813e4c97017c6bbd28b2f8dc67c46f64e1081015ea383275ff127a5050edc0fe

Analysis

user interaction
yes
max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lunar Client - Installer.exe
Size 3.1MB
Sample260930-sawsdsaf87
SHA256 813e4c97017c6bbd28b2f8dc67c46f64e1081015ea383275ff127a5050edc0fe
MD5 419fb072f52a8eadd1e84d6c7f303551
SHA1 28becfac8f12a67947951312eb719932ede800b1
SHA512 953ab775ac38f07fe2857bdf9583377336787b7cc73d063686ceacb2aaf52bd2e17e428ed875bf9c6a9a2d27f6458a2ea46eee8c6acd2e60031da49edb7acf05
SSDEEP 49152:omA3ABS2xE87vxpsrFpIvQV0aiF4hkCsihYEXOpw3UhsooAFhR8MlhqLAEqct:ohOSoPN+TIv6a4hFRuoOCkhsbc8Mmk
TLSH
T133E523E8B820DC3DEA310FF9B6E4C546E7788D39681855897721B5853E32D8EED0392D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6468	powershell.exe
6364	powershell.exe
6380	powershell.exe
6228	powershell.exe
6268	powershell.exe
6480	powershell.exe
6424	powershell.exe
6340	powershell.exe
6324	powershell.exe
6244	powershell.exe
6236	powershell.exe
6292	powershell.exe
6252	powershell.exe
5640	powershell.exe
6276	powershell.exe
6492	powershell.exe
6300	powershell.exe
6260	powershell.exe
3892	powershell.exe
6504	powershell.exe
6452	powershell.exe
6436	powershell.exe
6404	powershell.exe
1864	powershell.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	Lunar Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	OWinstaller.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4656_2129929165\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4656_91009142\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4656_91009142\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4656_457652861\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4656_2129929165\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4656_91009142\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4656_457652861\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4656_457652861\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4656_2129929165\protocols.json	msedgewebview2.exe

Executes dropped EXE 7 IoCs

pid	Process
4452	OWinstaller.exe
2768	ow-electron-setup.exe
4784	Lunar Client.exe
5776	Lunar Client.exe
3960	Lunar Client.exe
3224	Lunar Client.exe
5652	Lunar Client.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2144	powershell.exe
6364	powershell.exe

Loads dropped DLL 30 IoCs

pid	Process
3952	Lunar Client - Installer.exe
3952	Lunar Client - Installer.exe
3952	Lunar Client - Installer.exe
3952	Lunar Client - Installer.exe
3952	Lunar Client - Installer.exe
4452	OWinstaller.exe
4452	OWinstaller.exe
4452	OWinstaller.exe
4452	OWinstaller.exe
4452	OWinstaller.exe
2768	ow-electron-setup.exe
2768	ow-electron-setup.exe
2768	ow-electron-setup.exe
2768	ow-electron-setup.exe
2768	ow-electron-setup.exe
2768	ow-electron-setup.exe
2768	ow-electron-setup.exe
2768	ow-electron-setup.exe
2768	ow-electron-setup.exe
4784	Lunar Client.exe
4784	Lunar Client.exe
4784	Lunar Client.exe
3960	Lunar Client.exe
3960	Lunar Client.exe
3960	Lunar Client.exe
3960	Lunar Client.exe
3960	Lunar Client.exe
3960	Lunar Client.exe
3960	Lunar Client.exe
5652	Lunar Client.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OWinstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5576	cmd.exe
1184	cmd.exe
6020	cmd.exe
5616	cmd.exe
3724	cmd.exe
4392	cmd.exe
6084	cmd.exe
5640	cmd.exe
4924	cmd.exe
6524	cmd.exe
4880	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OWinstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ow-electron-setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OWinstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ow-electron-setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Lunar Client.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunar Client - Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ow-electron-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DxDiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DxDiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DxDiag.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Lunar Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Lunar Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Lunar Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Lunar Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Lunar Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Lunar Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Lunar Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Lunar Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Lunar Client.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.lcpack\OpenWithProgids	ow-electron-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\lunarclient\shell\open\command	Lunar Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.dawnpack\OpenWithProgids\Dawn Pack = "0"	ow-electron-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\lunarclient\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Lunar Client\\Lunar Client.exe\" \"%1\""	Lunar Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Dawn Pack\shell	ow-electron-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Dawn Pack\shell\open	ow-electron-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	DxDiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Lunar Client Pack\ = "Lunar Client Profile Pack"	ow-electron-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.lcpack\OpenWithProgids\Lunar Client Pack = "0"	ow-electron-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Lunar Client Pack\DefaultIcon	ow-electron-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Dawn Pack\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Lunar Client\\Lunar Client.exe,0"	ow-electron-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\lunarclient\shell\open	Lunar Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	DxDiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.lcpack\ = "Lunar Client Pack"	ow-electron-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Lunar Client Pack\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Lunar Client\\Lunar Client.exe \"%1\""	ow-electron-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	DxDiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Lunar Client Pack\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Lunar Client\\Lunar Client.exe,0"	ow-electron-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Lunar Client Pack\shell	ow-electron-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Dawn Pack\shell\open\ = "Open with Lunar Client"	ow-electron-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\lunarclient	Lunar Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.lcpack	ow-electron-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Lunar Client Pack\shell\open\ = "Open with Lunar Client"	ow-electron-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Dawn Pack	ow-electron-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\System32\\dxdiagn.dll"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	DxDiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Dawn Pack\ = "Dawn Profile Pack"	ow-electron-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\lunarclient\shell	Lunar Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Lunar Client Pack	ow-electron-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Lunar Client Pack\shell\ = "open"	ow-electron-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.dawnpack	ow-electron-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.dawnpack\OpenWithProgids	ow-electron-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\lunarclient\URL Protocol	Lunar Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Lunar Client Pack\shell\open	ow-electron-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Lunar Client Pack\shell\open\command	ow-electron-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Dawn Pack\shell\ = "open"	ow-electron-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Dawn Pack\shell\open\command	ow-electron-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\lunarclient\ = "URL:lunarclient"	Lunar Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	DxDiag.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5500	reg.exe
3296	reg.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4452	OWinstaller.exe
4348	DxDiag.exe
4348	DxDiag.exe
2144	powershell.exe
2144	powershell.exe
2144	powershell.exe
3892	powershell.exe
3892	powershell.exe
3892	powershell.exe
2768	ow-electron-setup.exe
2768	ow-electron-setup.exe
1864	powershell.exe
1864	powershell.exe
1864	powershell.exe
3024	msedgewebview2.exe
3024	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4656	msedgewebview2.exe
4656	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	OWinstaller.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeIncreaseQuotaPrivilege	1864	powershell.exe
Token: SeSecurityPrivilege	1864	powershell.exe
Token: SeTakeOwnershipPrivilege	1864	powershell.exe
Token: SeLoadDriverPrivilege	1864	powershell.exe
Token: SeSystemProfilePrivilege	1864	powershell.exe
Token: SeSystemtimePrivilege	1864	powershell.exe
Token: SeProfSingleProcessPrivilege	1864	powershell.exe
Token: SeIncBasePriorityPrivilege	1864	powershell.exe
Token: SeCreatePagefilePrivilege	1864	powershell.exe
Token: SeBackupPrivilege	1864	powershell.exe
Token: SeRestorePrivilege	1864	powershell.exe
Token: SeShutdownPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeSystemEnvironmentPrivilege	1864	powershell.exe
Token: SeRemoteShutdownPrivilege	1864	powershell.exe
Token: SeUndockPrivilege	1864	powershell.exe
Token: SeManageVolumePrivilege	1864	powershell.exe
Token: 33	1864	powershell.exe
Token: 34	1864	powershell.exe
Token: 35	1864	powershell.exe
Token: 36	1864	powershell.exe
Token: SeSecurityPrivilege	2768	ow-electron-setup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4452	OWinstaller.exe
4348	DxDiag.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4452	3952	Lunar Client - Installer.exe	85
PID 4452 wrote to memory of 4348	4452	OWinstaller.exe	89
PID 4452 wrote to memory of 4656	4452	OWinstaller.exe	90
PID 4656 wrote to memory of 4856	4656	msedgewebview2.exe	91
PID 4656 wrote to memory of 4344	4656	msedgewebview2.exe	95
PID 4656 wrote to memory of 4344	4656	msedgewebview2.exe	95
PID 4656 wrote to memory of 4344	4656	msedgewebview2.exe	95
PID 4656 wrote to memory of 2732	4656	msedgewebview2.exe	96
PID 4656 wrote to memory of 1904	4656	msedgewebview2.exe	97
PID 4656 wrote to memory of 1904	4656	msedgewebview2.exe	97
PID 4656 wrote to memory of 1268	4656	msedgewebview2.exe	98
PID 4656 wrote to memory of 1268	4656	msedgewebview2.exe	98
PID 4656 wrote to memory of 1268	4656	msedgewebview2.exe	98
PID 4656 wrote to memory of 4556	4656	msedgewebview2.exe	100
PID 4656 wrote to memory of 4556	4656	msedgewebview2.exe	100
PID 4656 wrote to memory of 4556	4656	msedgewebview2.exe	100
PID 4656 wrote to memory of 4368	4656	msedgewebview2.exe	117
PID 4656 wrote to memory of 4368	4656	msedgewebview2.exe	117
PID 4452 wrote to memory of 2768	4452	OWinstaller.exe	121
PID 2768 wrote to memory of 2144	2768	ow-electron-setup.exe	122
PID 4656 wrote to memory of 3688	4656	msedgewebview2.exe	124
PID 4656 wrote to memory of 3688	4656	msedgewebview2.exe	124
PID 2768 wrote to memory of 3892	2768	ow-electron-setup.exe	125
PID 2768 wrote to memory of 1864	2768	ow-electron-setup.exe	127
PID 4656 wrote to memory of 2148	4656	msedgewebview2.exe	130
PID 4656 wrote to memory of 2148	4656	msedgewebview2.exe	130
PID 4656 wrote to memory of 3024	4656	msedgewebview2.exe	131
PID 4784 wrote to memory of 6084	4784	Lunar Client.exe	135
PID 6084 wrote to memory of 6140	6084	cmd.exe	137
PID 4784 wrote to memory of 5776	4784	Lunar Client.exe	138
PID 4784 wrote to memory of 3960	4784	Lunar Client.exe	139
PID 4784 wrote to memory of 3960	4784	Lunar Client.exe	139
PID 4784 wrote to memory of 3224	4784	Lunar Client.exe	140
PID 4784 wrote to memory of 5640	4784	Lunar Client.exe	141
PID 4784 wrote to memory of 5652	4784	Lunar Client.exe	142

C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe" Sel=0&Extension=jilehohlakeokncafogkgnicgndeecdiengddbcc&UtmSource=client-site&UtmMedium=download-page&UtmCampaign=direct&Browser=firefox -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://launcher-releases.lunarclientprod.com/master/6e18b5a4f4ebbd4c7ecff572f1700cedce1f248bcb157adce5ec49be9e081a23/latest-ow.yml -AllowWindowsInsider --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --eula-url=https://www.lunarclient.com/terms --privacy-url=https://www.lunarclient.com/privacy --silent-setup --app-name="Lunar Client" --auto-close -exepath C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\System32\DxDiag.exe
    "C:\Windows\System32\DxDiag.exe" /xC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.xml
    3⤵
    - Drops file in System32 directory
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --high-dpi-support=1 --mojo-named-platform-channel-pipe=4452.2928.10265785703150744936
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ff8235ab078,0x7ff8235ab084,0x7ff8235ab090
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,11510252928519554988,3264850627210993114,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,11510252928519554988,3264850627210993114,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1752,i,11510252928519554988,3264850627210993114,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3616,i,11510252928519554988,3264850627210993114,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:1268
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3884,i,11510252928519554988,3264850627210993114,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1032,i,11510252928519554988,3264850627210993114,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4868,i,11510252928519554988,3264850627210993114,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2212,i,11510252928519554988,3264850627210993114,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5048,i,11510252928519554988,3264850627210993114,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3024
- - C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-jilehohlakeokncafogkgnicgndeecdiengddbcc\ow-electron-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-jilehohlakeokncafogkgnicgndeecdiengddbcc\ow-electron-setup.exe" /S --force-run /d="C:\Users\Admin\AppData\Local\Programs\Lunar Client"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      4⤵
      Enumerates connected drives
      Hide Artifacts: Ignore Process Interrupts
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2144
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3892
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Lunar Client', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1864

C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe
"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:6140
- C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe
  "C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\lunarclient /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\lunarclient\Crashpad --url=https://f.a.k/e --annotation=_productName=lunarclient --annotation=_version=3.7.21-ow --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=39.8.12 --initial-client-data=0x53c,0x538,0x550,0x4c8,0x548,0x7ff65fe0610c,0x7ff65fe06118,0x7ff65fe06128
  2⤵
  - Executes dropped EXE
  PID:5776
- C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe
  "C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,6407154278510980844,10510628859250936036,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3960
- C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe
  "C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --field-trial-handle=1940,i,6407154278510980844,10510628859250936036,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-WmiObject Win32_VideoController | ForEach-Object { $_.Name }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5640
- C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe
  "C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=cs --cs-app=lunarclient --uid=jilehohlakeokncafogkgnicgndeecdiengddbcc --phase=92 --muid=46640745-cc7c-441b-a342-5006756a8d68 --muidv2=aabf1b2f-960c-4f27-a17a-08e89687fb6e --version=39.8.12 --first-run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  PID:5652
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Lunar Client"
  2⤵
  - Modifies registry key
  PID:5500
- C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe
  "C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --app-user-model-id=com.moonsworth.client --app-path="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1790779645510619 --launch-time-ticks=697384010 --field-trial-handle=1940,i,6407154278510980844,10510628859250936036,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1560
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Lunar Client" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe\" --hidden" /f
  2⤵
  - Modifies registry key
  PID:3296
- C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe
  "C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --app-user-model-id=com.moonsworth.client --app-path="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1790779645510619 --launch-time-ticks=698972936 --field-trial-handle=1940,i,6407154278510980844,10510628859250936036,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:11596
- C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe
  "C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --app-user-model-id=com.moonsworth.client --app-path="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1790779645510619 --launch-time-ticks=699971084 --field-trial-handle=1940,i,6407154278510980844,10510628859250936036,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=5080 --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --app-name=lunarclient --muid=aabf1b2f-960c-4f27-a17a-08e89687fb6e --phase=92 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
  2⤵
  PID:12028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron""
    3⤵
    - Executes a command shell one-liner
    PID:6020
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron"
      4⤵
      PID:856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron""
    3⤵
    - Executes a command shell one-liner
    PID:5616
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron"
      4⤵
      PID:1792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  PID:5576
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "dxdiag /t "C:\Users\Admin\AppData\Local\Temp\dxdiag_output.txt""
  2⤵
  - Executes a command shell one-liner
  PID:1184
- - C:\Windows\system32\dxdiag.exe
    dxdiag /t "C:\Users\Admin\AppData\Local\Temp\dxdiag_output.txt"
    3⤵
    PID:3120
- C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe
  "C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,6407154278510980844,10510628859250936036,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcASwBlAHkAYgBvAGEAcgBkACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A"
  2⤵
  - Executes a command shell one-liner
  PID:3724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcASwBlAHkAYgBvAGEAcgBkACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A
    3⤵
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcATQBvAHUAcwBlACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A"
  2⤵
  - Executes a command shell one-liner
  PID:5640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcATQBvAHUAcwBlACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A
    3⤵
    PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "WHERE smartctl 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4924
- - C:\Windows\system32\where.exe
    WHERE smartctl
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  - Executes a command shell one-liner
  PID:4392
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_DiskDrive | select Caption,Size,Status,PNPDeviceId,DeviceId,BytesPerSector,TotalCylinders,TotalHeads,TotalSectors,TotalTracks,TracksPerCylinder,SectorsPerTrack,FirmwareRevision,SerialNumber,InterfaceType | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6228
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-PhysicalDisk | select BusType,MediaType,FriendlyName,Model,SerialNumber,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6236
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6244
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_SoundDevice | select DeviceID,StatusInfo,Name,Manufacturer | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6252
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6260
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6268
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6276
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_baseboard | select Model,Manufacturer,Product,Version,SerialNumber,PartNumber,SKU | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6292
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_physicalmemoryarray | select MaxCapacityEx, MemoryDevices | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6300
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_ComputerSystemProduct | select Name,Vendor,Version,IdentifyingNumber,UUID | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6324
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6340
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:6364
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6380
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6404
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6424
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6436
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6452
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_SystemEnclosure | select Model,Manufacturer,ChassisTypes,Version,SerialNumber,PartNumber,SKU,SMBIOSAssetTag | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6468
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Battery | select BatteryStatus, DesignCapacity, DesignVoltage, EstimatedChargeRemaining, DeviceID | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6480
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-WmiObject -Class BatteryStaticData -Namespace ROOT/WMI).DesignedCapacity"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6492
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance -Class BatteryFullChargedCapacity -Namespace ROOT/WMI).FullChargedCapacity"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  - Executes a command shell one-liner
  PID:6524
- C:\Windows\System32\dxdiag.exe
  C:\Windows\System32\dxdiag.exe /x C:\Users\Admin\AppData\Local\Temp\dxdiag-H9rAq7\dxdiag.xml
  2⤵
  PID:6540

C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe
"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --hidden
1⤵
PID:11856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  PID:4880
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4656_2129929165\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4656_2129929165\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4656_457652861\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4656_91009142\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

main.log

Path C:\Users\Admin\.lunarclient\logs\launcher\main.log
Size 1KB
SHA256 59e084dc2129c304987da0f4bdd7389d8668fa8913e2aba1ad7b77ff2a2ec391
MD5 3afede389dd70bc601c4b556f429d4e0
SHA1 0ac4d707d1660fba9b558acc407974aab3830f48
SHA512 98b45c246a0cf5a78e7f94d71ebe0f02234332b9028c7debb5a82a2032da2581b45bdb64c45f57c8448885a05b3cff5bd04de40918f4c62f9814d0780bfcede5
TLSH
T131316E423AE820FB515D4741E4CF8E4CF0147A662E8AEF0C796F443A6390D289ACBC0D
MD5 SHA1 SHA512 TLSH

Submit Download

main.log

Path C:\Users\Admin\.lunarclient\logs\launcher\main.log
Size 2KB
SHA256 ec061df052ea7ef3e32c7beb3f39e10c3306c3211bc3b1aa38f06279c70f86c8
MD5 04ca35a3f322cdf779848a0cf85d1303
SHA1 46d7e769172edb33b3fd6752ab10fae96947d20b
SHA512 60358c8d7dba9d06639426284da7867c3f0faa5f60c485792332bf64c04535dc690dc5daf3ffac8660599194ed4f5f9e37a7a67f9f5976de2046b270cfaa567b
TLSH
T1894161463AE820F7955D4741E4DF8F4CF0147A662E9AEF0C396F493A6390D289AC7C0D
MD5 SHA1 SHA512 TLSH

Submit Download

main.log

Path C:\Users\Admin\.lunarclient\logs\launcher\main.log
Size 3KB
SHA256 cee28c039cfdc61069897b9d1cf44f8a0450262f8307aab169f14756073b7326
MD5 51e4f7784ed517b8d81105e8c267bf59
SHA1 0db44e2ba71e7662a70ba6557e1fcb9b20a16978
SHA512 169195b2f8263143b3f4db0d2e3085aba4f086c59381441b980f9e65f9cdae20a4d77d375105045ade0bbe42873098ec9c2423cd3228936ff25c0f0b0c9e592c
TLSH
T165715C462AE820F7855E4741E5DF8F5CF0247B2A2E86EE0C796F443E6790D689AC7C0D
MD5 SHA1 SHA512 TLSH

Submit Download

main.log

Path C:\Users\Admin\.lunarclient\logs\launcher\main.log
Size 4KB
SHA256 bf7c9f487152579ef287901da2bd85d141778e9551a788e563f8fbd471454a2e
MD5 1ef9cfde01a191a72637e8230fd72014
SHA1 dfd8e8d6b13e0414f84490fbc235ca72ad8e656e
SHA512 e7ea2d889bce3488464447d1f7a7088fd07bf1fae66a625de666c73563cd2b73902346a25abbebc514203149489e5bc0b973c8a5d2e81bf690dd5dae2da6796b
SSDEEP 96:oUH6Hbs3mOoQIf9uHenyMKMyDMMEMjMxMqMsMQiQEdIWU5sH:6s3muw7fX/MwK3tQiQIIWr
TLSH
T1E3915B451AE860F7457D4B41E8DF8F5CF020BB1A2E86EE1D356E442F6795C1CAAC380D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Users\Admin\.lunarclient\logs\launcher\updater.log
Size 664B
SHA256 b1a43f0d4bf2cd3e3a7bec463f4f4ff1ec72150fae8c634e694c75eebabf69e5
MD5 9c2af99f26024ab064fc39e5a89a8132
SHA1 03d91aa37b78e308e7448da4054b1c476d869c85
SHA512 4e57f7fd2a6231bec108b66db9b394cd495c07eb18108932246a39931616fc2d38ecde4279a3c6ffc55a5aac9b231f9cc46df2a690aecc553de6bf12138eb9ed
TLSH
T1E501D6051ADA51F321586710E89ACFAC574C222AAE42EE61B2DE40752326F194CDF11C
MD5 SHA1 SHA512 TLSH

Submit Download

window.log

Path C:\Users\Admin\.lunarclient\logs\launcher\window.log
Size 1KB
SHA256 7bf23cc7377d10addca9dab64f7bf9f4436dd26da7d9745cadc97a9219e0e2e3
MD5 c9e017572fb45fbfd4212bea426c3d8b
SHA1 2dc13065e3cfa7bfd5c75fef798d0168ec0ac989
SHA512 e74a025e000a938ab806f75bdc12b693b3d964019bbcf903a6474f0432bdb7c5287b9dd6398940ec579fbca15354a629bd3958488acfe65846cc87bc9c4fbe18
TLSH
T1C8316E431AE930FB20FD8A48E9A79FCC30547B321A44AF5531EC41697BE29175ADB84C
MD5 SHA1 SHA512 TLSH

Submit Download

cache.json

Path C:\Users\Admin\.lunarclient\settings\cache.json
Size 150B
SHA256 c51b3cab39fa230c7c575ac4fd2260d4e3d2cfb7c321cd1d5f4ed92a91806f74
MD5 dbb02ee30ef184543349c252d8a1680e
SHA1 977c8bf32117c67a6137a127c9c7dcd9c4783251
SHA512 6e34675a5ab09f6ab7910ed2eb6b7d867303c8bc0fef1041fbe6ceabdd3ae6dc8fd7d9127e5ffdc1964288dcd776354d6df3ab24e357645c8a257a9940d831eb
TLSH
T1F4C08C03DABFC56312C80B0C0D28A0C0D62440AD04E1492A6C83990C422602802632AB
MD5 SHA1 SHA512 TLSH

Submit Download

cache.json.tmp-078033910858fe6b

Path C:\Users\Admin\.lunarclient\settings\cache.json.tmp-078033910858fe6b
Size 153B
SHA256 89329b5c8248477aab74f07ff1cc3f3000260b0103ae7b1f6cfe7fb770df0488
MD5 8d3ae53451fc0f7e7e42e46265dab913
SHA1 76e5f37e017f05a2968d7867f8eeb6f40d48da91
SHA512 72610bc539f8ff7e59692f51063ea823481f81044d0afad78dfa383a749b5bbb8edf3016b8baf84b02b972591e6099c23e216be52f43446fdd6e5bd2d502351e
TLSH
T1F2C08C03DABFC56305C80B1C0D28A0C0E62484AD14E1092E4C46990C822601802232AA
MD5 SHA1 SHA512 TLSH

