9ace64725a7633604b55717702fa7a17
SHA512 a0d3f406cc4ba3bbef943502de48a6619f5f2a78468e08243ff655de1de2c107bfeea0091f1a4c54fae9af55e0a727662e92ec0053a51df4260ce1131b0a19b6
SSDEEP 12288:ArPt3zwIp7McKNYyX0iPF6026gIC8ymoRRT5hb8G52CPWus6Ju3p1FPnY1NAC/ln:ArhzwIHc5T4chk
TLSH
T1976591023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\th.pak
Size 1.2MB
SHA256 dfed350facf62a6bd193ffc4fb93070d14d81934636ad3616fb50da6569118f4
MD5 ef59d1068e32973655acbfc6cf6227df
SHA1 c18825f5bf3c276fed3f25433456f866a6ba6191
SHA512 4fcd07483c2e12c0143ab6d65ec949bebce4c4464269371b25227c5f4abb282ab46d004322b903c69f8c863d08bfe6e462628191e7386e432bf19fd193ab4277
SSDEEP 12288:rCEfqgRqqUN9LyZYAhzYLkpms3hSkJUsNPsO5eXffpbDF0S6Sd2N+xylO1qsl5Us:P/bj5rsr
TLSH
T11C454BB37247DDD479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\tr.pak
Size 614KB
SHA256 479f3b31720fdeba8e327e666fc45deaa305b0c7078ac88ba47b8643d7e65b7c
MD5 9f10788034771f74f7ab22024ee2f356
SHA1 94af6ba6e627dd11077e79629880d1d270f6a560
SHA512 884593ede31a2de9dc5d0eceb9216d54c9cea1b7c3dd0fbf0c6accc443dab2b66d92bb3dd62e8284dd5405e5b4252c92a38f69db277b44ed9cf7b1117c3664dc
SSDEEP 12288:ZAXsgA2NDaCHz6sgNwIfZFzOGi0Rku5MZ49:juOvRku5e49
TLSH
T17DD4FA8178EF682C8BB9278FD6E90666F89F0766B331F446DA168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\uk.pak
Size 1.0MB
SHA256 4621c59516861268fc432a56449b552a7d84750a1a68ebd765a4d8442dde77e5
MD5 a449484d5228315315e8f50941fbd419
SHA1 c4c67e6829084ae1b9600d29c04e38c3c6a0fd92
SHA512 3d4675d629b25e815b13b2b0be989bc182614b209fdf9ddd2831e91d7ef0de805244b7e6e8fe2beaf26adcfbef820cab714bd9c55f662f4e33a6c19b289d2304
SSDEEP 12288:94omID99q6gFQAossSr+EfhVuL/qrjBtIVG/i5iNClIAve82PEulLNiXETqqe04z:9PM85y8p
TLSH
T15C35A9A19A9D54EF0106F05BE94C7A0D7DA701FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\ur.pak
Size 923KB
SHA256 7c974818fe7a9bb445241a20626b81379e7d485b0f4a1a266d9d39814223c994
MD5 b28422a01bc41ab7a46fc69264f7e657
SHA1 e415dbc9d57638fc1bb04ecccb5b670827b9b768
SHA512 5588c39a016b81d71814374ad27c4e8410a2a19c316e90552ccde0878414a4d7dd2276f0ccb629411a031225aded2e0941415334f999959182df52145583d555
SSDEEP 12288:ZiZNtBxoq08PMuCjqtdQjDJ3ydKqC5hd5EhjGQOpRDKQYrWUYjwadcJKwUiuqcod:ZeNz+j54G+x
TLSH
T13B150FD2E6BC96B24A21D92780D33C34CB735F13D34AF285E56246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\vi.pak
Size 729KB
SHA256 79822a3fdfc790d06616f04a63c76a80c4a80fc7b4598cd18b980cc73ac0d76d
MD5 2fe4ea0858eb5bd98bdfde9400a65f51
SHA1 3b15f3ec66af5fc8ec90844309034d5ef87345ec
SHA512 2cee975f3118da6402a2405eae77f7323d5c6b249eb312b0dfd3e51abfe91eb3ba0ce58e40e336527c5ee69bb1702e529cd4c9eb7efc81f74ecaf154fd577b1e
SSDEEP 12288:OOR8FpyGJx+cIIyoErsV/PwNKU00BTVN5DFN5fbaJsZA5a8iVycoINMZPjXlS6zR:X83yux+cImVwNd0AFDTs5a8JxtTlSMiI
TLSH