Submit Download

cache.json.tmp-0780343458d5e1b3

Path C:\Users\Admin\.lunarclient\settings\cache.json.tmp-0780343458d5e1b3
Size 331B
SHA256 c1c3a2a4e7508898087e1d0bc10f55987694b3e8190ac23d88603f695115e719
MD5 cb3115552b40159a2bdd245b9b91e21e
SHA1 9df10eb90956791a73c7018517a095fc10822a71
SHA512 1c9caf4f955598e1dcd73d4db7cbbb8a1774668ae044c0321f973ceab92238558d7830ff7dc4794a253bd969102e4d8f29b766baea67cd3d0e59cec4dc54f21f
TLSH
T1F5E07D63EBBF815384E8071C8DACB1C0F628C4BD05D04DBFB916564C81E10380A3706B
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 496B
SHA256 30d62315765062468955c238b4b41a17a99cee32a60f3a13b254ba80a5138712
MD5 198bc1b33c62e9b2aeff96f067f7c76b
SHA1 2d1d0d45eb763eddbb50f114938009a163ca0da2
SHA512 a9c44a0efaaf84789e1e0d83085817d663a9a65d3fac84612841377570bb13c64d5036975e6f08a52654f27a2be48d9022e0610f88038c321d68fb1f0f6c4e4c
TLSH
T1D8F00E33E26D547F04E1429C4C3CD0C0C034442FA7C72DFFCC4A6D1C069A6A802539E2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 306B
SHA256 a7b7f2886cbb7bdb258982c6e622ef4981a2d43d198572aa6b562a0ddc68d60d
MD5 15d6ddf978a6b5ec2b9dcac065ce7be8
SHA1 b3d2867cd6ffd1808a5117d84bd1a2365af0478a
SHA512 31cc2f5d2d50cbdda2c940ed7dbf8d7fe1925a00dfa32d08d62c9e95b1af848fb839f27ac72d1e8da24a2a93f9dd5504358de2669d90e02f629e5274fa48bef8
TLSH
T1CBE07D27F158696D41D64E8CA47C12D1C138006A27431E8BCF6439642DE7AF850A39E1
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 410B
SHA256 328c458a470476769f6def18d380d5c39b9183a751749c550d0bdd72f2920990
MD5 8c3e835a6d6140cd0de011cdaf7f9eca
SHA1 1d30c6a67cbfae5353219adba2b2798c02f8bd35
SHA512 a5e30a88d0edf22a464593f140da813c0b4c4b63ab6e40b7a14b93571d43e264875a8a42b47b1f28337e5888cb64b91f264e9505687571aec69973a0a99c3490
TLSH
T1A0E02B27E258A5BF41D95BCD6C3C51C2C274006B26431ECFCE9835505AA6AF8A0A2E92
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 511B
SHA256 90a3990a8043179b74ab487249567de2c9a557f2d5df306823e2e86333624dd5
MD5 475b1bfc7d297dafa00515d486d4613e
SHA1 265925cc674e033b2fe4021f1a45165e6fd5782e
SHA512 5a0646caef21044aa6b1e67d5bfa43372b67e04c3c0d7d8ee5e958127ce24992f1243c081ec0dc162ebce4ccb2598a9afe96ad5e80a952ed4d9f5f8eba282c65
TLSH
T1D0F05923E35DA5FF05D95B8D5D3C91C1C638002B26832DDFCE45345456AA5F860A2ED2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 614B
SHA256 f69efa0c895c4de3ff79c6359061a1ff9c7e3279c822785b016170fb79e7404c
MD5 2571d11d356ccd80350b7eacf6f0f0db
SHA1 b51ae45c4a99e37c83bd2f077ed180dba918e604
SHA512 7996064c0323a99c938e08ea56acdacb8b5d0f17b088a82f84230c5b985ba90bbbf2fb7aa5c585dafbc1d4eddad023ee7410d2545328d53da089467d375ea43d
TLSH
T174F02623E25DA5BF41D55A8D5C3C41C1C67C001B26831D9FCE45345415A66F860A6EA1
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 511B
SHA256 e9acaf2d3ac9a4f96fcc58a07f1f050dea36fade75a34d482c7b3e2435ded042
MD5 db09ba92a05b25668dfe4f17e1ab971f
SHA1 fafbe8b9eb10678aef9fc5cf217aaf33ab7245c4
SHA512 581f65299844527681985d6c7da0c0c2afb66f0723fac1aba63e60872a62f6b9f7c8d10741d13ad01f33dc1cb600e14095dc302f6c8a0d26db70ca3c97ac68eb
TLSH
T113F05923E35DA5BF05D95B8D5C3C91C1C638002B26832DDFCE46345456AA9F860A2ED2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 511B
SHA256 71efbffe605718b2ca9076bf1078aa8db3ce00037154430becd33fba59ded9d4
MD5 cfc6a2656fc256d6540b6b3a2afe6bcc
SHA1 9e5997b1cec6d9eb8c5c766f51ad0ee441937c33
SHA512 d1f193d79d57499e9708b4d424c1d319aaf452fc80bf02d4cc5f309e2e38e7c16cbfde510f11c5964da49c4562abaad8b4b3cb603d7507ced8e16394c8cc937c
TLSH
T166F0C923E35DA5FF02C95B8C1C3C80C1C238002B26832DDFCE45344006AA5F860A2ED2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 587B
SHA256 f980e4439488418ce3126dc8993219397d2f5a6b512ba97a850cb540518bc5c7
MD5 84ad40f22d333ba1dd77aa2690eb594a
SHA1 86e7c2b961d27d8e88260f09bee7bb585a5c510f
SHA512 5137411ff1d7b6f74ae2c30284c5096ea37483f33d99c95d6f0178c2405567af9f6170e199422ff4b4b19c72c9ecda834aa7764810b6e58bd3a40f3f6c7ecf5b
TLSH
T167F0AC23D35DA0FF01E44B8D5C3C90C1C63C002B26831DEFCD05345406A6AF861A3EE2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 483B
SHA256 caf404f600bb11236e70cdca602bac80a746b3a3a9666f590e5df77ba9cda525
MD5 e8620d728292c2e6b375ead63770fd14
SHA1 84e14d681e9bb75de0d8fade27b554fa4107b352
SHA512 50ecb5d0778ecc64e2ee5308ee8f9c726db4baf0f0b773e6804d36c9bf015a1b465370ff54580691536add38a2e6f8afb61ac0a60f22c055a6c3d2a099716140
TLSH
T131F09E23E39D94BF41E14A4C583C91C1C63C402B56871DBFCE11285819BB9F451A7AF1
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 483B
SHA256 934ad051d3f415cf24c006eb8bbe5dd8e09766da4044112bc464253b899c96e0
MD5 60eb68d35fd139204cde506b551ea977
SHA1 235e768052aeb07d581303e18f611a17be76f27d
SHA512 5231327e59af4f710b3f5cba779a813be94868e963588fa436f7014ceacb9cc003ccb82206d2c7f86746f287a74a89571d5fab0f712f6e4bf2a4e7f2e81016f6
TLSH
T122F09E23E35D94BF41E54A4C583C91C1C63C402B56871DBFCE11245815BB9F451A7EE1
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 484B
SHA256 36359c00c8fe4fbb3fe9522b2ac22af5f1f23a1bcbd954744070b2d62272b522
MD5 093de2bea617d6882f16f68aba299e52
SHA1 db500ec1312787106696f5b56ddb43055b3a2bfe
SHA512 456af245d063efed1b2b39715aadf7ceb7a6f0f88bc1c8b8ed0fed138b93c2d4e2c5c7ba535bde7074800b3add6fd800d36ace1fddca37e54ecf461de29dec6e
TLSH
T17BF09E23E35D95BF45E14A4C583C91C1C63C402B56871DBFCE15245816B79F451A7AE2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 483B
SHA256 48c355091466b0cf95aaa658846754a9a999ba376822d0fdfb4be658d18a0bce
MD5 554ede6d249e5571fb75ab7b52d01bd1
SHA1 82853c687be365b957b8da50e0ad3467c98010f9
SHA512 8946adb50322a360d950957aa6bb4f7d28cf55164306077eef05a46f27f6628ed3debff2801d16be0098507d0cefcb5c4034e43a1c3cf11f70b2b84be9555f67
TLSH
T1C7F09E23E35D94BF41E14A4C583C91C1C63C403B5A872DBFCE11245915BB9F451A7AE1
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 483B
SHA256 7f46478accf0359d797b4b759eb61164c57a5f870c8ed32ef9a94837ebeb7ee0
MD5 0f527587f20e9b45168cc044205e7f3b
SHA1 3fdd855b5980f1e259f3ce583482458407a713d7
SHA512 43970814bf5b74a7cbf1f38b0a2ebdb85397a14a6b4095e4534d64448ee27d6d76112f620fe2ea6e5159c3ab5b0b5172e8b27690bdd193cc1f8a1f008a8721e2
TLSH
T156F09E23E35D94BF45E18A4C583C91C1C67C402B56871DBFCE11645815BB9F451A7AE2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 483B
SHA256 b140ada6c87e91b1fabc1e009380ef1747d40f8089af298dab3dcaa97f45a5f4
MD5 13edbf62640ddd63ea0afb59cf3f8958
SHA1 deb76a030c7126bf9afce3f602ed0fa21f3623ce
SHA512 1a8753ba78ac2d162fda87083501e6e856247f9fb301e07dcc33e3a1b0ceba03854750dd967ac16e0a7604caafcb61ffcd67cd9ad22a6f7dd5825f577384820e
TLSH
T14AF09E23E35D95BF41E14A4C583C91C1C63C402B56871DBFCE11245815BB9F451A7AE1
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 515B
SHA256 10378adc5eca7ac782f4c59e9d2e676b30b48aadc0504baa02aa4264ae2de2a3
MD5 4a115e4dd8c468988c56b2836b61e87c
SHA1 18d53833e638713bcea27c5afce56ac0a2776eee
SHA512 c00ad8ee93d8302bf8c1fc17434bbd943ad39404ceb985166f00059e34075fce209454e297ef904e8197dc6b1c8a3fb58a82c85f8e722d2bf136c4d14585ba5f
TLSH
T1F8F0C033D34D55BF41E14A4D5C3C91C1C67C402755471DBFCE15281815A79B450739E2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 515B
SHA256 891d2561455ea51ad9fa4b830c557ac2710891ca2f6b51c5062d2c9e39c084c9
MD5 f7f9bdd3b4345cc3fae67052c0447425
SHA1 133a64d5757cd887fc0a8e992261a67cc0200ef3
SHA512 499ab6075747a6583f6d4c6b1e5b7622f1cb7c643bc08eddff323399ef3a4a34131cf4fc3dfbf9280eef527a14293626190d0bbc3a3f1d38dad1829eb857b91d
TLSH
T113F0C033D34D55BF41E14A4C5C3C91C1C67C402755471DBFCE15281815A75B450739E2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 430B
SHA256 33ab7777301e113db9d6115fd8a5da84678a78fb8e76d304a5669fe4c1d73a4b
MD5 ff5d67f92a6e183beafb9b76a2944d83
SHA1 bacfe4b017658478421cd261e8cd04a50ae8389f
SHA512 354872ee748e106fe928c8c9bbe07315fcb909e5033ede17f357599a2f1e0319bcd8f6af7878187d35aafe72ea0af7fcab42194839e089ef26355d5ac870400d
TLSH
T177E0A333D39D557F45E5829C5D3CD0C0C178406B59871DBFCD12595815EB5F811639E2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 433B
SHA256 eeb6d3ff7555e80c92a97eeac06ae07c7a219080a8a1dc56fb94a0393100a8b1
MD5 d681bb06c3678c233ee36777e8007643
SHA1 60f4820cdad839d1f062be4a2bb82886eae023b7
SHA512 44b4441663031c3804b11e4b549c74741b9f5861f2146fc77f63d7a26320f911af509b1c886c68708ca3b727c690530a11f46064ef00a0626364cdf11531fe50
TLSH
T188E0A333D39D557F45E5829C5D3CD0C0C178406F59871DBFCD12595815EB9F811639E2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json.tmp-078033847396ee94

Path C:\Users\Admin\.lunarclient\settings\launcher.json.tmp-078033847396ee94
Size 592B
SHA256 5e74cdf0066dcf159b9170d5d63a7d4aee92a60b42ad90a476e5d0bce52b4f4b
MD5 b58155278c71207812b5546dd966ae85
SHA1 7543fbb652f2c47be73d0db4aa91033772989c4d
SHA512 34265bd865d0ae6b5efcce36b254425bd87c14580d0921cdad98ef9a0a4ecfe058288eb056bf54021495ad0e4c05593581bc5d9e6a4d472ea277a9a2e6f804e8
TLSH
T18AF0F463E25DA5FF41D91F8D5C3C81C2C67C402B26831D9FCE49345455A66F860A6EA1
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json.tmp-0780338486c6550c

Path C:\Users\Admin\.lunarclient\settings\launcher.json.tmp-0780338486c6550c
Size 511B
SHA256 883f1e90544dc10e68ebdc371a28978d54ccd6c3049579d9a661d4ca91bb572f
MD5 478318d6dcc8e2cb2da8366d3b76b0b3
SHA1 4715118a7973d1c201faffbf2a0463e2ca1f6deb
SHA512 8ca65048d969aa1b65dd2e7c4abf6efd5cf5e22c5945dcadc1d46f50c65fe8cb73d7cfa0694133d7adb920390c36d0f4b1e893df0fd6d713cabd1886ca364f98
TLSH
T1D8F05923E35DA5BF05D95B8D5D3C91C1C638002B26832DDFCE45345456AA6F860A2EE2
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json.tmp-07803429810147bc

Path C:\Users\Admin\.lunarclient\settings\launcher.json.tmp-07803429810147bc
Size 464B
SHA256 ba871f240fc9c20532fdf040a9b2132ddf073f253f4b4d8479bf88d8377cd732
MD5 b5fa34f418ee663f8709c44ac1269197
SHA1 c082d505520416fac440beae92c705bc1bd58fb3
SHA512 f6cf9a82ed67f13c1572bafb5f1d868bc225bbab80173be4e02da5f78df21358f38d53b6978d674ea3695ee6870497de500e733c1ebb9ced1d9491c86be0e1b5
TLSH
T15AF0DC33E2AD557F05E1829C9C3CC1C0C138402FAAC72DEFCD4A6D5816DB9B811639E2
MD5 SHA1 SHA512 TLSH

Submit Download

SettingsPageBasic.xml

Path C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml
Size 752B
SHA256 62390ec9f79513fad8d4070adaff007efc970e0ce5bcd3713ecec331530033c8
MD5 30e0f4ec65dfc2f94fe34603345dc02f
SHA1 b61d6999905eb18a7db9d0535b7e9cb4ece4630c
SHA512 38e893ce44b1fbeef44ac0584fcc643be4c61c9333183382cb12660c1763a75c7017dcd4139d004e3226c574bf78d76fe17f11961f4039f067c77e94fb646c05
TLSH
T15E0162593EC7FD3908B21925B5397D90EE70D61730354CD5F3E8231B2A93536198B36A
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Lunar Client\chrome_100_percent.pak
Size 112KB
SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
MD5 e7bbddff3081eeecf7f56e76ce1d48e4
SHA1 eb83b418ad0e8f502f12a339cabc2fef8ec06cb4
SHA512 2caaa851d095d1a641b959cf092a2ce02328298aafdfadafc773eb0a0054054ae54c41574328694f6a37928203509a0c7e38f3beff1f4fd2ded00b5ed5531d85
SSDEEP 3072:z84PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:zRYWFUbGz8LI1TnjQBQCrC
TLSH
T13AB3D0D7B7B0AD7DDA474BB783560170FCB30B2D0682120A5A99E479653AF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\Lunar Client\dxcompiler.dll
Size 24.9MB
SHA256 dfea8d6fe934ca6d02708fc3773a0fc043adf104da18e7a1f4aabe42bf067c8c
MD5 4f1ea6f0ac5c7514a03450335e7aa971
SHA1 1be6bf889b5f88e246e1c6b89d1aebf03cc35545
SHA512 a2f7423fc370166425a974e4753cfcbd9a84fd1a8ebfbe9d4f1a60f8de235818c37f20a8574ddd9e92276ddcb43ddab020b3d0c7fe3e62ed64d901fee15ef984
SSDEEP 196608:uyEM0iNA8dEVPgDaIq/DYfM0gAgzgiyM+lXxwJ:uyEM0i6MEE8sZiyfa
TLSH
T1324729122246949DF059C879C3678626CA2C34E73FA778EFC0F461252B7BEB85B39135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fbgmbqcl.qps.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fbgmbqcl.qps.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CommandLine.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\CommandLine.dll
Size 60KB
SHA256 569307401b949368527b128155b4e16b349803ec7d65c1052cc23c7b7a1336d8
MD5 210472e9e333d3329072c9ea3ef06326
SHA1 298c5473a79ab2c34d1ef05a75cbdd04905c822a
SHA512 c0f41486e8e7a8178322bd1fcd37fe645e4a23041e0aa84d3571b8031e2d1881029aeac1b4a554aa2f6a4f1b57d23a063872fcc72a04984fbaec2bfd12fd4b01
SSDEEP 1536:/Zj9JT17qpL/6ePMqBNzrstoJSkrjbgbwziM3hwW:/x9JT17WPMqBNWAkbwzibW
TLSH
T1C953292193EC472BD6FF0BB9B47462610BB5FF86B523E36E8D49A09A1853F4144613B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\Microsoft.Web.WebView2.Core.dll
Size 557KB
SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
MD5 b037ca44fd19b8eedb6d5b9de3e48469
SHA1 1f328389c62cf673b3de97e1869c139d2543494e
SHA512 fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
SSDEEP 12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv
TLSH
T15BC4402123FD8A1AE6F63BB5A57407709BFAFC967979D39D0598251C0D72B408AE0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.WinForms.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\Microsoft.Web.WebView2.WinForms.dll
Size 37KB
SHA256 e4f695b72f99024e3ee5d5f26a367e664f4e120bd5d90aa87a8bc0509c365ec8
MD5 c7000faa6c6040188c8cd8ef28b6deda
SHA1 07a23c50092e5c1fd9c9df87e26b65df25d37b24
SHA512 eaee01031477454823974546055965df8d75c5115b25ab07b15ca608a20e8c21154ebb8c707a74213ebad04c2bf34a5f5563306e6da502235372c60672144022
SSDEEP 768:sijOv/1uokD/iyUdcIJtYZDgcEST3p4Jjrjh2jJFSUyauTv1JKia5/Zi/WGQK4uC:jOvZyUjJtYZDgcEST3p4JjrjaJFSUyaf
TLSH
T170036C0083AC8527E6EFAF78B5B481610A7A7E837A61D75D1C85F0EA0DB37E05914377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\Newtonsoft.Json.dll
Size 692KB
SHA256 7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13
MD5 98cbb64f074dc600b23a2ee1a0f46448
SHA1 c5e5ec666eeb51ec15d69d27685fe50148893e34
SHA512 eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147
SSDEEP 12288:p9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3SH:p8m657w6ZBLmkitKqBCjC0PDgM5CH
TLSH
T1CEE44A0623F88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OWInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWInstaller.exe
Size 338KB
SHA256 c90dbd8d6ad16b71fdf369cdcb1294fd2d51bda4b77d1184d70d9a9bd0141ec5
MD5 4d0f5668702a267afd2bdbba8f1a0d00
SHA1 201160fd1efe3d7a72fb32c2cdc1ad7b1e2d5cb0
SHA512 579a08f56e4b9aa35cfb18ebe1294235ce5003ad975122746f08f8a2b9ef6953f313abbdeb58ff5626ec889452c13fd5c62974950c1a606f7def27cab20da2e4
SSDEEP 6144:H4IsWFbv6O0IOZ2/EvhJK4oTzs9bRKYoSYm9qkb5PBEcTXVYbq2EZkpliJcG:HiWFbTeTK4ovdYoS6kb5PBEcTXxAG
TLSH
T14B745A5523F98618F9BF4B39B9B249118FF6BA47A8B7E78C0D80689D1973740C490773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cda4b3d58f6babac1f6edbcddd14d882f16ff7147d2d9afc2cab91776d2fd647
MD5 92887a7caaa1475e6455b469f8906e40
SHA1 4ab38f04e0e692da9a2c82fe8040926c7bb267f1
SHA512 942040ca803b8c3655bf37d81a0a49074ba6824977c3f50bd06ea503b0a16b95cdc1194ebff2dd7ffa1a7bb305c5e68d8923540d7cef5906e5241bce9d373d95
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b3ca97c57ec4aa0ab8bd27b934791a9bdac0b7094af55232e65d56edb5188fe1
MD5 fc482de2c1d11cb1b417bd9b7f0af920
SHA1 d9e168fd140e77d9aee494ca3730e75c3d5c3758
SHA512 c2b39e254ee94d3a392a42592561d94d4147880f2f3adfff44630fb3f022f261d24e6f1e6c4464744b97f5119cdf6772f06f0f551469cd8970be2e4dd47ce505
TLSH
T1F2D0121632410334C02025730012A20A0401D20F4106C004A429861F9E140940D27551
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f825a9e6b888568f6fa505c0908b414622df3600e2aa38f3330839348f984155
MD5 b0f38b360fde269370b153fb089bc07d
SHA1 0854fb323814cd43b251d49dbfdbffe2cfc5e6d6
SHA512 126de8f157c6b596a78f3a1c4a9845985332cbee2754efac98d58beaab77ff08fbbc53e92dd2443a6ab16c443ae74084a62a38f43f2b1dfb737a8c10bac7de24
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7e8184c35c34a11b80fa11625f9402f2b1631051c8c38b481c82cf66d2b3e901
MD5 443d4d6d20ee871abd8bca8a837e5610
SHA1 2cc9f45a669c09605b6c63f6f6a2f271d8217f31
SHA512 29ef23f8cfa5cfcccb25ed8a52e73f304e7743289cbd398994d9e4bc954cb2d330d659d7c947d81b3e7f6a005bb399f246c20fa00810bd7956ec49ca607cd99d
TLSH
T1F4A002A5C5D62415DE7192709462976262247A5102A24B0BC3DD5446EC531C14313605
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 1d2c1a722a07c80933cf1c7f4a38165f562463bbc109767ca4b74293e0469c20
MD5 bd88cff33981705ebfec9abd085fd123
SHA1 6769142ecb37d290d2a40fc1e66ded1516432922
SHA512 17f4c00a81df27d7cfdcaae36d4f57c3a0753fbb41df7d9b584fda4de7d57ee5260c57d7b5a0d83b87f96bfb8c28322b33c0cb39a345370acf40e371b377b4bc
TLSH
T1E2B0124010850009E651DB78C09109393221A9054381074AD35E0100FC021C00706350
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 995B
SHA256 4e9cddc56ab2630b915e51d7d0df5d8a335aa4f436c1a1933dd9806f59258097
MD5 28483f0110be5766d8b9a3bfe6f8d92a
SHA1 33d6b552617fc4fb35ad807ec39dc0abec7adc75
SHA512 35cb4d210f28941f0c3321d4f92a78f635f773441133cb9962e14b31fbcf27ab0098e69c7256cbbe8a60276f1f0063b94e8693bed47682a7b004986c0dc37972
TLSH
T161119BBA83E4077E494112F41A36A927CD1D541B432C3C6688F8AF8F63F15B0D20169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f93b.TMP

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe59f93b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 a4d695494289b7f9421d17535f7c459aa91219008a312823f7ca443d36659862
MD5 8456559c9eb49c3012eb049e54ca98e3
SHA1 85457c35fb4830d019a27c9cd473d11347053812
SHA512 2f755df537672177c63a10f1813d0a0a99cffffec9165ed03bc9422a01ac9eafa187302f42c792e2258fc978a83518655c8b88d3c2ee49e5dae59c05355d561f
TLSH
T1C8E0DFA681BFA03B606D49A21E88BDA55A77F13011A0A8E89A83416D70809E65A13862
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a4075.TMP

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Network\TransportSecurity~RFe5a4075.TMP
Size 356B
SHA256 64a51a123abc14b3077a80866e3c1c85b1da831b5085426f23ce2e4c838a523e
MD5 17a027490550d3a45b4cabcaac91df77
SHA1 6ad8d69e16e385db06b8af6a0de3c51701e27b1c
SHA512 5f9ad3e0ccec5f376565bfb1f00ec2b3f1481c36f9ec6cf018cf8524a92acfd583504ae3be3597339fa0df25214ecaf8e226ac3eab075a789d75305e3970f84b
TLSH
T1A2E0C0F2C1FFE03F60AE49621C887C754A37A430106114E8CA83012D30809E71526421
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 17aee75b80f78338aac47f561b5a5d1444d9e860749a1a3eee19e6f1c45fe27d
MD5 e127e7e38fd3f6af64775dd818ca042c
SHA1 3505a2a6de34cfb4fd8c9c08de159fd429a7ecc9
SHA512 1bcf5b9813c0cf30455034acf59fb2186f05b02c1f6bb58a3ade3a5974533fd39991be9bb14f4d5680e410b3b717c20367d50e90cda30cb1dccc4e87afb773df
SSDEEP 96:st005ByxRkb9GffqcZ8i0vhE+kmwm/7qx+WVHMSm+uecaYKpQjG+gbyYKOB:st00nofHZ8pauJ/S+Wi8YePoYKC
TLSH
T178E19802AE6869B74CCBF619BA35BF52E2FA102221D00F98EBFC851C05D66DD5307D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 12ab9254738bec75593a38824ab98c0f3da7bff521897ca969a59241420a9e20
MD5 c2d6ca568dbc838c9614c7c0d24a411c
SHA1 ede52cf582edf45d68d2fa357d314c848b91ab40
SHA512 f23cdaa245589b4f55f8df7766839642f5e8ff83f1a93d6e5599d9f8dcc66c1299ee4d58b5c03e263b87f3f673fa5f633e6cdcc04db3fd452777fc03861c5fbd
SSDEEP 96:st005ByxRkb9GffxZ8i0vhE+kmwm/7qx+WVHMSm+uecaYKpQjG+g7aMOB:st00nofZZ8pauJ/S+Wi8YePhaMC
TLSH
T15CD1A9125F6869B74CCBF619BA35BF52E2F6502221D50E98EBFC861C05D66CC5307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5979f9.TMP

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Preferences~RFe5979f9.TMP
Size 6KB
SHA256 a8b05c3828a9fcdfe72d2aedada7a7a91eb333039d9aa48dc41a02128504fc99
MD5 618a8487bf26e7fc95b329e27e8020b9
SHA1 e76f01cda5b341477fc32174de58f9939a5f904b
SHA512 98906ca50e33e6241efadac0a1789b21fdd12f5e93a21c1514df5e3c857a05ef048a38ff6bfbf8fc5322cec40df15df9b6246ffab350d226a1a5893a3547e402
SSDEEP 96:st005ByxRkb9+ffxZ8i0vhE+kmwm/7qx+WVHMSm+uecaYKpQjG+ggaMEB:st00nYfZZ8pauJ/S+Wi8YePKaM8
TLSH
T118D197029F6869B74CCBF619BA39BB52D2FA102225D50E98EBFC851C08D66DC5307D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 4e9f2efeee2546bf6874366971644cf6536e673d350013168ee4c14a31bd050c
MD5 84392649b2ac726d0953da21721b4f10
SHA1 781e42c7358247b17081b1c4e9174a06b427bcb1
SHA512 94045389cfc1b910820e001cb56ad451fd49f0e52ecaf0c4c98a4e6c08dddb61574ac476bbe884f462bfacd3d7ff16e97a9d1699d810efa5385ac64592768956
TLSH
T184318773D9D42B725C819A4A73D6A7475D304165C1514F9C62CE063D01E739CA76AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 690af49bbfd7a6ae272a06d749753321c73c8f73d2913f965a0d0b3d9f744aca
MD5 3efcdff40a8ba0a2132eecb2fe1f1fd4
SHA1 830b099b3e3f640c869dcf84c140b245b2eaaaec
SHA512 8c5486eafcfabaf40e6b07da284ada3c573e10a7012a26b22e4628e8f0aa671972d5d5271de61e5145af7976642fdc0a5547fe8030168d0b0ee9ccb7a3a7dc9d
TLSH
T13551EB73AC88677749D3DA447ACE6B13DD35415196911FA896DE0B2C01DB35C2342C7F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 c6e7c21632cb36da54aa819e03824aab2e7d3c3fbbd6e30c1bc525b9c901395c
MD5 7ec801916a39a9edeabaa5e419587acd
SHA1 15c036b2cca90ea3e5681c57f42e6dd778517b43
SHA512 c7ce6a482fa0040486941da1e9455f1f36370c31c50724a9f3bb67ead7d994de2d4587a26415deb48ab29f9969318b90e48dba26c40470be417232270e1878d8
TLSH
T1AF71C732A9A8A5374DE3DE44B9CA2B06B6A14122D1C53FECD6ED0E1C01DB3981342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 be932f9726d47224f2551f885dfcd4565c3c796a3f5019ec9741b772bb8f3d79
MD5 ab103f1dbecee40385245e25ae67c844
SHA1 c7e8c7e389f93a98b9947f3d727b4f2498600c94
SHA512 62d81e2fce99e1f17f9daf3821e6a6ca4906ef84ec4f1f84d24e02a1ecddb455cb9d1995bdcfb53f2c4fe4dca985a69480301ef510865c9d58c6f360d965cd23
SSDEEP 384:z2+aQikB+z/xvxjg/qhEwNbDci0XmJVb9zT:t/UxvxjgC+ssmJdFT
TLSH
T1DA729E2B54A93E2758F7F9057A8D075FDAB984A290C15BBC4AEE5F0D06CB3D81342C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Local State
Size 18KB
SHA256 9c9de32ee8e083e3ac3b237ff5140df80000640c1e7d4984cd7728456605bfb0
MD5 85370387dd03c400a9876623e839bed4
SHA1 057678d7827aa9e34b4621aeaf1c4f275ec54bd2
SHA512 890df0b512ef803bdec89e75fde1416c09ca9ea8297920067924215d16a7f2f17f89b147807beb8ea975afac24d505a5cdfacbcc103e4fac548370fb9629570f
SSDEEP 384:zU+aQikB+z/xvxjg/qhES3NgqC60STWm6PP0JVb9zT:X/UxvxjgC+SjTv6PP0JdFT
TLSH
T10A829E36D4A8AE2398F7EA45768D579FDAF4446290C51EE889ED0F0D06C73DD0307C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58da9c.TMP

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.WebView2\EBWebView\Local State~RFe58da9c.TMP
Size 1KB
SHA256 a8c60ae1d30f19ef0b60858213d50751dcd11b79a1ab40090073b5c13263713d
MD5 ce630327ed923720abeb6f2a3bcf128c
SHA1 6e90afdbbd243ef352ec89645ae9cf6a3319e873
SHA512 22b4589aeab1e770d98e9005453d4b05fd64074928722ece8c0e354c836394ed665ddf70b4c96c2dcd1005d6f1d7f1334d5bf325897458c2e2fca7b5156253dd
TLSH
T19B216573C8D82A726881994AB396E74B6D60416191554F5CA1CE013D02DB2DD977BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

OWinstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OWinstaller.exe.config
Size 632B
SHA256 272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827
MD5 82d22e4e19e27e306317513b9bfa70ff
SHA1 ff3c7dd06b7fff9c12b1beaf0ca32517710ac161
SHA512 b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9
TLSH
T1F9F0E11048C4FF268F3185A33B774814EF3883B7108C091C705E39AB0B271964317233
MD5 SHA1 SHA512 TLSH

Submit Download

OverWolf.Client.CommonUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\OverWolf.Client.CommonUtils.dll
Size 681KB
SHA256 936cef3f1fd444e4cdf934e04ec86b6877156cab6d5861c549b25f107f26d84d
MD5 31ffc5b8b56bd4889e20a4ad7d6fc973
SHA1 1692b55a11d7533697514c66d38af65e8ef38067
SHA512 15b5a9b8fe24265b13c5e5d0e629da81f33bf03909743eab840fe9b8a62dfd1b8a9b3da025747f369f6cbfc7a04ff4bbc8f231bfd831adbf5f45f8d4c70c9686
SSDEEP 12288:vIsx5RnuqfMcgYkB6b+tkeblqUOFgRhTZEc8Qt26Dj:nxXoh33TZiQ7Dj
TLSH
T15DE44A0233F88626E0BE5B39F8B01224577AF542A966DB4FB95C904C1FB37498D51BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpRaven.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\SharpRaven.dll
Size 82KB
SHA256 776c6b0642f7a3f3f3ad3cc6bb5f1d528e90c6029b671d8f82b0320b185b92a7
MD5 271251960bf1d6a491803e15bd562e45
SHA1 1a305315dec8b44b4d80ef8c23452880b7e90380
SHA512 d5fe5c76f2074a05d32785945ee9f088fb4293786968a1c84389233d83e9bf0480d04d5fa9676c70fd0fed47213f434ec0e0cb2e38379f720919d680336aed4c
SSDEEP 1536:aa9qjviI1YjOrfRK9bvyyfpHbnzDwky7PndZ:aEuqI1lRKbvyyB7nly/
TLSH
T13C832B3123988728CF9D6734B078225A63B8625E3B31E6D6DB1C615E6F973C347212B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\System.dll
Size 21KB
SHA256 4dbc79d2b1c7987cc64bb5d014db81bb5108bdd6d8bf3a5f820fac1ded62be33
MD5 51bd16a2ea23ae1e7a92cedc6785c82e
SHA1 a9fbaeb9a695b9f2ba8a3ed8f0d95d2bf6a3d36c
SHA512 66ffc18b2daf6c4cba01aef0e4af2f006a51aa218eab0f21dc66e47eea0389d2b1748ef0e30d2ec9f0123fd7f38ed3aee964dd6bde5779aaee19ebf55369af79
SSDEEP 384:ASUmlw9T7DmnI5+N273FPlIYiPWfPJsaAM+o/8E9VF0NySk/bF:ASYTrINE3cYiPmvAMxkEt/Z
TLSH
T197A28DA246509CB1EC468D7074C8AB3B5B3866476AD0CAD3A3A7C0419F543C77FBC2B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\UserInfo.dll
Size 14KB
SHA256 a27dc3069793535cb64123c27dca8748983d133c8fa5aaddee8cdbc83f16986d
MD5 1dd4ca0f4a94155f8d46ec95a20ada4a
SHA1 5869f0d89e5422c5c4ad411e0a6a8d5b2321ff81
SHA512 f4914edc0357af44ed2855d5807c99c8168b305e6b7904dc865771ad0ee90756038612fe69c67b459c468396d1d39875395b1c8ec69e6da559fb92859204763e
SSDEEP 192:9xvcecVMIYiYF8tO7zhjjWvp9A5K+o/y2sE9jBF0Ny+aiQE7:kruIYiPWhjjWvHAM+o/8E9VF0Nyp6
TLSH
T1C2624BB386A45C15DC0B8E7135C8997B9EB0FB922AD081D7621BC1814B84787BFED2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\WebView2Loader.dll
Size 161KB
SHA256 465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f
MD5 c5f0c46e91f354c58ecec864614157d7
SHA1 cb6f85c0b716b4fc3810deb3eb9053beb07e803c
SHA512 287756078aa08130907bd8601b957e9e006cef9f5c6765df25cfaa64ddd0fff7d92ffa11f10a00a4028687f3220efda8c64008dbcf205bedae5da296e3896e91
SSDEEP 3072:7evoTTlTRTyiuPThTNTKm81SbbMYSPLNsknZiZ2HZ5AaliiT88FEtJ57dXSvlCW:HTlTRTyiuPThTNTKmFQdhsknZiMHfEti
TLSH
T120F36C5B72E4407BE16B8274C9A34A11E77778110B60ABEF03A447791F237D4AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\_locales\en\messages.json
Size 13KB
SHA256 7339e315f9ba2add98d78ebee8eb9a7ebb0d31f4cede6a78cc446e588ebbac3d
MD5 af7c295cf37f611b89ad026dbc80338a
SHA1 da128c852393bd9bcd241e938c82fecf267ff2d4
SHA512 35fb9450fb6df79c3dcacbfec87f4385900f90cd3942def2481c8c396b4d9a04fb9902cbf8a1c7bb9f14e9243f1bf80a8da9b9146c256f737aafb7b142031841
SSDEEP 192:+ANFsiqgFAy3I24CGtkb9yBj6j/mP8uqRquZNLd15ZA2M:2gFACI24CY29Ut8vTTg2M
TLSH
T1BC528D06DDA16E3B06B643253CA77215B362176F21505C1F3AF9114C0BA2EB3D9F7B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

close-hover.png

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\images\close-hover.png
Size 211B
SHA256 83fff6ded423944d0d6d044437f82b5509a24ff16c034ecc5d6169ca3c61c383
MD5 0ca9c12a07f04842507753c785151283
SHA1 a476853326ea9ab6155f5a1fc86533cfd24f60ce
SHA512 8d310c96af1e2c5ecdc571d8f25cfed9e5e292cee35746107a28830e78a1cf68b65bb35bbfba66537cf5c38d0ed0b358bd6c9bbd4676cf42623d00c0d4b5cfe1
TLSH
T1D3D023DDC75D445BD61CD4BF82670112B55F1D9F053C600CE9146430147544D3D47391
MD5 SHA1 SHA512 TLSH

Submit Download

close-normal.png

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\images\close-normal.png
Size 258B
SHA256 ced445f13824aa3e0e130446dd04865e27c2beb85d16179a9cf05f76708ecb84
MD5 c6503858e81b5c797ef63e551b9e244a
SHA1 1d0b949e6cd21933bf224ea1e1b46436c021735e
SHA512 1f57824aa23cb02ec46d5f03ee0db70a7938e9bc0f6fbfada2fb75fe35bf804cca4d553818aac5bcdb0f89a6d001238b35475fd0520288e7cacc9be6516106fd
TLSH
T1F8D095C3374E586ACC6CA13E239E31C4596F2C5CC0F552057D442032DA383801395FA6
MD5 SHA1 SHA512 TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\images\icon.ico
Size 149KB
SHA256 70e7e734171c8c32bcfe8967bb3d91fbe259952ec9c92b6562095614ff465a1b
MD5 af5a51fc5d3cf1861f2a470711355265
SHA1 bb6ef7a49986f46b1347f007a327b7b35d28e4c3
SHA512 c3de8de1db9177521e87cb099a15ab4897e5d3a9b8b4086a555689743d9945fc23bc5c9a2409f26b2d120031e355ec6949ead3017c3b44cff7b701ad72073b8b
SSDEEP 3072:3Er1D2Sm4AA12U0ZvFJV2Naz+53/7rIQWd:3EBD1mNA12FZvFJ9QWd
TLSH
T1E8E331D87810DC3CEA350FF9A6E9C456E7B89D39AC1550893722B1893F32D4EDD4392A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

minimize-normal.png

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\images\minimize-normal.png
Size 151B
SHA256 2bb07ea586a9375205256a96a4ba0118de0547fa4a935d293f2be3965e701576
MD5 c5d6fd1e224a5a5f2fab29cde44f90f1
SHA1 2ae4c72421c19de84bd7d37adb6fd93b0037b4d2
SHA512 c2fa4f08ceb1e469397871d134a9abbc6b64d32f82d979e5a8dc94c5d75421084285fa11b16fa8ad90b0ab961293c8e6d11afb58ec86d65616641cc341e77990
TLSH
T163C08CCFAE5048BD842C862A229F05E064B72DA90022314CBA22A851242884023C6361
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\index.html
Size 27KB
SHA256 29b31e024477170e1f76ab145eb7a9bcd919389f5438db8a171bc9f55154878b
MD5 5ad4f3206b65b951bc79e710f4eeb3f8
SHA1 2a5b2ffb50e02adca04949199a10ec101eafe866
SHA512 ad6c0b47c7b407305859ccb45bff14d734ab4aedf08bbde9361cb1a32cb9b8a617b2c90723d669fc7c8f8a297e7c861d9d2abc4cbaad16807bd7d761d34cad24
SSDEEP 384:vN7Y6FCs5XRJ/seq06IfLglbyMaAt1vnEF+ggevsu5SwU:z5XX/seq06IfLglbyMai5nw0u0wU
TLSH
T132C2A611DA36202DB137462A75E2BA5D3034C117E5639A7EFA5C9674CBCB18B1F23B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\app.js
Size 24KB
SHA256 3044a9dfc31d8bf16f1f1018c6751adfabf86a4e93a398135cf058ca72a00fde
MD5 5609e25a421159b37c62f9f7b1ac81ac
SHA1 19bcf1093d0f128aec0b7aff648c32913a20fa4b
SHA512 15012c0d5ae05f543731cd293af1f75a1adf0b0d8b0a10428343135dbfc592a303451f83c3ddf2e07d26fc250c4b641f6cff9b3ee381e1b91eeb7219fc4c09e1
SSDEEP 768:0+ycDQYITdIb+sH3A4nzaYHhGifG3yRrH+K8T:0+yUQYcYbe1K8T
TLSH
T102B2968E967912789573633EAF1F4618FB32122F110596273AFD85814F7141282A7FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

block_inputs.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\block_inputs.js
Size 789B
SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
MD5 b5b52c92b90f4283a761cb8a40860c75
SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
TLSH
T14301D2D864D3A87A597DA328536BE748F7391964905A1054F0DC8C64BAF003BC16EDFD
MD5 SHA1 SHA512 TLSH

Submit Download

cmp.bundle.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\libs\cmp.bundle.js
Size 392KB
SHA256 7e14f6927d403bccba24e1ffc6a5a2f539cf523f45dac0a12be9665767488c13
MD5 995d2abd2b152d1b2225f802f037efb4
SHA1 f9e14a8a20066e041cb4d001e40dfee55997245f
SHA512 7f075a65b7a93297fca266f07a8dcc360f1f8ab52a5888fe8199051346ecc76da1a396bb01235974d1e9e619c481254b1ae2ef8038eb913b01e5bd0638e53511
SSDEEP 3072:6yMQM9zclmGxPMqbOISP88GEAlHYnnhriIFkNOLh6FhFldSxRAcDqE4E:jblmGxPQGELrjkNOLh6FLlA
TLSH
T116842A8D7991B0E617D762F1802F900BF33A6458784CC490B660D8F0ADF96AD927BF6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notifications.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\models\notifications.js
Size 5KB
SHA256 09529890b40777b01414003b702579409a62ceb225b4ab67b127ed01dd419269
MD5 47d132f69bae5531f2614f376dff84ed
SHA1 633932cb1b48301051e5e80d96d6946f5b451aed
SHA512 3e6282ce7cc82981dbf8c71ebbb7b310a913d08d15f5b221e74eee99f79556fc0355621de716ad93add21b40eec19ece88dfc2225cf050173b07921ab832436b
SSDEEP 96:sOr8u1s9FHYYdfHsW/GZwzpJGf8mui+U8QrGjqTxoOxoYsdfHsW/GZwvpZGNjINt:sGu9GYl3rNQ8K+JQC+N5Rsl3rxeEYIgO
TLSH
T176C1AA5F90BA00A3057293A809770241F66653AF49408CAF737C5EB44F311A6F4E6EDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analytics.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\utils\analytics.js
Size 5KB
SHA256 0a3b80a0263691f71e85ec681be87229e6325a7d173ff430bbf4eb7fa355476c
MD5 52b20797b4568fd9eaa065d676b7a344
SHA1 a14cb0b575f2a7d274a78093d74906351b603dfa
SHA512 f99786edcfc0220f1563617f40441f9b0ff02083be2c1847677b6533f7d1de16911227e349fe41e328800230bc2994b70db3ab79e4acef5fe07631e87aad0c5f
SSDEEP 96:LlYkmHqqVHlnZrJGvt+QP2EZc8kukLQsO2LT+gObNSPgPgzauV:AHqSGV+kC9zNObNSPvzaA
TLSH
T1A9C199292469719068B373B68F5B1518EBB116233144E9223BBE87415FF6D02C693FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

commands.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\utils\commands.js
Size 15KB
SHA256 42091cedc15f51b1c8ef473e03fa5a5f9a3af51d523e0197360f084d9fb792db
MD5 cc9d0e7975c08970d2b868c8d0d1e0ee
SHA1 bb203ff45ddeabcb4fb232d0f63874e592c52b73
SHA512 6a1ba2cbdc310d9baf26ce7a7c6b6c875b98f21afdcb9341ba1617b3211bef94097ff5bf572f6b244dbbf9308b9d4499446ffd3bc4636b728564faa4dcba7a2a
SSDEEP 384:2Ur5Hs8cD+1uUPULQq06WCHp7Gvv9WqEWOnvsUmd:2MwGVd
TLSH
T16872DBAA68A721651933B73DDB9F0215FB33083B11465814BEED86917FF6402C2A6FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\utils\cookies.js
Size 1KB
SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
MD5 6c60e675f8c8c68c0174b644d3a63a2a
SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
TLSH
T17721E0087580D81EC5725739AE286778FD30992611C6D54DB88CA4F02F30C169DBE9FF
MD5 SHA1 SHA512 TLSH

Submit Download

modal-events-delegate.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\utils\modal-events-delegate.js
Size 1KB
SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
MD5 117e4fdbdb0ecf211c8bd909efd337d1
SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
TLSH
T13C31D54D36FD173AE5B7172B5B2F5F8CAB72120B09054A26B2E69A804F354241196CFF
MD5 SHA1 SHA512 TLSH

Submit Download

strings-loader.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\utils\strings-loader.js
Size 5KB
SHA256 9b833f9e058ddb31ada44764449fe030f05e241dcefdef46886a74e30cd04ba5
MD5 8ac781fa72423fc5c4c21a8c4138b709
SHA1 50ad1d7f383d6801c57f916e46c1c17f79222725
SHA512 f78558488968b1151b189545294a0bb97131c0a4d5dc0fa61ef168d999151e0f12af271389aae985d129adacfc6bf610b0191fb912ffdf8e97283829e2802604
SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6Wfwk0lx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6WGe0muXDK0W
TLSH
T132B1ED58289354118C32B764CD935264ED6A4917023996F3FDEEC2686FB149E82F8FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utils.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\utils\utils.js
Size 118B
SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
MD5 a0952ebeab701c05c75710c33d725e7e
SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
TLSH
T1ADB01274B7AC73A2D315377AACBF6C1DF0375C368414B099B19034E19572D04519DCD4
MD5 SHA1 SHA512 TLSH

Submit Download

cri-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\cri\cri-controller.js
Size 5KB
SHA256 8c8c3097f0b587d715e051f55894d73a0fb7b441024f47512fa340eb3f692152
MD5 344b079e423000460dbcc623d3dea42f
SHA1 6f7a6db5cdf0e4c511ae1ec8aa1f08dd9e79190c
SHA512 15358d30f96ba6ec330417896ccd5c837e71b1712357185d7d84e60e8e6c21af52eadc1fcf61f6ce9a79165fab94813370a5ef0b632742043355ae3eb7eb6856
SSDEEP 96:u6CeVFfOhETv5T6ToY/aq4bCWCtoQNxcGyUkeErscwn:u6jVtOyl2EY/aLmWCyQNxaUkrscwn
TLSH
T1BAC1DC9C7CF9866058B7277BCF160518E732420722426A2B7AFE83404FF5E404A16FAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\cri\template.js
Size 1KB
SHA256 016ef6ba4ccb64f2cbdf63357d180f0d3a5f74857633556b311eff57be8d023b
MD5 2f82acef2d339db31fab5c73edf8af19
SHA1 d9138de6fe1320cd232fd6e1971fbbfdb9225bd6
SHA512 90311035970edf2c1d0175c9b718c731fad4f58ad5a0b43a2588e2e6132cc09deff1d49328174408c51fe3082d62612f7a2a6c25179ac474101468ab68c2abcd
TLSH
T188212E24441C90331B7B979BDA13276CE9519301D80B7D3871AE43A82BF3B828E62359
MD5 SHA1 SHA512 TLSH