T1F7F4851216E1302680AC553EC6CE540D6FCAE42FF7C1CFE56FF4297476221A46F25AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\zh-CN.pak
Size 523KB
SHA256 adc3776b0194593ab042b19a259df0c86d410017a52fcd709e8875cfd614ed31
MD5 45c90e9460e0e0cc4cb1d7dc39da2006
SHA1 42d9faaeb484e9698277b869115d6c243e7a86ae
SHA512 354a1a45f99c75c717adcfb864f939f96ea33852ab93453093153399154ba6d43ada143b8918f1871e3765ed7bfe387794f79f9b286f5d61e935999c70fd38fa
SSDEEP 6144:NXst6hs8uR5vUnS7UcUpEN0Ry59XviXy30YW2VmpxkaYplA:St6hsHR5snhcUpEN0Y5hvzkY5mQw
TLSH
T10AB47DE811F9BDEC044650A03729613D7C40720BF66BAF75AED248DD2AA2FAD0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\locales\zh-TW.pak
Size 517KB
SHA256 9fa276205e96996800c593b81062c765888d0dd9f63f97994eae1742a5baeca2
MD5 6ea6ecb86c0af2485b7b4ec7554070bc
SHA1 f3b37673eaeda5dfbfd8d60536f603a0125fa900
SHA512 4cc7bfbd46c20fef09626f0408d147b6da4b8831399abe7c1fefa5d9b13b88471f593b6fb78093c1d2742af4b4555b94b9151e61055fc3ed7c4458d8a96db6de
SSDEEP 6144:SUEa9vdaBHxP0T9T8gczVJKXaEv2BuTyZQi5cYfoHMDCL+sr2h5m9T4:Q8MBH29fcKXBryZQi5LfoHKTX
TLSH
T13AB46DBA19FBDBEF0901F884B7CD523ABC8B342CDD777636FC8518D42D6AA540A61046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\resources.pak
Size 5.9MB
SHA256 3adae16e84962d24f6e0d35bc5db0f65cb07a397cb12cf37dfb3bded57df6cb4
MD5 c1e4c6e8655e51d92d46e921ea2bb028
SHA1 61b3f5bdf8c190637e62db7104c6596a3cebc0a2
SHA512 ae0d1e1eaf49e2e7b757a9a23cfa960ba36390a33a84c8baa7666259efe611c32dcb53a2b65d313092e075de667975e4f96d88bf4098c598f0e2b91f98629445
SSDEEP 98304:lIHpPYxPJ1/oRMnl0zWIS9FhLrwr7gHnzDmJzkAbSig02qzPF72yWYTjzUxv:kwxBdLnlj9nkr7OnzDuwRt02qzPF72y2
TLSH
T1E75633A27A54A80BE24517FFD0A1C1740C2C9BD53592A19715BCF01EFD2226EBF8867F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\resources\app-update.yml
Size 117B
SHA256 ccb619e2558b71bdd33debd59aa4ae3e3010ebf413f93afd5e4e428edd79ac08
MD5 2524828351fae3750e1abbe6f7aae8eb
SHA1 504088a8a554f28023182965d0ad9da69e42ef20
SHA512 82a4e1d09d5f20de1f85f73705ab2565a5feab7147f6790666cdadf0e3a330b8286198421fc5e84522bcbaa5d630f2932ac4fc6983904b1aac25f83339c72e5c
TLSH
T19DB012F0B987A67D48F00C2AFC5228B450BC4590F756767A82DD35ECA0835B25EAF0CD
MD5 SHA1 SHA512 TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\resources\app.asar
Size 2.1MB
SHA256 f1284620826d9b9b3d25fd1e890e18d6e9363aa6a711deb0eb137bf0029d72db
MD5 83f1e40067c510132e4ef442e08b8cb6
SHA1 c73f8c8fb755d0333fa20c5ebcc14139a9738442
SHA512 6beeb5344e5b668958db132da48b64414b153166be35f6ef8fc346306a597b1f92fc8cdb63da1aed73148ebc33ab305aeacf4a1f285e740e7f7da0f6ecc38ab2
SSDEEP 49152:HSKu4C7AQGdhzKxDsK8csVGzL98cdYFvhUcxJsIpZuK8:FdhmwcIhUQXuP
TLSH
T158A5E86515E7A635666323FE294F0096BF34F447A104D500385C9269AF82F38F2FBAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golive-audiocap.exe