Submit Download

cris-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\cris\cris-controller.js
Size 9KB
SHA256 89924de5dece339a344ab2cda8e0dd4448719d3b9233d728921c553166765c7d
MD5 23602b0707b37ed7c1b5e3a14e17e0a3
SHA1 cd1859cabca965afb34cf44f9b69a5e76f782197
SHA512 0df7ba4063389dfd592495618600e99d5184179e4a9a79e678d0727a186ba3d921f314df861ae77038d5d8531cf5ac32f9bfcff87363d0b242f77157f3f8cd3f
SSDEEP 192:nCoyl2vxrZn2C7s+vK/H0mIvo99iXKapiaTkelwPMM0R9W:9yl2JV2C8/HOjgOkelGMRO
TLSH
T10422201998AD2A299A7773B5CF6A0508FB3142272944DB1A7CEDD3940FB940181B7FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\cris\template.js
Size 480B
SHA256 c6c0799e027b5554e44e1c31262ef62b2879bdf1b862fae56615426f07f471d9
MD5 408961db547931d2427d96035dc7245c
SHA1 8a0330bf52f53cb1e82e36cd67723ebb29d7a6bf
SHA512 08d79c8f54cc9898956df5b4de8360a38d482ad19ce155e84a33843221a0242240c59c49ce0ef980e150fddce716557bee7071a6525ef438fdcde9bdacee95aa
TLSH
T1B5F02E114135CE20373F17BE93631B28F631D0024A82E634D5DB5790333B4E78A96769
MD5 SHA1 SHA512 TLSH

Submit Download

finish-with-recommended-app-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js
Size 6KB
SHA256 ec775a786d8f0170c33e7d28df1f724aa1de26ff0aafbbf41c26dab864fda48e
MD5 8f0cff982886d07a530a1ceedba4bf2c
SHA1 6348b32708fb6f70225a3fdecdd616475a4bf8a3
SHA512 cc688485cfa0d3787496f8a65e222a38a5b46c0b3b41812b9e1246f0195bc6dfcdae1cd2c82a6f80620db91cd826a17fea5f31879c6ec7e3efb580ec71a4aca1
SSDEEP 192:otBaiFc1rnGDtjUnuYu7t7jt/Pv0+bnZ7uc:otBaiLZ++tHt/5nZ7t
TLSH
T1BBE1004C9E9E5168E53B733ACFAB4188F73502271540A617BCDDA7986FF0245026AFEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\finish-with-recommended-app\template.js
Size 1KB
SHA256 f2f955faf5dc90e9ad50815566aa42a693128f97f07d02c5c3a1dbac27f570c4
MD5 e3f895c48a2c99c3e8656c9093075286
SHA1 4d1c13a0f03ba903787b23f5f27563966cc08a31
SHA512 7c71787b7bc49e77923e178fbc38e2fe7e45283f257766020a21e25535ff095b7896406e612e254c46fef5af4a0fd2a4a9f5ecb0b33fab91261f01a3bad9a54a
TLSH
T1D1315859425F9A73173A468E9B670EAD3960DF02C8B00F11B5DF4784E3735888EA7318
MD5 SHA1 SHA512 TLSH

Submit Download

finish-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\finish\finish-controller.js
Size 2KB
SHA256 c57d168e804e06f26709322e340076e576d405a72cee0b663176c6167785c3b3
MD5 b4e14fe186c7843fe1365b630a4a17b3
SHA1 86619b54889f3da9057a4937584df4acebf492fd
SHA512 bd0e5a72f6a6145c6177248351bb2ab2bbe7ff66d36dc7d022ab81d614eb39f2a0a3f4c267c3018202d17e175cfac5755138b6a05bd7f3c7b358dddb20635640
TLSH
T1C841AB4879FA43B66B753B3EDE290655F732422B0A0A867A3DDC92808FB1014039DFE4
MD5 SHA1 SHA512 TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\finish\template.js
Size 1KB
SHA256 cedc900131ac48e92bd931926946dc342a99de1b16757969b7416f8ba037fad7
MD5 6410e00eec2197f48a0d2ff66d0c07d2
SHA1 480c640d3849cc90fc881306322ea96e31c1207b
SHA512 302f2fa32afdc0d2e8729a91ce20d16427f2a6d56f97a84aa1785c3babaaeb080ff8d1ba400a0d1c3917646b1597e1800a36622f3ebdcf14979da6e3a76879f4
TLSH
T13221289D426B5B37073A469C52675E6D3C60DE00C9710E29B4D74780E37789D8EA630D
MD5 SHA1 SHA512 TLSH

Submit Download

main-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\main\main-controller.js
Size 16KB
SHA256 2cc465c2bb45f3fcee61baf732b4c87cb50b4baa64864bf832475f45e2846113
MD5 3d497dfdfa6f36a812b4988a79bfa641
SHA1 d5c951daf21080e9ba18b05619252d5b3624d20e
SHA512 f500817f58c407c0fac8290d77b0a7e9c6d8198bd6bb126eaead92a892f0a1efa9a09ea953349c21d62a3067cb1bff00257bcee67c6bab49b782e9688b1241a8
SSDEEP 384:2Rp8ChTvzkzPZPb5yPQZ688wqUaftN23n:2RprTvzkzPJ5eQZ688wqJftK
TLSH
T171721C0879A8167895B7333FDF6B0649FB71102B45068A2A3DDDC2C40FB1811466AFFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\main\template.js
Size 3KB
SHA256 d827fab7a8ec31dd68bcd7e6725c01b7d72d1224fc0c1a136dac513cc7884d0d
MD5 694ea1756f2dace45053080494afbb70
SHA1 f503248779de58075f5a3ea9ba97a4838b95d1a7
SHA512 aae8397bbea463cbcff7a26efbc8be6e9697a65073fb566fbe0d32a68dd4e656f9ca70268a1faacd2b137cd7fdeee1a380f4b4126cb1ee2a6d2bcf07bf076029
TLSH
T1956131221065157267BA42DA56266E7AFE61E303C58B9F25B6EE13C007F3C42CDB760B
MD5 SHA1 SHA512 TLSH

Submit Download

modal-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\modal\modal-controller.js
Size 3KB
SHA256 327e18d2ebcdad776f7def86be1f8a6a2c3f68611630f71f0d51c1437ca9586b
MD5 21c95dbadab8f6ff6e8f457f076c33a3
SHA1 848fde4d32380ed71d4209ce9d5fce1896b6cd3d
SHA512 6c14b7c6cd58a549fef9e5a4ec9a2a88e2eafdd774d63532c932a308664625ae9408d42b97d9e1adce2a5ff8293d91d94187090647cd2b40b13aa0e8c4861b9b
TLSH
T15451478A242A116645BB737FCF8B029AFB73509B4A45461A3FCD87011FB081093DFEE9
MD5 SHA1 SHA512 TLSH

Submit Download

privacy-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\privacy\privacy-controller.js
Size 3KB
SHA256 5a2542b3c2937b853463742bee54e1ba5f47d0f465640b3f288c290879a9dd24
MD5 8c1b7b03ff6bb4fe149c76527d3bab1a
SHA1 f7a68ed7fac1927a90df193faadbcb2f5636e043
SHA512 4110b7c415b41fb41b144781e3a3cd890bd77c3f366b868f233b77ec193cfbcb91f4794a8fa70a0a5e888cea98650c9153c38dc47272eaff31d31cc8633983a8
TLSH
T1C9611FBE60B845741537633ADF2AA344F6B2422FA445CD1B3EBC9B811FF28164246FD8
MD5 SHA1 SHA512 TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\privacy\template.js
Size 655B
SHA256 95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8
MD5 cf8d2c26520d7c84e560dfa79e31dcd3
SHA1 716f2ec17480d5cc9c145bc147833fbfc39d36f0
SHA512 d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b
TLSH
T105F0C83C85A881211976C708CF12D625BE90C35B4D3F7C7671CF078357E7C01C921645
MD5 SHA1 SHA512 TLSH

Submit Download

progress-1-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\progress\progress-1-controller.js
Size 1KB
SHA256 88059a936f49f1c4376bd047256b965540c4edd4e60331405c4f92986f6828de
MD5 78f88c896dad595ef062a00a3dccf3a5
SHA1 0a321088d119c7bf977a6ad2caca9f84cdbc4058
SHA512 169fbd73dd73dc09428ebceefec5b079651fdc88306377a988ad3f2b96c0ff356532cb408ac26c627f77783c811f309794e2f93eb4a2e6cfb04fdf7cbddab732
TLSH
T1A941EA4E282942792DB3AB799A7E2909FB32411B500AC5203CFDA1404F7092A449BFED
MD5 SHA1 SHA512 TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\progress\template.js
Size 242B
SHA256 a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab
MD5 92b145e6649ba0add3dee9a69d3fa91e
SHA1 4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d
SHA512 747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751
TLSH
T1DDD09742C2A082312B3A1F6EA3F32320BE2040040B2A7630E6FF1081232B003860DBC6
MD5 SHA1 SHA512 TLSH

Submit Download

settings-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\settings\settings-controller.js
Size 9KB
SHA256 846b7dfdfac4c748589b33df2ae9a392b49b8010637b49cb880b9e000f0253a6
MD5 701c1f21f9969c50bcdd3211176a174f
SHA1 b213e1179a2a83d911a14677f10a0629170c35dc
SHA512 27d9dd9647fc1d692e8c935fc67f0ec1a6c34578c0b7848345bdb97b3e6458b96b7c72d894e3e3c7e753dfa8be48c7d2355225a0c2bee9b71f567a6e25ba621d
SSDEEP 192:5RFBjugWX8x2zLjiaPX/iXv1ijiJRWzHSQ9whrMk4Vo0MEKAmNN:5RFB6gWX8AiQPiOiJvsmD
TLSH
T1D3121C4EA96440364977577FCB678789FB72049B2402C92A7DECC9882FF08940396EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\settings\template.js
Size 4KB
SHA256 8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f
MD5 28513de0830383a516028e4a6e7585a0
SHA1 d31fc3a6f4a3ce6c4afb82ff2342a1ed718809e5
SHA512 0f7321c2ae13145bb694368dae1b74e6fe20e6b09712da2178bc46e6aa65223ab84c38abbf0ed074c85b42dba1a238a5f3f8d1ae060a0af6df748c5befe11b61
SSDEEP 48:Zx8LQmDdbaoFRpm4+0A2AEeQmDdbaoFCpm4+0A2AW:wpm4+5nHym4+5nW
TLSH
T18891086384219412477680DA5B369F1EFB65CF0241E65E34B2FF6BCC978BC8156ABB0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\welcome\template.js
Size 1KB
SHA256 42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb
MD5 17f54fca6723b983875d940d931e0afb
SHA1 01774cd5cea36bd74c80a708d6f77567e8091024
SHA512 401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038
TLSH
T12D31FF0AC55D81361533C3FAE28B5A5C7860AE40C9BDBC3439AF075967ABC00B933B70
MD5 SHA1 SHA512 TLSH

Submit Download

welcome-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\js\windows\welcome\welcome-controller.js
Size 2KB
SHA256 86ea9f6e1791df4cc3bd22b08bb9fe30a12a0c982bd76a433134236f432692ac
MD5 1542793b6c079942ba54766597802c12
SHA1 dd78699fd69ac542bbf652e9e65013d717e69db4
SHA512 e85ce5dfb1a973b73eaedbb38de48aab2a224a5fb20d186ed9395ee1916271756af7d2291e3aacb41e5a84130937bc937717d610e87289acc35ba704c857d2eb
TLSH
T13541CC9DA9B583742B767B3EDF2A0748FB32922F0A19876D79CC62410F71014465AFF4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\app\manifest.json
Size 691B
SHA256 7f6bb3fc13e9f7f8e7eb33815ca7d13138cccbf97f4270f1261894cdedc9db8a
MD5 f442736a4cdf8e67e6c230d65431a847
SHA1 edc6a80eed1c8428fa5994a29c915e2698d1a41c
SHA512 18bef5ed0a517dd994b249f556662da69865051596fa81f85ca6c6beed35e358e38397dbf9ace48adfb0750d618a571952e1492586ab6f10d9a2154e721b2071
TLSH
T11001C819E8946DBB15797627A8F90741FB86433F02024F4B37BC504C5FB21591457E74
MD5 SHA1 SHA512 TLSH

Submit Download

log4net.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\log4net.dll
Size 270KB
SHA256 ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309
MD5 f15c8a9e2876568b3910189b2d493706
SHA1 32634db97e7c1705286cb1ac5ce20bc4e0ec17af
SHA512 805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e
SSDEEP 3072:F+8gmdoxSO7ZbQFroo7RVir/dtnK0sgdnogtHcU5qFG1RSGCkE9kKn7GCcaLoWnS:I1N8LLI/PK0scnodG1RS1T93caLQD
TLSH
T15044065477F84A19F2FF6BB8A475411587B6F946B87ED39E0A80A4FC2C33B1089117A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

partner-custom-asset.png

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\partner-custom-asset.png
Size 2KB
SHA256 f9a654c702d0bd821de7a7f14bba34d0b6f7d85dcb004484e242e889aa90d77d
MD5 2705d292e2fb7609447714554c57a585
SHA1 68e385c6b314a3783aec8bb9de69aceab7b9fe36
SHA512 0a3285189ead35b013ae8f3f2ea646be1e5a77efc154a264f266359a1ccde0b71c395db23687d6eb1f65477b80c569f9691cf2df0ee84c553509cb364c7531dd
TLSH
T14C5138E4F6E4A9DEE3EF3424E7929748A67E6833CC3F5C096D7890000020E1629A47A2
MD5 SHA1 SHA512 TLSH

Submit Download

uac.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\uac.dll
Size 24KB
SHA256 10a0e8cf46038ab3b2c3cf5dce407b9a043a631cbde9a5c8bcf0a54b2566c010
MD5 861f7e800bb28f68927e65719869409c
SHA1 a12bfcd2b9950e758ead281a9afbf1895bf10539
SHA512 f2bf24a0da69bbe4b4a0f0b1bfc5af175a66b8bcc4f5cc379ed0b89166fa9ffe1e16206b41fca7260ac7f8b86f8695b76f016bb371d7642aa71e61e29a3976eb
SSDEEP 384:5GVY6ClGoWxXH75T1WVl83lLsFIYiPWc+6AM+o/8E9VF0NyOk:tBWxXH9TYqlAyYiPjAMxkEH
TLSH
T14BB27DE682980E6AEA235D3175D563335FF8B6502DE0C1DF161786448B607D3BB3C27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnCACE.tmp\utils.dll
Size 58KB
SHA256 251ab3e2690562dcfcd510642607f206e6dcf626d06d94b74e1fa8297b1050a0
MD5 c6b46a5fcdccbf3aeff930b1e5b383d4
SHA1 6d5a8e08de862b283610bad2f6ce44936f439821
SHA512 97616475ef425421959489b650810b185488fcb02a1e90406b3014e948e66e5101df583815fd2be26d9c4d293a46b02ba4025426f743e682ed15d228f027f55c
SSDEEP 768:cmLFb5dc9LS+8dayUhaPxYkkLE53UEDNnxqWLb1pA26MbwYiPbAMxkEu:cmLFtd9+O0fkV7xpD6ww7Pbxy
TLSH
T1AD434B1172A0C433D5665A3069E8D6629E7E7C422BF480CB7FA9027E5FB13C16B78367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\LICENSES.chromium.html
Size 14.4MB
SHA256 6a47119a572e342d1f796d20a69fba116d16411143dee56773356e6aa9412500
MD5 6fc6249b6b37aa6bb3b91caee250191f
SHA1 aa4d6422398b5f5fe42042a0c7cdfe7ba11ca57c
SHA512 5661b84683d4d7716d952dccbe54ae6e01ea6975858f53c2993ff925297e43ba420c1edb1abdf8e453ca98d1f3763f86e02704f15b1f871f066416cfb4478c53
SSDEEP 24576:vCNmjZ6doAjZ6/u3jK6UwR0ouDTjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jK65x:vXTeXqn8m1
TLSH
T1D4E6A42F7B48037306C642A2AB8B65CBF31E903F3B561654345CD1681F6BA2583FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\chrome_200_percent.pak
Size 182KB
SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
MD5 1e1744b9410d29e7d1ed28c4f67d6317
SHA1 4f3fcf3db1f8a1eeefd5a4c2f3f2d2b34c094a82
SHA512 10fbcc89ae3251f4c163beea1dd3a53bca239486e1ed7a997e9b04d3a6193266cd96db4a1f8b753942429305ae9ee28b1e9d3fee7e2ddfee847a4db40c8cea93
SSDEEP 3072:dl4J8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:tGQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T13804F1D373B8AD3DDA570B73926610E0FD7A20291EB3110A5A9F98397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\ffmpeg.dll
Size 2.9MB
SHA256 b35f93a4358a6c7de31725d60375e0752d2e6bc8ca94f649cfbe7b57a9d7fa39
MD5 fd11eaf1feef0a9c84dc1316667c427c
SHA1 5110e5473e7d618dab17c207999781a029d65674
SHA512 59c3e2280d4ea2af82b1ea316ee8fba6434f9b85f16989f3902351fc733b0c3f1c4f36717029247d7c20baf683f849a6650ca287c33cfe592fb3000ca417ed8b
SSDEEP 49152:JESTAZFzTxMIP2uEeLfptJrj0vVJA8ANdZGNxcO6IhgiS9Nol7WtaRRqSorwIaGx:JDaTFEYht8OnZGNxcO6IhgiS9Nol7Wt
TLSH
T1D2E5AE03F6D650D9D029C57197AB9313F631380A4F2056EF2A804A253FA7FD86E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

integrity.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\integrity.dll
Size 13KB
SHA256 9a90dacda605af6b0fdb03d03e460411a3ccd5b9e3a38d00e3c0bbfd63824ac6
MD5 02a54203724061744aea7df44df6cb82
SHA1 f69c0f0bbb1b5ac6c87250219ce9122e21d9ee3b
SHA512 cf09142064563b531f3aaa2f1947930fb9ef16c263ec10720d1517693ae0ddf9546322226bff3c452277fc4e499e45635d1efb972c0f8fd8e5222eac838768c2
SSDEEP 192:r8pjHjNyEIYiYF80dmL4pUQaULc8pq8RuZuuB+d+0ZAgA:r8xNyEIYi2mL4/y8Riv0ar
TLSH
T141525DA389905C41DD2B9E70B4C5D836EEB2B6961AD1C2C73269C06297D13823FED1F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\libEGL.dll
Size 492KB
SHA256 e0d4b2682d0e2f7df3cece9d6edb295d1a33a6a07eb128cb5c8bbe254585b45c
MD5 7ea4b3539f844e33519cab44c0e13da4
SHA1 0c75401951ed7f53a27dfd7c2dccb1ee45ed579a
SHA512 44767aada5cb3a610fb0e29f03dc28012be43b918fdb35b1d20f6e17a00c8f1f34611244c60d1a875b508b2ce45afa981765c82d232b6cade1e7c83ab5a0c9fe
SSDEEP 6144:StqwvC8uRreZw/wqbZyu5sIAeoZPw1ODZ6R3/8cWqR/H2plHoSud3:0qwvC8SrZ9NEIsPwa6R3/8cWqtIHoSu
TLSH
T100B49D15F3E945A8E06AD4348B534603DA7278560B65FAEF03E092793F37BE45B3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\libGLESv2.dll
Size 8.0MB
SHA256 fb4ce58a7383ea51bb00dfcd58afc638c93eb7a74ffe48edb1cbed031baeee9e
MD5 c79b039fb5e4de0a6479b3907b9520ce
SHA1 0cb508e896411d059daee4bc0874302951cb1861
SHA512 bf5d1cb21eb5e4a1dcd87bff1ccee75bba7bb115931d3ca73f727823be9f06057b6641ab25dbdd91f6cb1250ab5ad53b1165a2b3d070cd0ddf76cd445066da04
SSDEEP 98304:Wy6Usk0wBxMkD+YvkPzrTNqzOhPrrn2Qh3VY:rGfkDZvkJwsrr2QhF
TLSH
T1B5867D03F69541D8C05DE2B8875BA327FA34B8590734B6DF2A9413152F6BBE0AB3E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\af.pak
Size 568KB
SHA256 ca253121434ef430661c30672e1097e6d238e42821585b700776b56977c05d97
MD5 fc774f629eef0d028ef6c0d759b86176
SHA1 8a57809eb22b2d77a2b18ad1c12a17698c512e69
SHA512 ea2c29892c7313063512d4223884e5301ddd265c7299a93384ad1a7d98c950db52665063671242ddb6f2785dbb48d26439b423b12d41055484791414fea07b64
SSDEEP 12288:18abGwqRXxgtRGt+vW5RwONM8KuY3GB1sz4H2Jyn9N+saAQGmQo0v4JIAga26F+C:KaPqRXutRGt+vWDwONM8KuY32sz4H2J5
TLSH
T1F2C41B0BE781173D09B07696FA0845B7FB9CA26CC770B2BADDA982310966DFC11BD1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\am.pak
Size 921KB
SHA256 1f126a64a58ece296209d24c36ae416e3187996765027b1198ee01dead17394c
MD5 e523ed0f5b61632b6bcecdba23754417
SHA1 e146bf586f4b0d05732ada8ef1db69d750ef5d24
SHA512 444e540b31e713e0c3c354cb8b6d7e1b6a2953fe7290210ba26f05241c31b6d0f49ed818ddc438754403e7ce0fb06af4e9be6c46e101da6cf96bef6082d58d4a
SSDEEP 24576:tC4KpTe1jEQhTCMpyGvxVdDSjyc8TzeIXGf5530iABV6zZUPhW:NS5l
TLSH
T1F215AB547EF9F7570F8E8A19A4320E4E9594AE4652803C38C35AE3FC2B2DF1B4DDA215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\ar.pak
Size 1016KB
SHA256 cf46d1687d01d8ba58512ea7082aedbaa14ff0e748eae295fbcdae464b271b77
MD5 9236822ebebe58d5931cb3abfa59d05e
SHA1 a28c445ee0f9ba804f448d37ca7da3720d664f28
SHA512 368fca3153f7130b3fa76e373a1574a0db440a027697651c8ae075804c78d9d50a6d98c0b7d4edd13094d1da6c332a00ab943893b3006b507e491a489b457e65
SSDEEP 12288:8yq5GPb4BBjLVHTLG2awjy8u+7v4UDodMqkMZS158qNjpPEKLLlYy:8yvm5zE6
TLSH
T107258BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\bg.pak
Size 1.0MB
SHA256 f2a46c4ee04330ef49f6acc62c26ed7ec57dfe124aa386e08c5b582832c4000e
MD5 934193d485de19986de7e0277c139cd3
SHA1 387b3699cfbfa62fbdeeb4f6d9b127df0eb7e719
SHA512 d3516bb252832db4573d38ae9d6ab63db4a5988f49f92fbcdf191a12d9be078600dda750330fe66286a89dcf614864191f60a97999e66e317eedb0fea75bb8e9
SSDEEP 24576:qDcOWNy/LYJzQkECtUrVb6tbGdx373ZTm1z3GjK4UfVDsMX74u2VZsxI5e468KtL:XOWNy/LYO6UrVb6tbGdx373ZTmZ3G7Ul
TLSH
T1283524A15B9A68DF0101F45F98087E093CEB84FE3FE7879241652DBD39E10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\bn.pak
Size 1.3MB
SHA256 b4ada9665be5c9d9fe4254bff291978dfb50c2b22a7149faf9b9c3f470f0d32f
MD5 22f36ee63dd0e66da673a95e85352e1c
SHA1 65ea5cfaadabe5ed611a20f77d816b1f51aeea1d
SHA512 98b7661cf382ab9feedd09c074b8fa458e061633b250e0dff3ae5417fa7ee43f950f3952aecad8dc6d4dc8ece3d7f4428f4440acf03b525850476517ddd53efb
SSDEEP 3072:xlE7CdT2+xplSGuIpdJ5259J9gJfifHRbkWvLypUBbqVQL55BkwuHX:xeCdT2+xpsLIp3UkWvLypUBbb5UwM
TLSH
T1E755EF209C6E81B6A8C5CDC9434C6370C523AE9B9B61F74DDC17A14938ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\ca.pak
Size 640KB
SHA256 252c097b90fc3ba9096c519a6ab2e91b441f11cce65c7c47777542959dbf6c34
MD5 10db08caf10e1b1bf0570cf1b765278c
SHA1 914c5c8e9eb7cc7e718c16036025199c6dafd0bb
SHA512 e62302f4240f5eb5c56ec3f6ffa7846a562c02628812e70880f86818a061ab5b29197fa677c72f78bad9e0118f8de1e3ff13c223ccc6e54a2356dddb50caf343
SSDEEP 12288:YTW25sL27hjGlCiGh3UQU8K5PsFYN3Mw2juwHzejm0t3l7b7T5+vHcwTLT/fnWyN:YT5sio4L622l8MN2M0K5MYwUy
TLSH
T163D408239FC93B7704D2330EFB46C217A48CA9847B16D254F4AE1B1622CCADCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\cs.pak
Size 663KB
SHA256 5e9385505f9507d4a57f7a5960ceb35b5fba92c662b53bda4e4dc0d63245059a
MD5 b5daa2520a4bf24cb6b5298aa518f444
SHA1 6255446419fc78dc365267f254e7cbb5f5033b40
SHA512 000a7b9512ac05d027c43c80d397efc0b082305fcb52c499b587bd0584c54ae3794a4c74fefef9c7280f1cfaec4d21696178a5ba52815f992c9b5fe3df5e6899
SSDEEP 6144:CWEvFuhf4xp+EHbF2Pw00z35AtYJlA7Af5Bzp/GZ8OwwJSBW48Qz:9iohwrbF2HO35AtWD5Bzp/GZ8OLJSV
TLSH
T1BCE4391EEEA36435584002487FBE4128BD6E83140B6EB9AB7C8F9D91257577E8FF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\da.pak
Size 598KB
SHA256 054849037db8f9672ab80606dd7163f25b18710ee7f777e7eeaa68d24447aee6
MD5 f5e55fe7f2cde2968c0d2d0cac10dc36
SHA1 4c93a1eeced587dc5b01d7d8e3a063a5a2a7b4db
SHA512 3042ee29efef6d8c580758c623173c6fca5bb6a65779f928d6c1e635bccdd0f0c0528d1a2cda4409a1be1c25d6f0006cef3bd6982fafa0400c784890681494e0
SSDEEP 6144:sATJBS1qVIQRMNiVzVIv5MwHJBE/evTawlAnsJwOgobiq2SaE5dtfwcYsghHLd4E:sAIiAHVTe9q5dt4nsR8
TLSH
T1E8D45A4BDC9C732FC9A90725F3118DA7EB6D543CC684264F65D8943A09CBCA097BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\de.pak
Size 640KB
SHA256 404975e6b3af1f4e40be3905da1850c3e87e29bd03d0866185ff85c06861ba68
MD5 a63e224a1e24b61f3acf3bbdd212f563
SHA1 17e6e42e88509e1aca6ec87a0d5e936633bbb5be
SHA512 7db291bb6df49ad037916d31244636ce588f851b7e2d6e9b5c05bbf9199377a45f852ec979fcbe40b5810c0d8f2b1fcde924d7f8d1ff4bd33a3778dbbdf07a53
SSDEEP 12288:ZyDS5JG/3K7Up+guafzEmLO35aSUMUdChT:Z0S5c/3K7Up+gua7R650ChT
TLSH
T1AAD41803ADDF625ED68673617305CDB77B19E36BC342322788EDD12B614B5B283AD422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\el.pak
Size 1.1MB
SHA256 dc27d24e9afd24124abca6dca1a362462851267902fe6493ff3165a1c5aab69f
MD5 bd76528a8fc532885ecb7530f543e975
SHA1 a95e9ed8e3b7fd6a768f37465cd66b09404aa156
SHA512 b9d4a98768a56509ebb4a55f1c2a05300e32be939647a0b3acbb45083930d91967c68c5a0276d5f57400a6b8a410c8d0289ee403d127e7985db502675729a398
SSDEEP 24576:rqss46HWFbrlK5Yp9Ck2txZu8OJXDsSHCmu2Od7IO2USUBx3PyjkHvFz4VoyNJmJ:rqP/HWFbrlK5Yp9Ck2txZu8OJXDsSHCT
TLSH
T12845CFEFB4582DED8046950785D8F07C2BC66D6CE749CBD86229CB60BDF80719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\en-GB.pak
Size 518KB
SHA256 ee6fc979d1fff0c1a4d6bca929691733665c5df7e7a43cc54f1165ea14cffa67
MD5 c66a0ee9892bdb1f511a614d432b5b68
SHA1 0bade47c568201dfca6982d46d44a64e44de288e
SHA512 c83f45164b07932bfb17204ba3016ef4bc2c68817f7456d9a25f807d0ffeb4c1eeb1d3114bac5dd3907332765b20ae0790fe90d54399b6e0e4733adc40e708c7
SSDEEP 6144:mCJMs1KdSc4rcuF4yVEMP9pQRIBfaYHHDjko5b0DG1BcERQu:1J1IR4/EMLQRI7F5wDw
TLSH
T199B43C1FF785126A059352A2BB0AA562FF22D07CB35112663CBD801C33B6766C3777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\en-US.pak
Size 524KB
SHA256 bfa782c9efae2c9cd2c0214dae1bbb3c259d4d4c38d920b06677b9c4cf4f813d
MD5 bfbb69222dcc50ca860b6a80a3da4f4c
SHA1 51200c9bd18b0999ba38033662c5e319485e7420
SHA512 940a2855b5de5f1545abbfed5dad0cfe81e74e847a60f65b4a8df54860649502062ff8941c0fbb248c203fbe6b883ecae8b21e91215b07c1231129a914008a28
SSDEEP 6144:njtGVh0jMRG0PTMP9QQo94faYQ6TFB+5P2jdnngP8/s1wf:jEVhmOTMCQo9+C5Ojawf
TLSH
T160B44C1FF744122A05A352627F0995A2FF32D06CA35112663CBD812C3376B6AD3B77E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\es-419.pak
Size 631KB
SHA256 2b728123b590c5570a46ec2da7d4e620cb81559629f933ee5d71386fa142e02b
MD5 b0a63cb56453f3ec942195e1065e129a
SHA1 5016eab186612f33a7241f842cbcbe80ca709cce
SHA512 ea61a557d626f91c12e22dde790804dcdf6d407ea623369fcb4bd376d72152b71648263f02d2600fd77b2655d34382be95f32ede24057bafdb891ccec45a537c
SSDEEP 6144:rsK6lxhznjoJYLFLnQ2FYjnmo5vV305ieSr5AAoRGCl:m1BmpVu5ieUAfl
TLSH
T1F1D4F822BAC81F5310E3A388B743D757E4989545B408C29BE8EB876522CCF8CD977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\es.pak
Size 628KB
SHA256 4801312dd5d7e3d62db05b8fe326d982f3887c65ac9faa7621009853c0d3b0b1
MD5 60abb63b7d0a231c361bb03111499b89
SHA1 e6ec3f843f199b706fbe7c1d3a342c667bfc6e7f
SHA512 b61b34f108e264bb24fdaa5c638cfb5afc428a1f28edde8a1839b6af84c2d6889b460a0e73a9ec3d3dd0d3c4e1041aab8fac7413e64863a0bddb6339542207b6
SSDEEP 6144:b1YkJ88v4zeV/1uGbU5gtEa+5QhGcm3X8ji5JOvAJLlvJ58J36PZOW/:Ze8v6GbUy9hGjX8ji5AoJJvf8ho
TLSH
T14AD40822AACC1F6310E39349B743D753E8D89545B508D29BE8EB876621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\et.pak
Size 573KB
SHA256 488a91b53d17ca8b52e25f143197875aef7dd50e1bd51bad749f559c17f52aec
MD5 afe1f76bc67ea3886fd0d6ada960dc06
SHA1 363cb7d2713e4f286c3655df753108b8bc1dc5d0
SHA512 b5d178f2e27e751a173b2556199eaf7a3855dc537ddb76dc105e697faaec69cedac955202838b4288f562f154e55abf12a181a1bc1dc7a61a4d5d74d1200e97f
SSDEEP 6144:yc6YcUBG7nXh+f9jaH+KPe6yH07nFdGpNQvmdxIPOTQysogWUiofoflLXhS51Tqi:ybYGDR+MvPe0nFdGpUoPfljhS5Zqcr
TLSH
T1DCC44C42A27D771B182412F9E737E927DC9FE7D8B4000D9668974A1970EEF8C38B2B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\fa.pak
Size 946KB
SHA256 cfd05fb194e5c43c2c65e7803eca72fde4f5629e849cf2dbb8f6f62156485aba
MD5 71ac9af8d1deebd0f4ac15a2f2b81e12
SHA1 8c61c12860d220b0fdf2d0162ff95c53afac73a6
SHA512 cb9f4071da718edc0ae735ac087ae2329384ad34f11dcabe2af40ca19f8a7b83cc95160e3aa3ae88bd9a4f0dffe19eceb46e2a68903381d350a761ffafd02beb
SSDEEP 24576:BOoBOF5I8u313uyqoz+sb2vRmXnloTUoXtCfGk62Yh78ai/78MX4UOVU8Rkc02un:MdS5im
TLSH
T19625C1957AAC9AB15747CA0341E33834C773EF12D349FE40ACA1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\fi.pak
Size 584KB
SHA256 c04f5e2b7f30e8e350feefd6cc45f266dbeacf11837cc774c977bf76e9b403a7
MD5 4c9edf90a899707ff2ac97c81b5e61b1
SHA1 967ed2339e4a14147ed60d0875f16ea3d3cd480d
SHA512 fe80a1f6df3458e43bebe1f62203bf3f738055f4a13412c6ab0bc16da83b876b05c8aa89baa365a1ca7155296cfb3dbed4f143b89e4dacb98aaf50edbea1ab2b
SSDEEP 12288:ulx/dp19Tca5WaW5wJw+UURI8pvWamvaG:8x/25wJzId
TLSH
T1EBD45C915219C22237C4D29E7DB0903EF5E5E3DCCC284D9AE843C7D849EA9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\fil.pak
Size 662KB
SHA256 48884f90e800b0b0803ddaa0bbebbea1292bf8e1bb5ee8f035a79371bef7ac2b
MD5 4fcaec162908f63d6da009e18ad83539
SHA1 953d1748d721717dd7ad7f535764a73bc6a4d616
SHA512 0ca395473ef66ad1142c5f6088ce90a534f7eb45fc9e9e5acc32eab5f371571679b2bd6538f09c5223a82558371cd247182f4b64624cc507b09f2815daae1c19
SSDEEP 6144:4IC7/okacr/Er9FFfNy4DQ+ZyIWltRFhsAcJ56SGvla9boV8A1cOO:Hi/aO/ELn5yvO
TLSH
T10BE4C61577402748DBC352E55360A82F6AE560B83F827C6E0FBF269B7BA7CD5D270182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\fr.pak
Size 682KB
SHA256 e311ebdf49828d313760453a01ad1335bac955b4b8b291accf038714c91ebc03
MD5 73896c5acfb23715348065cfeaaa95ca
SHA1 a5faac8ea692e1dbe6dc667fea32a1a6ad8f845e
SHA512 4de8e3bd5bc4fadf655536b5285e4f5f570236d3c60d1e52259bd1d7568415f9c57816a97633d439eb36e22ffcdfd46913465dc827ea74ea3ae1e2b3b0ec7855
SSDEEP 12288:Abw5DvTZLAqb5dZb2Z7R6QuaSVYLyH81ezQI9kiZuYnY88jw2wTxJDzLmdxSm40m:3o6VmZf55M
TLSH
T1D2E4E66FBAC431CB19C60277FB16D663DD348248F215E340D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\gu.pak
Size 1.3MB
SHA256 11e4ab3cfa421ea0d4d0971b038a6e7a254094fa6dfe9b8f65fd1572f36bcabb
MD5 d76f8c03323625db4edfee35784da1be
SHA1 af7cdb843bd30ca234d81cd9c593c87709aec30c
SHA512 3af2d086b5abb988b2c67037870c1d2a9cf68ace232d99cda47b93d2639adafed3bc39300ac5635d7028004c2d3a327179be90568e27a1a1a6c7869f5d76359d
SSDEEP 3072:/sKn1zW++jFtt1Ib9tPjAwREJKVMjNiT7llj63rAulfcSi5NnWsWi+/GQoy7vBzu:/sCNWxCbjs7z5qCVCi1ssLw
TLSH
T1BD5518D0D7B9F07019DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\he.pak
Size 829KB
SHA256 30409b7264418b9b9852b2419669bb8da6f489b58d4eeb1007b39d5cc978621d
MD5 2fe5716790acc2234910947f2501f387
SHA1 062c54e342088acd61a8cdafc6a2264235c54c94
SHA512 57ffdc66c062819d8a5e2edc82d04e626b1ca00e5528f796e46e170c29f69ec89a771d157799ed732fce31f97bc2f6001b559471cfa84f8ad0d1f932fa4bbe6a
SSDEEP 12288:wGrhOF2GrTmoBrAfDuBAlGWq+/1J3GIGAACXlXeQCaj35RXbN60jsXk5mOmmrrB9:l5j62
TLSH
T1BB0599C4B2E452255131AAC39FA5FA286FF3CAB53CA27512CB14526CAC774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\hi.pak
Size 1.4MB
SHA256 59ae1278d1b58da7c0a11e5a23bf69ea31c674aebbc24fcd537a84769efe9d69
MD5 116a4f944f08e6005b792d89d3f0bf96
SHA1 b507dc68a7f86abe2db57dedf3b04a8ca7534acb
SHA512 f3547fbc2e28a34f7ed849f05280fc1ad13c0e81cae85e06a89068bf8b1c1b10901fc067b3c066d89640f40e82236878e365d039d531d5ab4cad3b8535626d41
SSDEEP 3072:eUe+UDOnh+DI6ESjQrcewaV/B90ZV1d3uGlqvN3dgNJEdtDVeDn1s4f4/BtROy4N:8+jh+QSjQt/+U5pAndKtu
TLSH
T11165050CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\hr.pak
Size 639KB
SHA256 36d9939cd9d89baae124fc930cc050e386df2b8fd0eda0fb48882a2929b94a76
MD5 8ca2b00eb3f0a1aba023d6bd80b0df03
SHA1 925a49d5c63dfe2a5a4f235bb31007f060751ab3
SHA512 df5406e2cbbed3f612554c2a13c71211c0d8883f69b96f0116b5044ec8d8ea8b39bce572f158d2eed52fefee9ea8dda684987019f78830d2b2deaafcb379cdd1
SSDEEP 6144:krVaCiySH1RnvXOKDOYE/5wQCOR7PrzpJ:kxZu1RnvXfM5+O9pJ
TLSH
T119D42A7DBEF3570A0897B34AEFAA434479BD08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\hu.pak
Size 684KB
SHA256 501569c5e74285231b41d067e0ea28972ef0ab7b269886485cf1b42cd78cbd1d
MD5 b898f99d79360f2bf2ce506c324c25a1
SHA1 8805034141ac3b138688d00bb8ffaec7a5033f68
SHA512 bf55f3b15964e346e9b6be757de03fa0c610d568428d443a55135c8a823e71ae3c7bb99ef40e429950e601ce96ad8fa2b68d7fb482c785a10c5dd8e52b76ae23
SSDEEP 6144:MddbPxudyTpVHiLlw5kgWA4ZtOu8U5UTt8gZ494rYhCi/UtmuFNer2EnjD+54RIf:MdVPELAjU5UJ8LRa5Tys
TLSH
T18FE44BB79376905ABC6C179778643F15592E481BAF2B32FB2883846D24A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\id.pak
Size 565KB
SHA256 09d4dd7cbe4eb1b7730a80a3a3cd0606139f4b9647b0a04b49314638680b0a31
MD5 7bbdc528c668aa0994417aac9301a718
SHA1 71a6c00c115c5c6ea01d8f6258f141e5a35c70c9
SHA512 52e742e249f12fa3185c961e91c39a290b8ffcfd4260d9b502b90608ebdbbfeb834a43b150a415af76e84a0527c7473da122c6e857ab12b4e0c87319f64d9c6d
SSDEEP 6144:4pNXRs8aNQQ83ZA9tK4AfjzTFjlFtXmBmiFp/Q25R61lKOBCTmWiTv8oyHu:w/vaNI3ZWj8TFjlFlmAi75R61T4u
TLSH
T1F4C4E8632ECD310C094842D5F2DDAA1E7CCE233BAF05B76E8E348F7055A67686716B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\it.pak
Size 619KB
SHA256 901a28a4cd0b1d545f0c2e4aa54914029adc03801859761db30c81947de63f92
MD5 5643e0b3864700801fc4a1c59a1244d5
SHA1 2c7529e034bf04589ed52a4bafc5123d7f424910
SHA512 bc60b4df1f943df74a93046eae531ad8a2eb7c0186a8df9c5e9b4a09b3a3466f8b3e8f0246fcf53bf819e3744599519182bd9a3e52d87e683fa260b007002766
SSDEEP 6144:ct7Hl4tBXWx8miX97+2N9rYS/qBRRs61wtl/RT9TbOKkg3gCYrqdqpzSj9f3wBYE:0sGMXZZ/K8YM1CWkb5PkSlxVr
TLSH
T1F6D41B3AA5D6212519976359E611B085FB6EFCDCFA41721CC99B031C22CFE80F2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\ja.pak
Size 754KB
SHA256 8250b4783dcc389fa96fdf79e8188e439ffe5fc01325f32ab8c322c4d27f20a4
MD5 830a7cba279a3deb42af3e23775cbc4b
SHA1 7102caba0d73d48af569d6c9877fa3955fb778b6
SHA512 e0277e4dc6a1f603a0ffb40e7e01dace0f49604eef6aa6d4fe554592f7366af490b84c6d7b823ab61fea55d335437f69ba04502537a3d90fc704a741b6633b2d
SSDEEP 6144:mnhlmdGBTZTDm1CQRdMfdV+Z8Q2E0uRUNbN5ziIy5GzV3:qraGBBDTyO+Z8Q2E0sUj5zVy5U
TLSH
T18EF44F7CE3C969369D6152A22C0E36E17506AC5FFCA23A3A443DC074BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\kn.pak
Size 1.5MB
SHA256 847c5e6abcddf120b4dbc34e28dcd1c2e93f94ab1d6f016d0c1504a58cfd5b93
MD5 4183e32193ba8bd36bc421490dfd0959
SHA1 c3c1ea138dbe32969f10f3d25556f381ec1e3688
SHA512 06b0fb8ac6c844b3efa6a26c0af5e295d0074ec78902bb7c1767191440176a60367e4deb7ff527284c12b5de22fe84e943967e37a6baafdee798d7dc2b642017
SSDEEP 12288:BiHflzAE1TS7ZhbUqZMS1M7P5JVHM+4EryjEi:BsKQ5nMl
TLSH
T19A75CD18ADBA7D301BD5106B24EC643ECFF16BE29CA907C2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\ko.pak
Size 640KB
SHA256 b8ecd18ce8601686ef64129c77f5307d0c60656d27eede7a23b4f3947647b302
MD5 577ffa9acdca15ad31b1bcb16814d4cc
SHA1 799416720afe209f47355542cbd6ca607a965df8
SHA512 01837e4a84bb4eef059bda5ffab9bc4bb7d3b349bdb3a11d7d01471f1d9afec817a26925255078c62dbe05b51a8aff4a652a93740a1ea8833d3471b7f3f535e3
SSDEEP 12288:47/T8gEgukiPM1WNiPszcbifYj4ZGRy0IeYs1ubLwLCMrI01xWSJGRG1zLhwEtFr:6/g6Im3R5o3uHuI
TLSH
T129D4C5F23CDB63C91193CD82AEF4FA198382D976F7530294ED44CE449E245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\lt.pak
Size 694KB
SHA256 6d648211ff3a6801e049c9a3931afaf3007857b2872e55ae11e19849180d19da
MD5 bf8e3fb7d28a72a7064e593c065e2535
SHA1 127eaad62f1298643dc2b2558f24d18a24eb7355
SHA512 930027bacb01d41124167b326df40d61e7119d81046eb289ae5577cf5bc492762bcb80932dcb56e4a8103d63fbde11873b1477af627f159e709c9fcfa84771ba
SSDEEP 12288:zzffIIZg4oMwQSY0PrVKrY4bi5P7MIAAJP6StA:zzffIBM0Bbqi5oItJ4
TLSH
T182E42B0069E3AEFB9A4467C981A4CA78DEFD50009767BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\lv.pak
Size 692KB
SHA256 0c0663909339a1f4edf09355a67eea0fcfe821c78d4891604eee31695ce20b37
MD5 247ff0976e6756e17f3260b19ec59ff8
SHA1 a42f0145d6c7422bab290a7552155aa8b420e515
SHA512 3ec584b9b637a5554a5ee1e182851dd254f28d1767b582b1bcf81b0c4096a0ff74487f3153bebce2126e1de05c813cb0d1b2dac251d6fbf3a71abc486a6fcf8b
SSDEEP 6144:5mjmTu+M7F28kCybaFGkrNStVFxH9KGz8mQWQd5VbONT5rmNnaERchTyGisHcAz2:1R4CCywMd9zpQHINT5UchTyscSx5S
TLSH
T16DE42B959EC68FA94D904DCA733AD132A8CCD740FE07E112DD7D8B3A650F52822B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\ml.pak
Size 1.5MB
SHA256 2bc35d18af85b3c7004a6e1e02591f5db4430a2f334f5c4be3c0a0e04837d9ae
MD5 d2faced6115180461f01ec5b37780721
SHA1 04af518a359396406efe27062de502d72a0efee2
SHA512 cdfe605367e5a2ef4026d1a1805f932397b161c28e37673be06431494bcecf4757aa4677d9ea38659e40a0a4dabf482ac4598eaa430ce8ec59cf26e6525567a4
SSDEEP 24576:7zVM/oZAuuxyYl+9y9XBkx/em7KfyBR+zXcj+v2uiLl3751aaiAD3e:7zJ5g
TLSH
T1F5759D5BA036CD3B0FD102167B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\mr.pak
Size 1.3MB
SHA256 5dee369e9366bfcc4fc95aec6c58b915933efd72c718d56802e35e8af5a880a0
MD5 83769844b688def4c5a1f4ad810cdf03
SHA1 8280d04751f52d62397fa9eb0fd73811cb331344
SHA512 15b1bce67685c1a3e250f89c70a6e47c16cf1d78cc089c86bbc342aa047ec248db71a0ca0cdf00d1147341289b778ae280d0d29932f673bbc65d79736f28079a
SSDEEP 3072:zDvYSVM2ENIGC6dN5t1iIh8roTsElUrX3iWUVse0NF05HwF/yGRR3R5EodxEdY+7:zTfM36iWUPuH0P2Qt4P45tmbAy2
TLSH
T1A855C24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\ms.pak
Size 595KB
SHA256 5af99080b311e15a19f9988779a1cdd939a7fb9b98bf093fca324eeb58b39602
MD5 ec5e67d9e72519f3a1c7611ef1919a9a
SHA1 eadf0806da3c5020ded53cd0a0a2a16551aa0de5
SHA512 3c5101b115e548134ae8c1b915305b0cbf81b955a63859def2271796353d7a6f3441c01956fa3f6eca855c40febba666b6c11322a9dd6399918bede5fdafcf3f
SSDEEP 6144:l5PzpO9dhf94qE1XJHxze6L/rg42Huqwo9O78AVzZY5b4tVlqL3VDhh:ncjqz1Rx66Q/HuqwoWfY5GlqF
TLSH
T130D4B6469EDE3118085843D9D2DEA91B7CDD3332B705AF2B4DB08FB0126E7A53316B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\nb.pak
Size 572KB
SHA256 11e798ef612a1d22b90450c547998bf0b23ccc4ca5265f27f1924c8b09f22937
MD5 08d67d2d33fbac45ccd9d09f86f16d9a
SHA1 1537998d712de4d4936a00df571d979f56523ff7
SHA512 df267cbcaeba56aefd906005c11fe62ef1d697c2e0213bdce1fc24805cd20e384ea213da0c1255e156fdcab3ea59f4d2b200868a6d02e8ddf9f4c1ed878b95bf
SSDEEP 12288:Qzjx5QXbO2jOp7fI4R36v3qG5wmNBdls7FDu:uxmOes6v3qG5XNB7uA
TLSH
T121C40883EE46B72EF2A443A4F519855B9B7D942CCE98199B54CCC63E0CC7AF052BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\nl.pak
Size 594KB
SHA256 bf2a7d52d8c061b5f5543e7c4e20b4eac96e65e02a967752af873c3ec30034b2
MD5 628efc38e167f553e6ea4e46fe77c112
SHA1 44734e1804e10bf0a18675432904ce2689293064
SHA512 200ea89e0c466216af6be2d029c057c15b3afd5e48287fc978d551b14116f41712289fff86234e5dc5f7e33260723a5b4ed0a9d48672d0d496bb5f8d8935cd9d
SSDEEP 12288:KqKspUlbJWQusNUSX/gmfex95bt8ysigqHgGfDTF:KqGlbJWQusNUsfex95biysVqHgG7R
TLSH
T155D4F907AC4E653E59C0A349FA098FBBBF2ED22CC26CE67D94DDD5340443F6842AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\pl.pak
Size 663KB
SHA256 7a464e196878d304c7358e7ea457e5d2a17e3065ab02f29b8402803c401d747f
MD5 879a5773cc682f1d557eef24cf02c8d4
SHA1 eda4190bd8831926b8736d5f7d86d1c84228e52a
SHA512 1a2c9d120136eda736fcbc30a03aeee3ff5f23c794bbff63b384299deccb65a378cc6d2f126c625ae29fe968db842a2b39692f112f472baedbac7ba83e11c939
SSDEEP 12288:FvPTW96Z+wKppFwfQfuzSJabZLbEYPPcCUdTe3m4U0hMrma1Qh8j5Ra7FolEqtT:F3Ti6ZopPYfhM91Qhk5bB
TLSH
T192E45C0E5AE58A4E8CB008E6F2E70B7CACDDC808F109D35FE45F4526615B19ECABE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\pt-BR.pak
Size 621KB
SHA256 6cb59658b372d605c4dac61711b56abf5555ed69e7b9ab0916f9185af48e66ec
MD5 51094db887fd87bbc9162d5521e22973
SHA1 36e3c2e2516493c35dbe11ba18548eeb7e2dec99
SHA512 c5c15fdf857144105f2d544f70a454aa9322e4e451c377e184b543d99f20ff5daeadde54694ab1e77385893f9f728cec0402891bd98da86571d73893fa24e98e
SSDEEP 6144:0D/LLEOBh0NBXBLJZPlQcy2Q58ENAhzgesRUJmMs:0DjLEOBmY58EAXsRemv
TLSH
T194D42C2A6ECA136604225350774EDB47E5881745FE0ACA87DCFF4F06A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\pt-PT.pak
Size 625KB
SHA256 b727b377a6ccf25952189c59ef175c213dd1e29e896b6b5fdfacd024c711ac93
MD5 ccd1baf51f76cf4041c5946a3280c5d4
SHA1 98d8c6adab3d8bff3a4339898a8bbf68047d8c8d
SHA512 b6233a3eb262cb16b4cd61302dda8a74b129af80596528289f47e3efabce50fd4e06b8ee6e39dfb3426851f191ee62d79bef2ed97757fb2da02f0284b079e7f9
SSDEEP 6144:kKrHqVBc1X+oYpStieJVJJxhbGDLfbDGfDUh5snsusGMSRTd:klDe+oYbxh5sns6MSRJ
TLSH
T1D1D429286EDA136605135341770ADB03FAC86655F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\ro.pak
Size 648KB
SHA256 205ea8cc0b368426f06c533b636a2845e66e3f7932aa6a680645e79de15edff3
MD5 06edd53ab148c98097b5970386e2f9ef
SHA1 c1cc65de8cc69e82666f7fecbe510de7a9f8cda6
SHA512 9bc9a8b34bd6be4bbbe959757c23708aa109ca476727686c5cf4de295c596bd96ea4f226b2b93d04fe0f67b9011f14ecbd3648e967fa003b9b1b26e548575aa5
SSDEEP 12288:sVjgzMdy7hjolyvnBf4d2/j5sAZ5Bc2/ff:KgOs5X5y4
TLSH
T1B7E44D23A1C82A972D5152B2B73624D3E88D105DF641E28DA4DEC97D10CDDDBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\ru.pak
Size 1.0MB
SHA256 54f1bc4ffc72547a655d4737d2c7260a71794dda56fbffd13e6e8cc313c5520c
MD5 b000132c3da11a23d9502e879e35244c
SHA1 19d441ddab87bd2ae421b31196ecd2c9c1c158ab
SHA512 b3d43c43701c569060d3f5a942102d07fe7f2c76e7856eb4769f5fccd56aae9907c69e1cedb391cd66fe437ac92105a4e5f3d4d949982a5adb6c8bf72708f57d
SSDEEP 12288:V5ThpwfQeRo4YwispqzJ9sF+oa+UWXv6HzW/oqSv9s2WTBENtgA8Nb6dwYHyO3j7:ffcBW5eohP
TLSH
T1B5358760669E64EE1101F01BDD08BE0D3CEB45FE3FAAA31619642D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\sk.pak
Size 675KB
SHA256 eb91fe27fd087433da4d21dc1c387a816bed0de3e6a140b4597caa90f4921fda
MD5 b4438d51809fe2f1ce9b6dae65644de8
SHA1 43c5adb90d117414c9b21fb122e268c67513ac4e
SHA512 b0c49d7cb43680358ce5692079d27bac6b3e6a21ccd23182252a17775652e9c9b4fee9e2833b28798749f4e9e97b8130e5791f737fdd66cd909b9712adecc462
SSDEEP 12288:oGoBq77+NUAyi5i2Tj5Bnyf9YQ6+8pTjsxt9ia:oY+NKix5cYM/twa
TLSH
T1FEE44D3FDFE7181E8E8D0148EFEA7110FD7E8650864EB4A6944E324714E26EDCAB4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\sl.pak
Size 646KB
SHA256 52426fb8fc82d1ed28797ccb62b7fe14f123cddf011f5d5875b076cdb0c33695
MD5 ac0a75c5b39b5d01894e81fd0705b1b5
SHA1 0bb293f904c9450e26f88b47462fabdf75f03d3d
SHA512 4c002d8206040e0d76f4b7c26cdfc75e7a86cae6187d4361f8b20cf071994415bc1e8f613794b3233d631faf9cc9705549b846322430ac3e0be02380eacf404d
SSDEEP 12288:voOLftUNcWtpeWpcB2BLBPHL5lbH80WOq9Myi/fzeDJql/ad:wkftUNleWHPHL5lbH8ji/fzeDj
TLSH
T1E3E41B357AA75E0F0C9AB28FFEB606007FDC044CD252A6A2FC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\sr.pak
Size 993KB
SHA256 92dc15bac0e96ede33a7055994f3558605b3147b890ee0414314274216dbaf80
MD5 b1c9028a635ac87124f958cdf762f9e5
SHA1 342a883649a11645c90ba87713619de0ece94002
SHA512 0d5f64e224bd84873bf6d1fe004ec1c79680bb29e6eefcde0aee7460e2417a8555b9b3816ca190039165ee6cf98b1171983ae99ffb08203f95b5fe956c483cc6
SSDEEP 12288:aBNEoTHMyfD0+z3nIAhuSOd8CC0ili4MCkHvj5YEZ/XCnxKnZ37GbuEU/k/D:y+oTs5ucb5JC4o
TLSH
T1CA2556B19B9E64DB0901F41BD808BE493DAF41FE3FAB975211601DBD34E10B847B929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\sv.pak
Size 577KB
SHA256 51f5cfc915aef54ffa11077d00021c99aac1c86f04076ba70f43608b11486199
MD5 fbc8be5878cf2eb9caa03249a2703960
SHA1 397a3975e8bfe33d4a569d1ec193ca1788f49b83
SHA512 80884b7f345add46c2d3949700cee62be1beb70e19c37cc6e1f37dff16b899dc483205ca487677f3cb7766eb736ecb1fc3d21480f2e66900e8df11268c03d3cf
SSDEEP 6144:iRdRvgh0hKL6Av+iIkQywo+nmHg2NxbINlujnLAVRFcz5RtGm0+SM49mFMuISOG9:UdRvgAO6W+DTj2E/5Mi/38N
TLSH
T123C42D438A10F526FBB2530DB609015F0AEDE15CE7E2958EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\sw.pak
Size 610KB
SHA256 e3bf553f18a0008dc5ac86e001a0ffb190f885260a7bf06feaf34822f0dde36a
MD5 5d8f54655b52c495469c81505bc70cf7
SHA1 1137cfcc672d04e4d042af5e9035807ad1ee4de1
SHA512 77b01a29418ba010d1da495692ca4a388e6ef3da808c337c4696deb49af364ece62b97cfc9ca89cc5375951611f6f0e19375cb9858f15eb152da639afc07b6a7
SSDEEP 12288:x1XijzUy72yxGC2qMrZ5CmedqNGjRdpvC574FqHKLC6y5IZSLQB4GFpP2NUiQlZi:xdinNUGFDi4p5WcQ
TLSH
T165D4D6629871E0191233518603DDFF732BDCED5C292B2D935A46BF0F218F98C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\ta.pak
Size 1.5MB
SHA256 d3849b163ddca28155194a3b68583e115943d087a4d0bdb90ea815eff618cb73
MD5 f940b7b57fa0f5bc1c10c646318970bd
SHA1 d2c84040cbe3b317a2f237d05db14a31fd1be347
SHA512 fd1f8762582e0dd34b0791b38f5220eee384a8c11acd97b37194563ba8e1dd96e844d13c2e963fafb7f999f3ab6698303baead64e789780097a88856987c38eb
SSDEEP 6144:XUBBTJI5LocB5aAkuWdGP5f55q3tR9Ptm1vYpiMyO:wTq5Ll4FdGR55qBtm1vYpiMyO
TLSH
T1CD750CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\te.pak
Size 1.4MB
SHA256 4038e8dda796e26e5101da4af24a2a9c212637fec1e7633458b821d38023751b
MD5 09af4a60f243cb0211a69c142ef858a6
SHA1 3a6e821cb8ce2362a093d983ff51b41f01cbec81
SHA512 408bcd2cf86965f1fe6d71d2bcfc2231fff02259b5ff755903232503600466e32f04370d43dce55cea6c2b732ff92f9a5b9089099322f67efa475dc81c82a3cf
SSDEEP 12288:EGJlztoiUy7McKNxywG6USF602ygIC8ymoRRT5bbiu52C6WuB6SI3p1FG1Y5/C/K:EG7aRt/5SRcO9
TLSH
T1E66592023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\th.pak
Size 1.2MB
SHA256 e4e627969668d8672cc5212b9b3a1f3c42fe0c5d90d15ee893ff0bce8cf7c2c3
MD5 2f2e7773c921c55378207f4262daf575
SHA1 e919488f38f46afeba97d0759c00c66bacc728a1
SHA512 347bf1308e9ec5fe18f9e0e1f30c0c56f1b629db99be3ec4ddd8d03c4b9f6e09b6938cb93ad385fe194441e4540c190e367eaa7785917a068e9bf4fb7524b176
SSDEEP 12288:SY6dz/wyzx9N9LyZYAozYLz8AsShukJUseTPsO5eXffpbDFDS6Sd2N+Qj4o1qsl7:54Iyzxg15Csj
TLSH
T190453BB37247DDD479441B5B262A7789672DAE693F73F8E00089215A73F071A8432EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\tr.pak
Size 621KB
SHA256 eafa2065b5dc4a3c95e5f0207fc31dc54f63aee65a8fe79925ac62a15161ee68
MD5 c7c5739fde8a8e6a74fc67fe10cc92cf
SHA1 9be5a3f6aead9c0a7d5fe6d688eece2d1db53a1b
SHA512 2bb59e05dc1499e326533b3521c5345b50c404efa512043ce4f908909242ccb8cdfaa5e12218ef9769bb3199b7a01ea7d4b364cb6608072f74415b5d82bfff88
SSDEEP 12288:yR597aXhXBQTw5Hz6sgwpIfZFR9G4pKkf5Mo4c:yJ7xcgKkf5F4c
TLSH
T167D4EA8178EF682C8BB9278FD6E90666F89F0766B331F4469B168636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\uk.pak
Size 1.1MB
SHA256 4b65c4e32609f29eebe8fefa25b0fa861c05cfb51131d5ba64e1878666a0bd24
MD5 1b697e603f9828c5ad13e36afa829341
SHA1 f4653e5619ac52b79da8b6576ed4febff8f92ef5
SHA512 434e17983b7502743c2210bddf1679541c8bba9c0f5b715d8b77cc919cc8d46395449054a0b407e024e30fb661acc00d1f8aa6f90bd141e1c87328204d8ccaed
SSDEEP 12288:phbqFH3ijmrV7GjIwkkzVWxjvC6sSr+fQn1u6ChdiBEIKT3/5iNvcA6Qwe860Yuo:p4ZSyrkim5K8E
TLSH
T1DF35A9A19A9D54EF0105F05BE94C7A0D7DA701FE7FA7871625A43DBF28F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\ur.pak
Size 933KB
SHA256 c0d81e0446bae6d62b496f5268222ad53fe5e6f7325c19bdb7685974967beb3b
MD5 38e2b44e1d59e3275cafac4225896dab
SHA1 18c75e680d79c648434ddd19dd22a55fd49530ad
SHA512 a5a4dcf0c24538bfec537cdccb993032bb5947e3c7c37793f7a6204df77513bb8ec6bade6e832a6248c1e670c513a8dbed2a9e2f30fcc7d60f034500dfd94dd2
SSDEEP 12288:9uidSKoWw8Pl1eqtdQarI7yRbTpt5gnpEhjGMOd+DyQYrsKYjwadcJKwUduqco/r:9QI/5xGtu
TLSH
T1BA15F0D2E6B896B34A21D92780D33C34CB735F13D34AF285E56246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\vi.pak
Size 737KB
SHA256 3db088338da5890b390d6bdc047bd038ef2b2f3d982c74f546784895dd0d9b18
MD5 7772d478e416ee84286e591f5ff60c18
SHA1 1294bda5e37a7e02ee16a0ebe5937af99a5ecb50
SHA512 be88f4200d81916d18880160087a0c360c213fd4cd1356a691d00a525399422782e14fa39207d9c3ad75ed3e6979c6cea87342483b7ae329ca675a860b3a06ac
SSDEEP 12288:TQq+cyZ8oE1sVpBhbgN0+QYVN5OFWdjaMg3p5a8iVy7oIN1ZIj6l2eziuR2mfzqK:TQq+cyZVU0DFG2r5a8JFC+l2YiuhfzqK
TLSH
T111F4851216E1302680AC553EC6CE540D6FCAE42FF7C18FE56FF4297476221A46F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\zh-CN.pak
Size 529KB
SHA256 e0eb2457c1edb82ab19f484e45d3e029ad0c5b5cc07d68a82faf6bab55f52e52
MD5 0049a699318d1fcba473a12387e12154
SHA1 8f6395bd3c089aef2f69827e66eef04a37f241c1
SHA512 8af8059f8ade9df619068945ac9836a58b700fbbad2cece134cea82a5a250f93c2abd1ebe54390dc01bb1f0de93266661a86da984c325259b766e20f52966dd2
SSDEEP 6144:FJzyWdo7DRSkO1zik9nV7u8UkEZWbn5tXNIXp3IYj2EBxnWuY7lA:FZyWdoX4ziinc8UkEZWL5RNsYYhBUu
TLSH
T1F0B47DE910F9BDEC004650E03729613DBC41760BF66BAF366ED248DD1AA2FAD0757A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\locales\zh-TW.pak
Size 523KB
SHA256 a5847062b32872a9a9b77361aa1a1e7f8734f6547adaa62f312a78baf20ef5c4
MD5 41adb340e5e3f4ce714359af89247e64
SHA1 65279e638f06fb1f8270955ca2d38d1065cf6100
SHA512 ceb4473347ce8e9c0bdf78c450e93f70c89e36abfdc9b4d613e1c1e73ade52d65c2ec226350e49a32fc1d4752752fd09e54fd0a1fd2294fe1a76b074ab0512fc
SSDEEP 6144:6HMV/vahIDnbeaVJVhKM92GuEL7t405YYUoH8DnXmYX2LX5mdT4:9VXaweCh9jL7t405XUoH3BLh
TLSH
T15AB46CB618FBDBEF0901E884B7CD523BBC9B342CDD777632FC4518D42E6AA641A61085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owutility.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\owutility.dll
Size 3.0MB
SHA256 8a209e4a0381171f621166284beb0a726cb44a0c6969cc6cba750134438a891f
MD5 08e4da662478603a5ce6f3fea54ecd0f
SHA1 139fee8a1b7be1994dedc4edc79ad1d25ddf617e
SHA512 a2dc43b27f23dd39fed66759b73f2a10f86654153754583aa30d96d35eb0b65a6742fb23f98f0114635cf727ec0c47cee4d990efef360f5f1c8bfe3d7ace3924
SSDEEP 49152:Jstwe03D4/Gu0CYk5GyyYda7BSqpyEK/GN1+vE2SG0nypTN1BvNVrRUBhX4rqa:atXGAaaGyyH7BVOGLnyph1BllVqa
TLSH
T11CE5AE5B62A641EDC16BC4BDC943B90FF7F378190763A7DB0250966A1F27EE12A39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources.pak
Size 6.0MB
SHA256 b86af01ab1cfa0011c2ed7bf187f7c2349719987bb62b7f581d4375fdefb75cd
MD5 9bbd14743eabcbb2553a4ec7101a8422
SHA1 b72c83d02ee97089cc9f172197c77d76e2cfe9b2
SHA512 300404c1b972e0905bc9ed58af84ecff83f68100a4c1aea9dd138b3d521beee51b7b76afcbaca2f64b961c8727ab304969a65bfbb8fc1938c19e8390a5be6d20
SSDEEP 196608:1nLBR5ltjL+WkrYtJ/eGDi/F7MeZFFfD5CcowhJT:1T5n1krI/7i/BZfD5N1b
TLSH
T1925633A3F760343FC488077943D087715F7C995A2A41A0274ADCB265CE6A24F6B85BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app-update.yml
Size 253B
SHA256 8fb455b661b74401931d19367764883f9e18e2d9fa2176f3ac5246d22d9ea806
MD5 8f1b2f1a067f36e27c6d7e40e3e01c3e
SHA1 99991d7c7ba0dc8621ac23f795e1b0606214033e
SHA512 a9e90cc1785a137db10ff283facbf364686c5eb59e45b8a8aa8b823fdb803dceb05fcc25f1fbe0849a28930e0391aca7133d1198af2ea7976df8014604cde4f1
TLSH
T1DCD02E6AC701803AD3132B36E824E2648A88A098D093907086CC0208AB23D278E3F25D
MD5 SHA1 SHA512 TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar
Size 24.3MB
SHA256 0a86fe349f62bc22a6c4026e0ca973a28842f455514edecd92d00282f9ff2971
MD5 1adf1d4d30f304b32589935d05e77c2b
SHA1 dc0e52f9b07e90b0d063d5bb4cb78293d835779c
SHA512 3c6689b9b293d965e27a1d1018acf2a1e94464383d85e509ef5a3aa0ba182bc43aecead8ddbdf47bd055d75c8133cc47161893b28acc2e79ec1e5fbe7be38200
SSDEEP 393216:vxB6/rEvhbPFzRcuhHmvu0cFkP7B0wTIpqBWq/c54l2xB6/rEvhbPFzRcuhHmvuD:HwHmq4
TLSH
T1E447AF8576E5743283A763B9486F4005F33A941B680C852CF5BCC9D92F9885892FBFF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7x.sh