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\resources\golive-audiocap.exe
Size 198KB
SHA256 bc8665a83dff3217e7e81d126078a7e19e6024adf49ffbf6677142a94d3f7b4b
MD5 403e6c5d33fa4fc73a534a9406bfbdbb
SHA1 9a05ce3bf6f5adc627f16c6afa97a90e23e64da6
SHA512 50af017c066acec074d706d7aab2f7a51c6b11f2f7a41bfedcc393174b1d8664287c3ebd03b4fdac68f8dde0108f74e0458641a2c362c14b28d87d69b04e8686
SSDEEP 3072:qh3m4rWn82rg9SUH+KEKPt8n9n5OvG2vgwChOqVLRe91rsI1vAo:qh3d2FG+J+t8GvdQhOYej1vA
TLSH
T176147E15F7A510FAE2778538C9524A02FB727C5647A0AADF13900BF69E237D09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\snapshot_blob.bin
Size 329KB
SHA256 314def6cccce2e8b6d9f4d4273c1e306a680f7f9e21d5551663c2c2d13ec155d
MD5 445a6f7cf7080710a11c68c979840875
SHA1 ffd9210ddc9c4bb1d353e7ffd8cf916551ea93f4
SHA512 e42c0e9f0be8bb0fa6c21540aaa0c7c34a222b7c53c2fd248dd0a7b0c629c5e29aecee5185a36330d8819a3c5ded19c62f4c0520fadb782f00d716e573f32475
SSDEEP 3072:jtjRKkOt+xeReIyhOIW8oWi2Q8YZevKUX/xj1RJkx/LnVmr4FIGvqT:pR4t+OU+HpZDCj1QxDVmMFU
TLSH
T16974CB06F319C72AC459267E4CF993893234B2CE9F86A21B759943FD38B153D4D22B8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\v8_context_snapshot.bin
Size 695KB
SHA256 36476717691fdbdac6440b96c48e94e8938a97b775340b4734622fdbd731dfad
MD5 5e06f16a1bfd30965a4569b513e10d61
SHA1 4f48383f7bb502bc2f2fc03fd2bf8e553aee235a
SHA512 7fce5738219c8e901527393e89f37bf329305cabc0c368b3a1c7cd7d636394db11553560e6318ddde70d7e1a3a79d66d5bc2f76116c51ba7cd8bdfb157a03115
SSDEEP 6144:rS9cowVafAdRjt+OUjIuZDCj1cvN8bnecHRWSmMFImJpz6nl5Pbp5QCV/xdFzQ6S:LowAAl6vN8HRWSxmQz+bp5QO/xdNS
TLSH
T10FE494A2FB1ACF2FC58D267E5DEA86463534B08E5F4BC25B715403BC38B95780E29358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 22a2305e52d6cded30c0606c7cb44e25c1374dbbec08f5da183f91de0b1390a4
MD5 57ed221051a5124546848d413c7bf534
SHA1 37fa025e93d7fbeb3a6eeb21660221a35b3bc917
SHA512 c9ce057dd2f166cf75b2d4a4d8a6ef90376cba15ad182708ba24504cc7ee11f7937feb5414a874df573a1aa7e51c23e257e611300725315a11de6f34fef3fc09
SSDEEP 49152:ljso2Wp9s18LbsQCgJxAhgK4axTciCuE2aRj6q8U45uqPppkBXqyWwBgVGdWyKQS:ljd2WpM99ZKtA8h8AHwv
TLSH
T1E7462703F28680E9F05DD679875BA622F632F8814B2276DF56A01F192E77FE06739704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\7z-out\vulkan-1.dll
Size 917KB
SHA256 457ac4472ea01cdc7bf483629eed2118814611c79e39ea69304adb2509fe28ec
MD5 84ad45974c4d28380280efe0c25137c9
SHA1 0b6740c39c53fcfcd98c0e82bc3878ff0371d2dc
SHA512 0c0d7454cdd38146e9ee7bf296bde8fb368e3131a6da9b204bd4b02025de1cf9a44085c5f6741159f39f82284d7dcbb9078389bd9960d9d9da08b3b7ff2b5ceb
SSDEEP 24576:FgQmQinxRotX321+hvdK2S6Z5WGcSDYsHQDi6g3P0zAk79oOHHe:+N5nfotX32qFKb6Z5WGcSDYsHQDi6g3L
TLSH
T1DF155B1396958569D57AD038CDD28607C9B178822326B9CF02A817087F6FFF47B3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrEDF6.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\sharescreen\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 3b8cb0c91c4a173d0bf76dcf35e8fa67301aa1da870884979f4d94c3772b7a21
MD5 b67dde08042df217c8a14a023fde6b6c
SHA1 aca1b6dcd80537b42a68e5f696d32a103209757d
SHA512 250d700ba556dd30e0bf226b8a056d4632eb30410dcf4a014ec92b696ec5334eea57cd3f32526f7697b7f81b34b20038affdd77a8f126afca8fdceb8d4f1748a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\sharescreen\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 a71c1f384c43eff1b4c2e23637eefd5d1eeac7e51f98c9e0b014796783e57378
MD5 6c51e1c7bd359b6d13a6806d736754f9
SHA1 0fe69d598479f328c648eea7d3b14773404642e2
SHA512 4e8bdb7c26f1609ee67f03d1ac17e17245bfe092208915ad2d3e2469d2aa06f5996de1fbd58c5b4824e0280415bfd1952c46bb380c14624e4dc94d0c9319d052
TLSH
T1A501590804D250C0EF46337541521CC0ECB2C4DC4E749727B59E25A9EA9FBC5D609E05
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\sharescreen\Local State
Size 434B
SHA256 ba4b96f927439d438d35d0757f910ee492dd329c03a175fbaa323a14d33af99a
MD5 61fafb073e82d3671820d07ac00f00ec
SHA1 4d0482098484c023169ffc063fa6b318c509ad8c
SHA512 6a7f5f3a4c1265d1e60c754edd3e95a746a3eb9819a444da3c84103ae366c095153cd13797f146d31542ba07d8df3785925b89a74abeb23e3f8b295ae35ebc02
TLSH
T10DE0A3B355AB9B933A9D5978092965224DA842F7427D1B749C45131207F2904CA04C6D
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\sharescreen\Local State
Size 434B
SHA256 369673a97799a63aedc8680bbe70b4df9c4aef17914614c7bfb97287e3dc2848
MD5 db43564fd5ee476ccff6b863740f9325
SHA1 b4d1b71c0f5b3a59c44c2ca281bc7942208e3402
SHA512 7c18bc75e973ccb9a0b7d58313734fb55e75beccf6963300101a08f67600b7c8f4987d8de39e01f61c707fa1ef1e037e82f06092b7f9242602808bec296aa42a
TLSH
T141E0F1FA55975E5EA7A5A4B8111F3F2E0D18082B15A6B364FFC8471A1E39CC40B44C37
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\sharescreen\Network\Network Persistent State
Size 2KB
SHA256 cdde23f1f6b63f6cdce7a04f010df202f6962594a7468f68e5f63f967f84a44e
MD5 b1b7bfe4c66e4a647c873c2da5f97d98
SHA1 658dec2c2f84bfea61e8cbd22f7c381c033e2772
SHA512 ea2cae59624604903ce138490a24b34558598d5ced9fdbd9b972c51b75fc554e2fc4c789a9fe2f56ce31e24b2789a7412a7a4502ef4b8445e0245f5f3d05c472
TLSH
T166416CCAC7E8466DC55223F62B287E33C1BE1A1C42283D0689D9DF8F57E1871A25164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a9145.TMP