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\7x.sh
Size 235B
SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
MD5 8a65a1ab93601ddecb93af2a310dd68b
SHA1 a1d449ca51b5ba67be9cbcaa7901cf9b3f1c0f04
SHA512 25844b7975d5567b70d793369342211bac5ceb5d17fee7cc7a0a6a0a2b8d42f4188119544927da81cd88c115fad9d09993f2ef61ee228ed16fc20e0ab323482a
TLSH
T1DCD02B11D01DA8841049060311457428C821A859330C3EC99C5216BFEE15F632819358
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\index.js
Size 500B
SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
MD5 9fe8a485038be54d687ad7dd9dff80d3
SHA1 76fc7b47a329b759539bca0b785ad41c083c29be
SHA512 0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac
TLSH
T13AF02E5975DB81204345D3A43D28480AE4E8DCF363491E3A90C097F4BB65D7143F25BE
MD5 SHA1 SHA512 TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm64\7za
Size 1.1MB
SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
MD5 bbbf518e41f7ac044cbf5e25bfae8b2d
SHA1 5f1df07d814224931d0aef78d8b45ff89474ac78
SHA512 02c447db478013e8d4452be017222ccd261d6a818c28e210bfac8c4c2ed2caca16c0b8bc8290af5fdd61077de43fa36cb012007609279714051640dd276be1be
SSDEEP 12288:Zj4X5AliTSvnzjfTET2oplihyabHIEigotxcfR+DVAW9a55XdcOuFvPJ8k:Zj4X5A4Ovnzjq2oKybpUe33
TLSH
T15E352A4BF60C7C43E383E1BCEF89CEB1B62B75B9932680A07596419CD1D25A5CE72643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm\7za
Size 983KB
SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
MD5 601642dc448c3b398e92ec0d19e447a1
SHA1 114f88fca99d59eb7a1a180f0e3ece3f056f28c9
SHA512 e67cb183e4e7f8ee30d7ca8e3357573acf6c04fa31415862d75703a9536e1c46c2a340f4b6f8a06213a05d802d0cd8b044d1e84d51a4e39211896ba3d1f9fb5d
SSDEEP 12288:HgxgE4Zq83N97ECVgV+w1DIaEOXRq/vjwBgLI/z1o8JdX4O7eCBjj:HgCTNZD7+XR4rwH71tX4I
TLSH
T1CF25E4A6F5419B63C6C05A77FA4EC29E332317BDD2E9710599240B64BBCF59E0F3A102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\ia32\7za
Size 1.6MB
SHA256 8400fe1f78c7033ddf16f55b82c3a520a91c424a29d5163c45c6e085c5834373
MD5 dba8ad5c0f1a27e9e387817df9ceebbd
SHA1 33b7ae00c218a250c30588fa134dc9946665147b
SHA512 1276bff843177a0d4c6b6edbe4bcba26b88164853fd7a518d6adc114e1f87d01ce3efe3cb8f3e8a83355b3789b7f4da53231a0e994e0314b8e38fcee20e674e1
SSDEEP 24576:g94/Rty7JgYr+JA7Ick1PmkRYPjQxVL5I+vjgR5ONbwe+AqDAKcNJHn36kWQ:gK/RtB0vk0d4I+vkzw+LAPJHnV
TLSH
T159750953ED21891CD018227194EB273AFD24C6FBD06F53AA9684FD3ABD73642978874C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\7za
Size 1.4MB
SHA256 afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
MD5 6a2e4039a2f56265369f22ecb1a19fd5
SHA1 b0ea59484a4827d7d9a0a27a5270310ef07e61a8
SHA512 796188635271cbd7dbd6a7f37cb4d4d5b394c8a302dc62008c40b4be507382925eeb8a550ca11e81c791d5dbda238f95dedecbdd0daddf84907c4fa3a9b1ca59
SSDEEP 24576:Z3qW/EbABBtyz89OfxvH7WlwAMEd2rZXTN9H8lBFwEP:Z3zEbO3a7ucjN9HUwE
TLSH
T146657C43F9B6547DCE9AC775821E9232F678F44906309F37B284EB302A52E60DF69B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build.sh