Path C:\Users\Admin\AppData\Roaming\sharescreen\Network\Network Persistent State~RFe5a9145.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\sharescreen\Preferences
Size 122B
SHA256 3489a9fcea842f7bd4152b6ac5a20d493dfba1fdadaec75b503c8e5ffa0d9042
MD5 c2211c33b4af50e74d888ca4d28f3fad
SHA1 804e6bad9e0d0deb2d4cd221803d362fe2c310fa
SHA512 83d929bb34348fa0552897b526eb97fe3568f5d00a04b2ed5d9e4446fe68f1ed38fc33c7eeefa02090cf15179fd3d9337b783ba0dbae2434ff745d60bfbd172e
TLSH
T104B02B03B4005033020A16A40007CF0A28AD00341D07F504D0E0F2A82429C4C084701B
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\sharescreen\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\sharescreen\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4274b5cfa384b95292f1a1ab501d2ea99aa208c8397d12ae448013e16a7e4f03
MD5 1b58507d7c39af7863c402f61dad4e1a
SHA1 d0797d201a5d7f58bac02173d268a9edd5802083
SHA512 f0ac39167f1881c925d5ff907c6f6a172f5e14fe28e7bfc562e711abd191c5832f6740fd233a1ed53bca61629383d5db772c72bf45ec849b98a3d2700184ad1f
TLSH
T152A0023D01404511C8A41FF1105655C667195EE9D307130142D143CA8E702A8C113580
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dc7b.TMP

Path C:\Users\Admin\AppData\Roaming\sharescreen\Service Worker\ScriptCache\index-dir\the-real-index~RFe59dc7b.TMP
Size 48B
SHA256 550c9adba7341d17fd291df294202868bd06995c1d1a2db3ce60995c24268cd0
MD5 5fb53a90ed95303a25406c0df0f0383d
SHA1 1f53bfe0516e896b4f0679b9e239be13dbe4ce91
SHA512 9fdd8337be5d2ef7f6007929cc922647ff1abddd80bc9b2565fc66235cc8365c055a8055916272b981360215b694e2ef8f91333cc82e90a104a9231b7a15e457
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\sharescreen\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/1940-629-0x00007FFBD8730000-0x00007FFBD8731000-memory.dmp

Download

memory/1940-903-0x000001C3D3140000-0x000001C3D3170000-memory.dmp

Download

memory/1940-628-0x00007FFBD8B20000-0x00007FFBD8B21000-memory.dmp

Download

memory/2012-880-0x00000218C4E70000-0x00000218C4EA0000-memory.dmp

Download

memory/3084-980-0x000001F40E800000-0x000001F40E801000-memory.dmp

Download

memory/3084-971-0x000001F40E800000-0x000001F40E801000-memory.dmp

Download

memory/3084-972-0x000001F40E800000-0x000001F40E801000-memory.dmp

Download

memory/3084-970-0x000001F40E800000-0x000001F40E801000-memory.dmp

Download

memory/3084-979-0x000001F40E800000-0x000001F40E801000-memory.dmp

Download

memory/3084-978-0x000001F40E800000-0x000001F40E801000-memory.dmp

Download

memory/3084-977-0x000001F40E800000-0x000001F40E801000-memory.dmp

Download

memory/3084-976-0x000001F40E800000-0x000001F40E801000-memory.dmp

Download

memory/3084-982-0x000001F40E800000-0x000001F40E801000-memory.dmp

Download

memory/3084-981-0x000001F40E800000-0x000001F40E801000-memory.dmp

Download

memory/4944-912-0x000001EE97C80000-0x000001EE97CB0000-memory.dmp

Download

memory/5024-891-0x00000286E96F0000-0x00000286E96F1000-memory.dmp

Download

memory/5024-892-0x00000286EEC60000-0x00000286EEC62000-memory.dmp

Download

memory/5024-893-0x00000286E96F0000-0x00000286E96F1000-memory.dmp

Download

memory/5024-894-0x00000286EEB60000-0x00000286EEB62000-memory.dmp

Download

memory/5024-896-0x00000286EEB50000-0x00000286EEB53000-memory.dmp

Download

memory/5024-897-0x00000286E96F0000-0x00000286E96F5000-memory.dmp

Download

memory/5024-898-0x00000286EE710000-0x00000286EE711000-memory.dmp

Download

memory/5024-901-0x00000286EEA70000-0x00000286EEA73000-memory.dmp

Download

memory/5024-902-0x00000286EE710000-0x00000286EE716000-memory.dmp

Download

memory/5024-899-0x00000286EEA60000-0x00000286EEA62000-memory.dmp

Download