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\build.sh
Size 266B
SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
MD5 08025b57ddf3df9bc3e2844d86e4135f
SHA1 becacdd4705fd90eb2a8f45775572ffa08629082
SHA512 914d2da94700e3c91974da71b16366dfc8972ad59ed64719c4eb7805a89ee3ed1b12712a292c9c73164cdb9f9df6f6cfa847eb123387ed499205d9157cdbe65f
TLSH
T1C6D02B11CC21C02159845E1B23B34714D16954F5C6E07BF998D1C87CD08A241CC3A9CF
MD5 SHA1 SHA512 TLSH

Submit Download

do-build.sh

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\do-build.sh
Size 646B
SHA256 4304f90e9b9266cccf357b212c6a8ea3b0816b68c39a4d4691d638c9e2f07286
MD5 2f48a9c98543108edadedcbf4d45b4ae
SHA1 a7b0bafdfb070e0cc6fdfa2977648b8d07593f5e
SHA512 cd17c759b1e7800260eb70befd37c273c78b34c44280290d60d406efe0a174cb34a727bc2cf42e8fb80bb65924ac405175bff69f34c115527ebc573a6a430b42
TLSH
T1D8F02380C864B031D5C8CE0373B69B28BC2658858FE8F95CDDA90CB8C104952B71ABCE
MD5 SHA1 SHA512 TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\arm64\7za
Size 965KB
SHA256 6f4dd78a82cf574f49118d99be620fd3edcfa9e48971d8523816b7ed20419c47
MD5 d8257aa0b1eb873e9ee8f89e97ed9b26
SHA1 0b3be717f56ad4ab2c1745da8be7a7833b47d3f6
SHA512 b850de0e1e85dae63ea4b857129ec1eb0bcb7eae3c2100a9fa600d2d5f4d9bc8daa0d07e148a2a57079e5496a68013c03725ac8dd3a39311e51660f27d29d1de
SSDEEP 12288:tfzSbxCCUWOQfK4okeJSdieTD76s88y2fFvNZSxrvOWwy5BpAGcKB:FSMCUWOQNYJde32ZkfFvN0x7ycAGcKB
TLSH
T1B5253901F91C6C22F2C6B1BE9E850FA5352BB57041B0C2DA7877525CEC96AE1983D7B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\x64\7za
Size 2.8MB
SHA256 434075f6ff5ea9250571033ca06b95d464efcad87a528dd0b224816c86b1a444
MD5 335361d7f6faf13cadbf116bfdb97226
SHA1 d6cba0f2e221d1061261767ec38ddd7c550015a3
SHA512 5fa86f6ec50e0f2fa87ec7cfa0e98cf2bfe158035e5af024e017cce4ddb33aea631008e43328e6049e0f95e8c63dac8b1e03d3c949b34ad2a3e94ab979cad0e0
SSDEEP 49152:VxV0AtX4EEf/Gf80I+qnyVUdbU1t4t1zCtmf3ybzh2uI1I+wwBV2Lg800h/E2zz8:Vf54EEf/Th0VEHf3yb5U0h/ELGCTZ5
TLSH
T1D0D59E17A6B0A568E082C07427CF97729670B9B62A29324F37C4E6293F7ACD1F715353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\package.json
Size 244B
SHA256 acabcd4f1c0b7399de4c213e8fdfd5d064f29e278f94bd5b763d8ac8555e2c18
MD5 2a3677c6c6bba9a148bc83c2f145d136
SHA1 1b828bd2e2b4eaaed8e68821692a0bf87bdd54db
SHA512 907651c11e31ce7c8242c825033e168c04a185e4717d6c28b1c77a48317ef662419c833300198fc6292721299905d7fe32069307bcc5751e3192e50c3c26209b
TLSH
T161D05E20C4180E7311D8D6981C52434617210C074D90BD0C37EB431C0B6D2FF06FA73E
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\arm64\7za.exe
Size 1.0MB
SHA256 a4159eae119f2d906d3f6d136d81d26d5d3afad2f2a91ed9b9fd1bee442a66a9
MD5 0cf5432ca393040f51c40efc426f34c2
SHA1 e6a8d2cbd8a289efb6cbba2a1498da22c29483d2
SHA512 3a3108aedcbe926f9ff4d3910bc8ab63c83a671498ee17031617d24ac8c3a3159b63186c43741adbb5498200d99289ca42b12ce7f268c59433183fbe79580d4d
SSDEEP 12288:6eJk5mmhxMpYcHwTR9rjJf19RVlGVYG4YQTukMef5vxW/gR5HD/V:vojYYcUlcY99AK18oR5j/V
TLSH
T106355B416E4CE891F1C6E2BC6DB78F61363775288A548287B127432CFCE2AD4CDB55E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\ia32\7za.exe
Size 783KB
SHA256 e4babf4e75140f0575d807e18329139af82f0d46bc6bc73ad0661e3b67d6cfde
MD5 b3455183081cbc28bc18c12cea3e6edb
SHA1 1ef1aae0b5e7c2687f45fc72a3f82228d0ce295e
SHA512 a99661d30c53f329fd1437c5ed53ad49b6e3c88c2af5ea41a9760bc111d1f7b4d056bb6d83f4e26df1ee5c2d914c432b2653ca73078310a0724cba61fa0169df
SSDEEP 24576:Jq79Al2Gp6BXGyja9hicoZ6ijJhyHiJT6u:sS2WUda9vy3dT3
TLSH
T145059E227AF5D0BBC24211328A0D7BF695F9E3190B3048C763908F6D6B359D5DA3AD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\x64\7za.exe
Size 1.2MB
SHA256 a92c1406a0fc0b1b8b52e8729ec99f8e12cb56e503c588a394c5a9fe490bf8fc
MD5 25cc27b31541cef2644af3e0940e6ceb
SHA1 fdfbc28eb9fa042f9cf7d198cbea68dbeb49e7cb
SHA512 ee772d88ef035299d7d99ed83f5e38d3b20ccd94fd866baa86a9f05e0cda932bf89ea2053efd7046f53890c5012ecd261fc27668c4fc3ed6960b0ce2aac10e20
SSDEEP 24576:kXWmPnP3K4fhiFvAEV0R9TzPeHLSoU1JaeX:kXWUny2hiFmR9erSoU1T
TLSH
T184452A56F6788375D073D0B9C5D2AB9AEE72308517308ACB1246876D3F17BE6863A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bsdiff.node

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lunarclient\bsdiff-node\build\Release\bsdiff.node
Size 270KB
SHA256 42ebb2d32a68398f3508ac15cfe1048f020cc63dfcc7b239ea1057367b31b736
MD5 6d67dc304cf8cf6a3e2abc5ad26e7805
SHA1 b7020fa96388b854b1b7a153bc5fa474d22a7bd3
SHA512 412ab3a46eccdef13844d09045c092882c075e38b4bc3210e6dc37a6010f31a58f96d135eaf053d9639f67afee31f256c9d972d980aa01e7f30ec5e45361ef9a
SSDEEP 3072:VGVkKfkWbK9KurlNsp4WOlYcplWD23b/PDppXZWpbywFLeE+8JOZjNky1Qjakw1Z:srW9KugYYiHbXDKbNfDMEjhw+
TLSH
T11A447D55B3E51DBEE167823D86670606E7F27C220720EAEF03A0867A7F13BE15539721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lunarclient\bsdiff-node\index.js
Size 838B
SHA256 30dd5a205be5f283602bc6f01770c16b9afc511facd06b5cb4a5fe36b671f6af
MD5 8ee9e6be7619cc2028c5262a97a72254
SHA1 b2f1fa18510bad8f5e3a8dce19e79f62bfd1d51c
SHA512 651266b5c9eb6d5da9dfb514b9ab9efd576c0c8254333e66bbc6f0ca4f99a6d9891447a8784b446dd37e0e7069e87952c0baa967ddda0f509770d653ec8a3e01
TLSH
T1DD01491958F7619A5637B5AD5B6FB90D70B5D0A3206CCA003C4DDB50BF734781359F48
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\@lunarclient\bsdiff-node\package.json
Size 1KB
SHA256 13b5fa32c2b04054014a96a3f7e7d57b37906333fe50bba8dff4290e526b89b4
MD5 ea99386891aba30bdc11554852789108
SHA1 5408ff500b6a317a8c369fbf6d2a5b6690de2dd5
SHA512 4d101a0ca7db8c14f8297e304658742a574a763f1503162322ae8dfc360f6fe8470a25c8298da73903dafb64d609d4fa56c545caf6f41a735a6f19fadee9c1a5
TLSH
T128219D37D8249D230ADC0564E9693053AA72599B4994FC0837DBD61CEB1D4BF21FDE38
MD5 SHA1 SHA512 TLSH

Submit Download

better_sqlite3.node

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
Size 1.8MB
SHA256 c9c931f06eaaef782952eb0ad6502a650c9e6c33e9caf8bec2e5847ec67aceef
MD5 4a982745373d098e5c71bbd6056bec9b
SHA1 c6c51012db8e070979ecff5c44cc5ba6434e3a46
SHA512 02e189a58c4a8b2702c81ebf548c79dcb4c95d63765d30423d85254ae5203a37d169210c2a9547c8b83795a80f0c49d381e8387c184a84a72a756df80c48f8c4
SSDEEP 24576:zszAAQz7diKFvRfYqeujF/NX2NmyB+8cpNdt38Kxut2AE4JqtBp04k6dW8vOoHLK:z8coujDXsSf738KQcWIBpTdHO
TLSH
T1C3958D4BE3B400BDC1A7C1B9851B560BE7B6B40517709BDB0690CA696F63FE217BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

database.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
Size 4KB
SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
MD5 952ebcfa3d8727e8b1d7b681c9f5bf32
SHA1 6168b5f5ed77669b3c6c1f1d526f0eb116bd3a43
SHA512 d2dc310d2e4a491903988ed88228d35e9688e48c9b6180c797fb58f84d1105724ab3933ade92be0e73c8a27fb6f3064449bfe00cfa1dc92919ad53a81af2680e
SSDEEP 48:+FzYIUZFeVxWy3h9zxIEXMOK0ZHQZ27euTqQaqE8E+LC7yIGrtRxtjFvcLd3s03M:ac1ZFjQBG1oQZi9qSvNRBkLveomRz
TLSH
T1EA818388DBF5611247EB30D4A674A48D6234D27971AD08E0D8CBC3F531E60C9BBE3B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
Size 110B
SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
MD5 26660b3078523a953ee252b4e86e1c8b
SHA1 f7c22bdc8183f6a9cb73a9b4a735a5bab7ca01b4
SHA512 d4f32ba712ff15e8b6a1634eee089057a4716318b90e932b95a1c1cd30945ba708e7e725316fc824107637d2e97a2a64193ae81c0a3d2484651f52122bace99f
TLSH
T16EB012CF1BF0B18F26A44184E9618493D8C2E466841A40208F05CFFFA484CC42FE2DE1
MD5 SHA1 SHA512 TLSH

Submit Download

aggregate.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
Size 1KB
SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
MD5 25fdd950809b2b22d0ba6917fe014c35
SHA1 5555b3223918668b5bf244e892b1d6a258f0099a
SHA512 50516a2d2265513dd7ee727cf9cf21d118601a0ee2b9de61111c6f5fd8933915f3029ef6f764f7803cf5438725c6017002d7f58cc36988d97cc1bdb805dd42c1
TLSH
T142412121E2D2221605DB24E07097F909EA7ED720B54DB4F0C92EA7E910D1DCDE9E7A80
MD5 SHA1 SHA512 TLSH

Submit Download

backup.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
Size 2KB
SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
MD5 69638dc10c19961a0c05350ae333d6a4
SHA1 5941988b67c6fa083358002ba36538f1e39ad03b
SHA512 495ecffdadbc8c9bb2e886f9f7a93668fa5b2192a0ba79a7e1a9d3c2640e0520e39f2d2c6f3a26b55c72ff882bff43ed6439c0ad7c7622461e6ccaf1ee8f119a
TLSH
T171413158F39E5169436734C04490E00EE93DD6B6313E09F1AC8953F022C66CDE9DBBC5
MD5 SHA1 SHA512 TLSH

Submit Download

function.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
Size 1KB
SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
MD5 1036ce624efbb9fbbb387fec25fd1bcb
SHA1 35395f7ef4c18b845582b9289bc802d87c9e3c11
SHA512 7d65a4bc5bf5c9b97dce021cdb8c888cf975ad24613b12b239db1e03a98dda89faf7b1b204c906f6dde5439d22414d9b4410554d01eea8fc121287ed8821f9a0
TLSH
T1E021C911F2A6214246DB24E0B0ABF909E97AD765B44C74F0C58B97FC40A1DCED8E3A81
MD5 SHA1 SHA512 TLSH

Submit Download

inspect.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
Size 174B
SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
MD5 21784edff107eaec0e9ef7e66e83552b
SHA1 6b59caa4cc8a568a8ed3f184a075d66c68f17d08
SHA512 9bf6d36dbc01dbad11d5d01c0b662620bf6c0cebd85c0065882e8ec57e3304bc4d301add25bf57ea425a270f3ace6a44fcb958dcc8bf993f411eb81a5369adfa
TLSH
T125C0800973F1B465554F30D5955FD00451E5F0242CC450420D1DC684CD708697F3790F
MD5 SHA1 SHA512 TLSH

Submit Download

pragma.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
Size 536B
SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
MD5 9354074a096ee1cf58905ca8dabfd60c
SHA1 63e6c02339c45c252ae3bb24267610a636117eb6
SHA512 32bdf8866d1c4e3db8a2ca65df2c1bd0d33c064d4cc526e264587cbf9c09ba7b97c8adc430a9dc019d9863e0e90b4318442ffb5cd08e0de52cdd4f081b5150b5
TLSH
T155F0C91602F245530BFF14C094E5F534F4B7C668B50E94F0D99E83FE41808DAEA83E95
MD5 SHA1 SHA512 TLSH

Submit Download

serialize.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
Size 625B
SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
MD5 41cfeffe67a2975f68aeeaaed0bf384c
SHA1 321f3f817bc095c34b76d060d706ed2cc48f204d
SHA512 8a0ad9732b5a07866eee742b2e884e521111f213af9ae39ebd92fa029d88f087c43f8826672d1fac5c571d14b284f20ae25e12aa4058a7881d6fd5e93c0b0a0c
TLSH
T1F5F0783A3365564B0997A0C050E1B429E9B5D324312D68A0E989C3F511D48CEEAF7B9F
MD5 SHA1 SHA512 TLSH

Submit Download

table.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
Size 6KB
SHA256 97c42d9ded1aa96c7d916b5b92f96b4e59581d50eaf629cd2c7afb78ff26a9ea
MD5 43137a36158617045d106a2ff534edaa
SHA1 f365ee98f7e36d1bab09e58187d467dd5f73b6f3
SHA512 f4330d881ae76d41083d3ba9d0056697abd634638a9951a4ebe4044fb79eceff4da034d22d9ba2ad4cd1a208fb0ec1c47855da781d9c9dabc34979f6f7f9eff3
SSDEEP 96:bJx7JBAUU6VtWpzwukGy2K3rN6gYMNEXxulo+yrgrm+IttSXFJ:bJx7J25PUyKb0+UklovOQk1J
TLSH
T18BE12308A7E17A13404B7095BC58605EEDBC98B27C1C48F5B8DC45E92491CBEF9EAF26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

transaction.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
Size 2KB
SHA256 bc8624a3ef689d8f78e5669020ad121e17acbc93b1d5ee5afe26860b1084c66c
MD5 6b77badde74e5a5b854041134e62041d
SHA1 47f5883e26f1aedb2bc1557cef9dd21c26e0e0ef
SHA512 d5be3aed74a9c9a948afbf6f03c19e21ec6d5a86f5f277de85d9d7374136fab4cf68bca1a6e752e5d41ba6b48c00577ca26ebacabd5bec51491da28affb3719d
TLSH
T1EB514312F67ADE7063E23088FA0B630EF5299A49E03494B0E760EB4A3A958CD8117D53
MD5 SHA1 SHA512 TLSH

Submit Download

wrappers.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
Size 1KB
SHA256 a150a6271d23f4e5f8953b129f370ff096c7cdc4b812afbf080a6cf4ab741bcf
MD5 9e2ba6058f66127065c27ea3e81b8e68
SHA1 92346423dab9536ca4afa50e7ef171843d5eba5d
SHA512 2b6644404fea27117b74f904bc608fa42e36e3b100f51010394ef917df7c48f40af018e5b06243d31d7ccba5ab05cb32541566e79775df482e09a107524d091d
TLSH
T187213A8A72E6F162D31530309DCFD184FCF9B861694C64BCE47497922DE007942DEDB8
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite-error.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
Size 717B
SHA256 2582d61c27680dead168543f392eb102be621dfbef282a4ca4c7c21aa5e7c75d
MD5 e1372372ca8f94dd66666d886a81f9b5
SHA1 437034e71dedf15013967b540db157cbe3eac3ef
SHA512 5bbfce635aa1b10b30f1703eded4256224500705e3b14c7cefcd522ad703596d15d6cfee7914dd70700827afd01a50d61bef1954d29b8788bf6347f96e9cd8d4
TLSH
T1660168C69F7099BB01E15884FC116806996C5678C021B5E4B6C8DD9F2DF0087CDA56A0
MD5 SHA1 SHA512 TLSH

Submit Download

util.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
Size 331B
SHA256 92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f
MD5 a5d75fb36bedb4938a8b9dc6525fd515
SHA1 b5270aef455a7de04d31d19713ed7dfceb55fa06
SHA512 c181b25f5b991826159125a4f7af8ec0f8a7bbceba674121f144f401295670136daa64598d4e0f48cb8ea2849000ac8e7f59881220f6a30a4905ce9309db8067
TLSH
T1E6E0261BDAD2876511AB30862E8EE404DE6CD2A6746854F0682AB64970C84B4EA8B25A
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
Size 945B
SHA256 35f5841195912569932e7816ca09d03f6567a9c37a6668d4fdd450314d46e24b
MD5 1c385b7e6e66a16946f1c031c3b9fd46
SHA1 7d3eaae39c73e9d37c913de6da3a9b3593a41b51
SHA512 b69406457e1f218a93458f6c521cadc9e81eb179165e1287509688a157dcd770dd2d507efcad8d708168cce687e3a0035391e1087df1f932cd83d91a990d7a43
TLSH
T1BA113AA0CE258DB32AC569D5ACB91182B22048078CA5FC4C3387466D5F4E4BF21BD57E
MD5 SHA1 SHA512 TLSH

Submit Download

diskusage.node

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\diskusage\build\Release\diskusage.node
Size 175KB
SHA256 4eab3dfba427744808a3d91f6c613a139307d872965b777e5cb2e5cf39713135
MD5 7ea471202e211da7d1fa64035dc57f94
SHA1 8fa48d15972334715aee0d025009a136e479263c
SHA512 02a6eb0d902aa4a588ffc235a2d9dac8519cad4a45ee8c4599d44db8b9cd2bf67db51df90af2bf44e9c7bd263800af84dd61b007d47b661bb145ddc963479770
SSDEEP 3072:xF894Y9xuyLHZGfOjZd4DtAQ5Tbb3y4/WiA7RV8dO134Tk/c:xF8x2y1GWrsHV/WeYITc
TLSH
T105046D19F3A940BBE977827CC9930606EB7278154360ABDF036047796F2B7D4993E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fallback.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\diskusage\fallback.js
Size 677B
SHA256 ba34dfcda1ececcfad1c14331b97391f37e875fca932167fd931ed380a74081a
MD5 3f41fd929c3dbb89d2bf04908b3ea24a
SHA1 50a36f15a0764a59d39c692277d04ad135c25c04
SHA512 0e2b61f7894a09b9ddff1f339f881bada3add03195380a034afaa803f8c6a4f53c500989c4e9ae135c960bc0e38da52da48798324c86132392511852c37817c8
TLSH
T1850147DB0C93361A29B5F3B2260F010AF616C4A3072C5BA1F5E943611E66044638FCD8
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\diskusage\index.js
Size 1KB
SHA256 c87aa357fc676205fa60a6c0215738b0a261f7f7b1fb1f836231de38ef2d2abf
MD5 77f8f61dd5589fcf93daa5f368e6ff3d
SHA1 335ddc23af257b7a840974e3f9b2acf4c8564843
SHA512 dfaa44bc8ed7102deed3244075b450fab2fdddb5642d6acefd65b496e672e2a47ece7103ac5bf6e4bfaed05d490427f4ed5a2f7cf646c6fe8d249c4cf4942aad
TLSH
T12021D2CB0C433155B8B6B376991B823AEB19A553021C5260F9ECA2711F3D0687A9FEDD
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\diskusage\package.json
Size 563B
SHA256 f9231a5612e4555ae06d957da5e9cf0e770ed127696222c26418ae43d7c86bb2
MD5 5e611b5d6caa104ca70784673162d400
SHA1 c1bed49f3c94323ed62dc38231f14f73da310b17
SHA512 fe1a64fc67c42d463f0b744ad7808862d6047fce33326e97024b905fab70de83da8175106e108ba7b6227cc585df0c3f7581bebedab838a2dfa18652141c7093
TLSH
T120F08B15C8A4583726E423D4F865694272220D1B8805BD0CA7D7B81882AD59F16FF27C
MD5 SHA1 SHA512 TLSH

Submit Download

iselevated.node

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\native-is-elevated\build\Release\iselevated.node
Size 107KB
SHA256 999708c215a00ea0191f33e26004804c2a052b61f113abe1f0a742a78349ca0e
MD5 99ddc6dc50a07984e1cde5618bb3901b
SHA1 89760b25a45da74c0d252bdbda40e94db58b523b
SHA512 9784c99ab23cfe8f2b8f240ff104975f5e073decb771ec5c974aabffc5183ecd11d091830b0e5944630e6dc7b8689a1b7cc47f017071ec1f47fed5bc190d79bb
SSDEEP 3072:fUW8Q0zrSYpjmct3iMVVtYrXTGWwd517565aw6nTr3m1o/Y:70nb53iMVv4o/
TLSH
T1C6B3495777EA40BBE173867884A30A05D772B8111761AFEF03A4466A1F233D19E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\native-is-elevated\index.js
Size 735B
SHA256 3655a556f41f58661df14658ffea4291967b3cc14852c53ac43e2661a0d2c91f
MD5 10cc0243be1232c4073b53a78c6927fc
SHA1 2d64f19e51c8ae3db1aa20090b81c5914f3e318e
SHA512 7a5ab555fe16fbb00a37abca4fc1d0859a553ff3bf7f80e94cde926ffbc08761041799d3690fa62adc7a26e74d7b8accddd9cb5170c9f4c9d36eeac79978a2ca
TLSH
T1410128EE3EF7702D911920A65D4F4223B178D903051D9EA4F4884354FFC0A648EF8E9E
MD5 SHA1 SHA512 TLSH

Submit Download

mise.toml

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\native-is-elevated\mise.toml
Size 20B
SHA256 f4e76711ff120302d3b0e45d941b8e2413f5be3604a6868a6e997edb36968251
MD5 5995a33a46693434f2a40fbc7d97c8df
SHA1 d592f1894a865c71d18193a3f6be6e5e3425017f
SHA512 4c5a20e7d33115729ab229ea6dc3b9182b8b8db5ea2982f0f7aedcc60583249d4dcf6098e11425e6aaac65486cbd76dbdd8f10cf54b48c60f8732b4abe663595
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\app.asar.unpacked\node_modules\native-is-elevated\package.json
Size 461B
SHA256 efd87e2e50b7d7a4ff0558245b9892b8c5568832cabd973b0a4760f757f3bf27
MD5 a040e097bf37ac3ca7bfc576630571f3
SHA1 7d57f7c29d23f5ab24af1ff5dfddb400a3bde775
SHA512 037e4171d35edd2362eb6f98e46b0de49d2c8eeaeb4c2b7cc7bc18290cb63fea15bcc24c82c908342487397ca7ed2ec9e2c0b9e60e219114ca3b414a7550ea79
TLSH
T187F05C31C2642DA39EC802C1ECB81A82B6571C4B9644AC2907D3416CA68D57717FD1AE
MD5 SHA1 SHA512 TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\resources\elevate.exe
Size 114KB
SHA256 2807963a3e0702a8beae5fc82a8bff3bfb8a5ec478ee3a7489aaf71e0b4cf0a6
MD5 51ea0eb73d0f91cf70d10980d31eac17
SHA1 5012b34a905203991a48934ca32c2217e1b83549
SHA512 f7681635eb7dcfe00b4e19cbaab2bd791c19dd8302745246370593e1fd2af8aa3cebb37fa512f5f9cd43ad0275692be6a3a64805a5e87620ae6546eb9ab62762
SSDEEP 3072:grbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlYdTA:iPrwRhte1XsE1lYd0
TLSH
T171B37D1274C0C471E5731A3555B4CA718EADFD710E759EAB6398027A4FA02C0AB3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\snapshot_blob.bin
Size 394KB
SHA256 eb484904e06c217beaafd2cd6847eb909225a5f0a4bf814cb1ec22653e6bd2e3
MD5 2475efe9ad373a9ffd0da6ff9853a9c9
SHA1 c63fdceef60f3409013df2af2802e681c71d982e
SHA512 9a5fc21e93df7df65ed051eed9c522b42dc5e11b58f5b370b7d699d4be1de8709e8a066e5ec6bfcafa2ebe069981bc5c3a1fb41b5874cce6c80c216600de98df
SSDEEP 3072:XU6QtROt+xeRvISYOoxs+Yi9qSkvpqE+IE3qfJjtN:X7t+OcTCvpDjz
TLSH
T13584A909B349CF36CE083A756CE887896526B18D6D96F31B7519772F38B35740E32A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\v8_context_snapshot.bin
Size 758KB
SHA256 1fa1cdd08423809344fe15fac2d9d1ec604cc3ea5af4b944d89a51b1e98c8665
MD5 00f69a4fa2169454a5601261a9c7245f
SHA1 b6d3d33b615fe050b7b2d009695a2a6e4e7c12a6
SHA512 abe8e379e1842d00c71a7c9cae3bd4d3a1d6ab4679f8c6d850dfee3f91affa23cbb4e0b35c035bf2832adb5f0cf5a8fe4fb21a7a377babf190fd6f11ce67e4c8
SSDEEP 6144:tU0ckYOkGt+OcqCvpWoNyuZaVaBgJjdOSkvh8mQu/INZV/peyWBOI:y1RNvMoNyerT8mQuANZhcOI
TLSH
T10EF48565F74ECF2ACA4537B86DE547463835B04A6F8BD21BB518233E38B65B00E3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\vk_swiftshader.dll
Size 5.4MB
SHA256 2cf42438adf1163e833485a103c517b6f96c9cc115f28ddb95bcc6c937125be4
MD5 5b1d6e0ba3ec6f0b50e7ea9a611f1560
SHA1 29b636882476cd6e4f5df8fdae686db30dcafee4
SHA512 143fbccfae72598543db830cb3b8e89f9e0b1870dabca2ade11ec33d9dac2ef791b28d9d7b2a95eb0470f3e4df7a510f710ed449e7288f8385060baeb8ac0e32
SSDEEP 49152:tf8J6ogB5C2csJiy2fY+sY2IKZ/s+OUvKW8yhj5PGhekCciy43Jvlj38HxiL2cW+:18U5C2csJijqwuHEr17D8cRX8
TLSH
T18D462703F28681D9F06DE679875BA623F631F8844B2276DF16A01F192E67FE06739710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\7z-out\vulkan-1.dll
Size 922KB
SHA256 0009f8702059507105cf6fd43cb9bfe1e5d4f6d61803ddb142031ccf0806f2f3
MD5 21ba5de80a3cb5d26dcf9e7461642c97
SHA1 5640baaf29dcef79995226e106d08591c35c000b
SHA512 c5ccc160cfaffb1cb81968cb0bfb79ecc6f7388f80ef9f577cef1073fa557181e8ec5ae8f172d85e05f5a53c9cee6fc1c4cfb22d7e88ef22fe303a4f1d0fe540
SSDEEP 24576:8GVzDeAVM7N/L0H6tDVj3sF6Z5WGc4DYsHQDy6g3P0zAk79oOHAF:8GlDeAq7N/L0H6FVLsF6Z5WGc4DYsHQ6
TLSH
T1F4156D23965485A9D47AD034D9D28707C9B174822326B9CF42A81708BF6FFF47B3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr1EF4.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ow-electron-setup.exe

Path C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-jilehohlakeokncafogkgnicgndeecdiengddbcc\ow-electron-setup.exe
Size 979KB
SHA256 a5d18162f66e93a20866f99b3ece350af2409a814e9f085b0231a80035730371
MD5 9d4c45ffff64ec181f22dab5429b1e3c
SHA1 c4b1e8527491781d83bbb2de77e75260f644a81f
SHA512 7ea0e46b55894d45a4577756323cf9d625e1fbc66e43bc3266a7fbeefe72d7425cfcb891a3c26ecf0277c61ad31204ea28a071a37ad3a58c64409c53a021e6f4
SSDEEP 24576:AhrArflvPMDhobsfLsoSDu173pG1szLSvJwhw/Shau0170GyH:3rtvUDhG9oSK73pfqvChw/YaZ703
TLSH
T1F7252301A945D423F5227B7563B89BAF5D75780B02B5C6033FCAB29D3DF27A29D1E202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallerTrace_2026-09-30_15-56_4452.log

Path C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2026-09-30_15-56_4452.log
Size 1KB
SHA256 af1e828fabf2fb8608992c72a8c74285c454ced1f674b1bb5c93ccc52a00dbfe
MD5 5252d17f06b89c94f7be58ea8a57e3c9
SHA1 ad9b84ced6af7da026c95523a761a0d08cfef8eb
SHA512 18145c99acd6089a1aa7c61ccb676a35a3f56a52898c726624de1f9bcd4cd98c4d67f30bcdaa7484f4169afa7422cbf3e384cc7e6b4a4c9e495a4662844c851e
TLSH
T13031FE169343B9FD091E061BF238D91C4523EA04FA5B6090D5E566ABC613239CBACE55
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerTrace_2026-09-30_15-56_4452.log

Path C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2026-09-30_15-56_4452.log
Size 4KB
SHA256 c41f3fdbc68b16f1699bc5d5c14209fee6e39c005782743ddd29a3124bbfb51a
MD5 110f315fed13cb8e3601038cd1ae9317
SHA1 9ce7c8414c8f40530039d7348029eb315cd6d14e
SHA512 1bec9f95c20c17b89a115a24826bc5ec809fd82a45ed9065eda51d9275dab6f0e38fc12edb85a0ea23133d0703fa679e601dcb77f5855827bd1339f0ea3740c1
SSDEEP 96:t8s1h6f594mE1pLpVXZj+Tj+Oj+lE3j+DsXzHj+Ds/j+DsGj+D7xrB+j+Ds+:qChy9YDJwZnJj1Ig+c
TLSH
T114913303632318FD590F420FE229CA2C45737A01FB4FB1A4E5E626DB472752DDAEDA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Roaming\lunarclient\Cache\Cache_Data\f_000002
Size 34KB
SHA256 5863d6336956513f5c427716f0133d08136c8c11851c4e759327a268cfabbcce
MD5 6b9382ca0f09a80b5bde8f94141a7c8d
SHA1 270586de595c511a8a7061f5ee8f23cfe0ca7458
SHA512 98ab58abbf821cea66ddd47ae12c0d6830953a3b9fb8ff7a84f02a59f51bc7504566e84a2737e72d8db191a15a737e000279e2e689d0ac147b9e018fec350725
SSDEEP 768:86IGfSiaZU98l7P0LBCe49ic3fuwCuxTpUofTNF+pjy:86ZfLauYxxnfTuy
TLSH
T195F2F113639DA03BD9C7DC6E64DC2FBF06DA211B49AC3C873F0068BEA59A8455672258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Roaming\lunarclient\Cache\Cache_Data\f_000003
Size 105KB
SHA256 79368a04eebf6385b27362beecc45cefd44236d0da467dda9d5adf28e2ae4b78
MD5 dfe5ba8342c842a9ebd33a85ef565d3e
SHA1 87120b6407e45dd80ba87e879ad47693aefa7633
SHA512 7f8a5c61ebf234a09ac95011bfcfa47c10be96db0b3bb04e55feedd2e3246c056211f61e691b9eac0bd837c4e2847aa08440505ffccf62f16c13d12f42711c70
SSDEEP 1536:0XklwnU7imNt0I9cpS1kC49mtoA3e+xO8Utv7LL0wZi5X2visI5qguqM:WklYUGmT9cpS194kklvXwkeX2M5nuqM
TLSH
T1D6B31270B946D1AE537267B41EE7BCF17FB4AADA839F03A1578C60AD35C52868E8100D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\lunarclient\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Roaming\lunarclient\sentry\scope_v3.json
Size 33KB
SHA256 72a76bb8d73e6ec3d18c20bb20a710679b2c266b5fb26ac8231e5ffb93d87d98
MD5 909492eacfe2991693bc3c339a5cdc1a
SHA1 c4bce470ffade144da2580341cf0e5c0ef4d137e
SHA512 20b6b71b69a3c64649067a6bf53633ca8bae53ffcb4b36150679f39a4e7c2ea9803f79c77af213c05a17287cd4b3b6ce5df7d409a3980860e562b714a3e043d1
SSDEEP 384:4aWXT+d8HYYsX1NPf3Xhi1Z/UUAz0R77G5D5agEx2xGutjuZYi9QH7rCfPmM4n6s:4aWXTSvXdhuZa
TLSH
T1A8F253107078AC3C1FF14A79E4892F99B3345E63E461F4B458F4E504B8AF9DD206B9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owpm.log

Path C:\Users\Admin\AppData\Roaming\ow-electron\jilehohlakeokncafogkgnicgndeecdiengddbcc\logs\owpm.log
Size 5KB
SHA256 29ea962fa2e6bd19210ea1f8b19abc7db6a5bd83401a254eb1105d1578cea8fa
MD5 9af67e08209512b81da56bfe4ed1e8a3
SHA1 05e12f8c25b345d477903d3ac2c8f5aa978dec53
SHA512 7f69bf47abf4fbf568c5aa21a1f5a664a0c020a8fe42f1b5cf653cb42e4e74f83c99042f257432edda4507dbfe5da9c16ace9b1318b1739ea437f53c54e98ea5
SSDEEP 96:K6/wpTE8alANdSbsSbsSHoSHlThEEX4nSw34sSw34sSEhSEdEEbx4xxdj:P/wpCFjBThEnx4M4OEEbx4Zj
TLSH
T1A3B19B60BF64A255871D8CD390254A0F87BF7B72BA087E503734668D8A157ACDDBE08B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emifmpeaagaaglhaimndbhcpkjfmjhfnjjpoibdo.owepk

Path C:\Users\Admin\AppData\Roaming\ow-electron\jilehohlakeokncafogkgnicgndeecdiengddbcc\packages\emifmpeaagaaglhaimndbhcpkjfmjhfnjjpoibdo.owepk
Size 6.0MB
SHA256 7a15962baff7f5cb3ec77bb8d3b642f266734c47c9721af4dc1160db35147b37
MD5 3a3035832f222172bc3cb6a7c36d7912
SHA1 23b6009ca398c39638f84c9e169ba223fe627982
SHA512 40feffbcaf0b85e3bfaa694cd9a0fb9163ead98d9fb595c2ed402bf080d7ec8c618b183df45c9f1c5f35c8c5207a321f7fc5f293f2ad1128dd5fbb51e11855cd
SSDEEP 98304:Qy+vK7+UvJE6j8M2pJCNw/dBhg9D6ZryjJNgLilb2Q2NiLPVd7mVMzJC8srswKnw:/+XFnf679D1jJNIigiLtdCM9jMv
TLSH
T16A5633E2759CD57B6B93C2BBFC2EC414F6BE429EAB50219A5D2257F825DC8810BF44C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbakpbpolagjcgkhmnjmaeieneioknidnfjiejnf.owepk

Path C:\Users\Admin\AppData\Roaming\ow-electron\jilehohlakeokncafogkgnicgndeecdiengddbcc\packages\fbakpbpolagjcgkhmnjmaeieneioknidnfjiejnf.owepk
Size 114KB
SHA256 fce368156df13175c4c134004d6e774f82cfeae09a0defae8086c3f09b3d6909
MD5 d74adc9283db91fbcca880336376e540
SHA1 32c7359f3a9b51863e1c4c28efc43c7b4310ea08
SHA512 f3cbd28e5c5b069114beb136d0975534474a5c17ebe874b1027a69cd1b831bcd393a13d9f4b2f04842c1ca7d0a5f02fe617101d31f67899a722871e8421838c6
SSDEEP 3072:SOZEdK8ZxRruVNxsmVmX0bOQK3Ldm+nDUGXekfTwNR+:SvdKcKPxsmVmkaQuDUEw+
TLSH
T14CB3133610A1F4C0CEEDEDFA989DBF84E34EEC6678D913127CD54CC19A910AC162E097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jopghajpapbfooofklncedoalpgiaglgjaokpkon.owepk

Path C:\Users\Admin\AppData\Roaming\ow-electron\jilehohlakeokncafogkgnicgndeecdiengddbcc\packages\jopghajpapbfooofklncedoalpgiaglgjaokpkon.owepk
Size 1.9MB
SHA256 6847a6e3de3fc9a0d68ded7b5d8c3a5484ab53b5ce18373e8bbdee151ec7f82f
MD5 8cb5319e4183aa3f4f7b2e12e1cb9d27
SHA1 ecb612dd968847285fa586581d911b72c586b531
SHA512 4d75ae736f7b4c8568b3225f853a5451d09685d1f8d2a27469568a04fa4383b6aa89cdb05ef1f921d28699b1ec0afc5bd58c800bada34709e0f0a8e86e0cb5fd
SSDEEP 49152:/LgQnqIIxXUwZuLDzkIzUci+7Bl0QXwc0CuBBc0WesL+:/suquLDzyf+wc0RBBc0Wpa
TLSH
T1E49533C438B04A235B17F69878FE498381AEF8BEFAD2C33B0DC35706F91A6971525645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ow-electron-utility-plugin.node

Path C:\Users\Admin\AppData\Roaming\ow-electron\jilehohlakeokncafogkgnicgndeecdiengddbcc\packages\jopghajpapbfooofklncedoalpgiaglgjaokpkon\2.9.4\ow-electron-utility-plugin.node
Size 714KB
SHA256 c2df504a42c2a775876b93a73d43a34e874041d6aa80d4399406a11a976bfbb2
MD5 11a59b1518920bf2e6d409e803f043c4
SHA1 7d9d0bc4a7132c861eb2ac04abea42b0ced2b2d6
SHA512 aef776160e49c20841ddb88402acbd478509a789e899b9fd769bce1d241b31df55d3130ad115c144d07eca0605d50e9c294d69a156a182f298fefb98a50af3cc
SSDEEP 12288:qjVWom4AdHVVMRe1UWzqJph0lhSMXl+Zf:qjwodA1Vh15q7h0lhSMXlef
TLSH
T17BF4AE16B7A401BCE0ABC139C9974A12F772785207A1BBCF03944AA65F2B7E45E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-5974-0x00000220DA6A0000-0x00000220DA6C4000-memory.dmp

Download

memory/1084-5973-0x00000220DA6A0000-0x00000220DA6CA000-memory.dmp

Download

memory/1268-323-0x00007FF8456E0000-0x00007FF8456E1000-memory.dmp

Download

memory/1688-5856-0x0000024A79030000-0x0000024A79031000-memory.dmp

Download

memory/1688-5858-0x0000024A79030000-0x0000024A79031000-memory.dmp

Download

memory/1688-5857-0x0000024A79030000-0x0000024A79031000-memory.dmp

Download

memory/1688-5861-0x0000024A79030000-0x0000024A79031000-memory.dmp

Download

memory/1688-5860-0x0000024A79030000-0x0000024A79031000-memory.dmp

Download

memory/1688-5859-0x0000024A79030000-0x0000024A79031000-memory.dmp

Download

memory/1864-708-0x0000000070DE0000-0x0000000071134000-memory.dmp

Download

memory/1864-700-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/1904-288-0x00007FF845170000-0x00007FF845171000-memory.dmp

Download

memory/1904-287-0x00007FF845070000-0x00007FF845071000-memory.dmp

Download

memory/2144-614-0x0000000005620000-0x0000000005686000-memory.dmp

Download

memory/2144-663-0x0000000007060000-0x000000000707A000-memory.dmp

Download

memory/2144-612-0x0000000004E80000-0x00000000054A8000-memory.dmp

Download

memory/2144-652-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/2144-611-0x0000000004770000-0x00000000047A6000-memory.dmp

Download

memory/2144-613-0x0000000004E50000-0x0000000004E72000-memory.dmp

Download

memory/2144-651-0x0000000006CC0000-0x0000000006CF2000-memory.dmp

Download

memory/2144-661-0x0000000006F10000-0x0000000006FB3000-memory.dmp

Download

memory/2144-660-0x00000000062F0000-0x000000000630E000-memory.dmp

Download

memory/2144-666-0x0000000007280000-0x00000000072A4000-memory.dmp

Download

memory/2144-662-0x00000000076B0000-0x0000000007D2A000-memory.dmp

Download

memory/2144-664-0x00000000070D0000-0x00000000070DA000-memory.dmp

Download

memory/2144-665-0x0000000007250000-0x000000000727A000-memory.dmp

Download

memory/2144-625-0x0000000005D20000-0x0000000005D6C000-memory.dmp

Download

memory/2144-624-0x0000000005D00000-0x0000000005D1E000-memory.dmp

Download

memory/2144-623-0x0000000005710000-0x0000000005A64000-memory.dmp

Download

memory/2144-615-0x0000000005690000-0x00000000056F6000-memory.dmp

Download

memory/2144-667-0x0000000070DE0000-0x0000000071134000-memory.dmp

Download

memory/3024-1069-0x00000238D4F30000-0x00000238D4F31000-memory.dmp

Download

memory/3024-1068-0x00000238D4F30000-0x00000238D4F31000-memory.dmp

Download

memory/3024-1077-0x00000238D4F30000-0x00000238D4F31000-memory.dmp

Download

memory/3024-1076-0x00000238D4F30000-0x00000238D4F31000-memory.dmp

Download

memory/3024-1075-0x00000238D4F30000-0x00000238D4F31000-memory.dmp

Download

memory/3024-1078-0x00000238D4F30000-0x00000238D4F31000-memory.dmp

Download

memory/3024-1074-0x00000238D4F30000-0x00000238D4F31000-memory.dmp

Download

memory/3024-1073-0x00000238D4F30000-0x00000238D4F31000-memory.dmp

Download

memory/3024-1067-0x00000238D4F30000-0x00000238D4F31000-memory.dmp

Download

memory/3892-680-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/3892-689-0x0000000006FB0000-0x0000000006FC1000-memory.dmp

Download

memory/3892-688-0x0000000007080000-0x0000000007116000-memory.dmp

Download

memory/3960-5829-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5823-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5814-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5810-0x000001A9C8060000-0x000001A9C8061000-memory.dmp

Download

memory/3960-5811-0x000001A9C8060000-0x000001A9C8061000-memory.dmp

Download

memory/3960-5812-0x000001A9C8060000-0x000001A9C8061000-memory.dmp

Download

memory/3960-5818-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5819-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5820-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5821-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5822-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5828-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5824-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5825-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5826-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5827-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5830-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5816-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5815-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/3960-5831-0x000001A9C88E0000-0x000001A9C88E2000-memory.dmp

Download

memory/4344-222-0x00007FF8456E0000-0x00007FF8456E1000-memory.dmp

Download

memory/4348-412-0x0000018C1E0D0000-0x0000018C1E0D1000-memory.dmp

Download

memory/4348-414-0x0000018C1E0D0000-0x0000018C1E0D1000-memory.dmp

Download

memory/4348-424-0x0000018C1E0D0000-0x0000018C1E0D1000-memory.dmp

Download

memory/4348-430-0x0000018C1E0D0000-0x0000018C1E0D1000-memory.dmp

Download

memory/4348-429-0x0000018C1E0D0000-0x0000018C1E0D1000-memory.dmp

Download

memory/4348-428-0x0000018C1E0D0000-0x0000018C1E0D1000-memory.dmp

Download

memory/4348-427-0x0000018C1E0D0000-0x0000018C1E0D1000-memory.dmp

Download

memory/4348-426-0x0000018C1E0D0000-0x0000018C1E0D1000-memory.dmp

Download

memory/4348-413-0x0000018C1E0D0000-0x0000018C1E0D1000-memory.dmp

Download

memory/4348-425-0x0000018C1E0D0000-0x0000018C1E0D1000-memory.dmp

Download

memory/4452-186-0x00000221A34D0000-0x00000221A3560000-memory.dmp

Download

memory/4452-150-0x00000221A15A0000-0x00000221A15E6000-memory.dmp

Download

memory/4452-190-0x00000221A1990000-0x00000221A19B2000-memory.dmp

Download

memory/4452-192-0x0000022187520000-0x0000022187530000-memory.dmp

Download

memory/4452-475-0x0000022187520000-0x0000022187530000-memory.dmp

Download

memory/4452-463-0x0000022187520000-0x0000022187530000-memory.dmp

Download

memory/4452-140-0x0000022187120000-0x0000022187176000-memory.dmp

Download

memory/4452-144-0x00000221A1610000-0x00000221A16BC000-memory.dmp

Download

memory/4452-166-0x00000221A1A00000-0x00000221A1AB0000-memory.dmp

Download

memory/4452-146-0x0000022187540000-0x0000022187554000-memory.dmp

Download

memory/4452-147-0x00000221A1CF0000-0x00000221A2218000-memory.dmp

Download

memory/4452-148-0x0000022187520000-0x0000022187530000-memory.dmp

Download

memory/4452-194-0x00000221A19F0000-0x00000221A19FE000-memory.dmp

Download

memory/4452-161-0x00000221A1570000-0x00000221A1588000-memory.dmp

Download

memory/11596-5735-0x000001C7A50B0000-0x000001C7A515C000-memory.dmp

Download

memory/11596-5657-0x00007FF845170000-0x00007FF845171000-memory.dmp

Download

memory/11596-5656-0x00007FF844EF0000-0x00007FF844EF1000-memory.dmp

Download