97f380089fcc806678709e7f16d415b2c766cc83c47b3285d56131c39f8756e9

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZedLauncher-Install.exe
Size 111KB
Sample261018-146hpabs41
SHA256 97f380089fcc806678709e7f16d415b2c766cc83c47b3285d56131c39f8756e9
MD5 fee1f422aff546def4a22c3e934f8a5a
SHA1 45a95809766e758f9988883e6bfd64fdeb9c2784
SHA512 97cf6e8da2ea29bfcc6ade491fd09afee376d8539e077305003740002efd1673fa7fa911c21d1471f550cd0208b24a5ed230922e73615285f7fb822770db4a63
SSDEEP 1536:uaqEUhSYcbx2vMFvApV+xXUdvOxuGca4G/zuMTdjGELX2A1:uaqEUgbx2vCxEdGx89YzuMTdiAl
TLSH
T111B3900562987566D3AB2FBC74F20241CF71BA5E9A21F64D2E87135A0D6378498F3733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
5276	ZedLauncher-Setup-0.1.23.exe
3204	ZedLauncher.exe
2276	ZedLauncher.exe
1232	ZedLauncher.exe
5916	ZedLauncher.exe

Loads dropped DLL 13 IoCs

pid	Process
5276	ZedLauncher-Setup-0.1.23.exe
5276	ZedLauncher-Setup-0.1.23.exe
5276	ZedLauncher-Setup-0.1.23.exe
5276	ZedLauncher-Setup-0.1.23.exe
5276	ZedLauncher-Setup-0.1.23.exe
5276	ZedLauncher-Setup-0.1.23.exe
5276	ZedLauncher-Setup-0.1.23.exe
5276	ZedLauncher-Setup-0.1.23.exe
2276	ZedLauncher.exe
5916	ZedLauncher.exe
2276	ZedLauncher.exe
2276	ZedLauncher.exe
2276	ZedLauncher.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2092	powershell.exe
2956	powershell.exe

Discovers running processes 1 TTPs 8 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4088	tasklist.exe
1068	tasklist.exe
2984	tasklist.exe
1696	tasklist.exe
5040	tasklist.exe
3648	tasklist.exe
4816	tasklist.exe
4580	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5292	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ZedLauncher-Install.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ZedLauncher-Install.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ZedLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ZedLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ZedLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ZedLauncher.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZedLauncher-Setup-0.1.23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ZedLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ZedLauncher.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\zed\shell\open	ZedLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\zed\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\zed-launcher\\ZedLauncher.exe\" \"%1\""	ZedLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\zed	ZedLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\zed\URL Protocol	ZedLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\zed\ = "URL:zed"	ZedLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\zed\shell\open\command	ZedLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\zed\shell	ZedLauncher.exe

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
2836	reg.exe
3500	reg.exe
2200	reg.exe
4148	reg.exe
5792	reg.exe
4524	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5292	powershell.exe
5292	powershell.exe
2092	powershell.exe
2092	powershell.exe
5276	ZedLauncher-Setup-0.1.23.exe
5276	ZedLauncher-Setup-0.1.23.exe
2956	powershell.exe
2956	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	ZedLauncher-Install.exe
Token: SeDebugPrivilege	5292	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeIncreaseQuotaPrivilege	2956	powershell.exe
Token: SeSecurityPrivilege	2956	powershell.exe
Token: SeTakeOwnershipPrivilege	2956	powershell.exe
Token: SeLoadDriverPrivilege	2956	powershell.exe
Token: SeSystemProfilePrivilege	2956	powershell.exe
Token: SeSystemtimePrivilege	2956	powershell.exe
Token: SeProfSingleProcessPrivilege	2956	powershell.exe
Token: SeIncBasePriorityPrivilege	2956	powershell.exe
Token: SeCreatePagefilePrivilege	2956	powershell.exe
Token: SeBackupPrivilege	2956	powershell.exe
Token: SeRestorePrivilege	2956	powershell.exe
Token: SeShutdownPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeSystemEnvironmentPrivilege	2956	powershell.exe
Token: SeRemoteShutdownPrivilege	2956	powershell.exe
Token: SeUndockPrivilege	2956	powershell.exe
Token: SeManageVolumePrivilege	2956	powershell.exe
Token: 33	2956	powershell.exe
Token: 34	2956	powershell.exe
Token: 35	2956	powershell.exe
Token: 36	2956	powershell.exe
Token: SeSecurityPrivilege	5276	ZedLauncher-Setup-0.1.23.exe
Token: SeDebugPrivilege	4580	tasklist.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeDebugPrivilege	4088	tasklist.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeDebugPrivilege	1068	tasklist.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeDebugPrivilege	2984	tasklist.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe
Token: SeShutdownPrivilege	3204	ZedLauncher.exe
Token: SeCreatePagefilePrivilege	3204	ZedLauncher.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 5276	2728	ZedLauncher-Install.exe	89
PID 5276 wrote to memory of 5292	5276	ZedLauncher-Setup-0.1.23.exe	90
PID 5276 wrote to memory of 2092	5276	ZedLauncher-Setup-0.1.23.exe	93
PID 5276 wrote to memory of 2956	5276	ZedLauncher-Setup-0.1.23.exe	95
PID 2728 wrote to memory of 3204	2728	ZedLauncher-Install.exe	99
PID 3204 wrote to memory of 2276	3204	ZedLauncher.exe	100
PID 3204 wrote to memory of 1232	3204	ZedLauncher.exe	101
PID 3204 wrote to memory of 5916	3204	ZedLauncher.exe	102
PID 3204 wrote to memory of 2200	3204	ZedLauncher.exe	103
PID 3204 wrote to memory of 4580	3204	ZedLauncher.exe	104
PID 3204 wrote to memory of 4148	3204	ZedLauncher.exe	107
PID 3204 wrote to memory of 4088	3204	ZedLauncher.exe	108
PID 3204 wrote to memory of 1068	3204	ZedLauncher.exe	111
PID 3204 wrote to memory of 4524	3204	ZedLauncher.exe	113
PID 3204 wrote to memory of 5792	3204	ZedLauncher.exe	114
PID 3204 wrote to memory of 2836	3204	ZedLauncher.exe	117
PID 3204 wrote to memory of 3500	3204	ZedLauncher.exe	119
PID 3204 wrote to memory of 1716	3204	ZedLauncher.exe	121
PID 3204 wrote to memory of 2984	3204	ZedLauncher.exe	123
PID 3204 wrote to memory of 1696	3204	ZedLauncher.exe	125
PID 3204 wrote to memory of 5040	3204	ZedLauncher.exe	127
PID 3204 wrote to memory of 3648	3204	ZedLauncher.exe	129
PID 3204 wrote to memory of 4816	3204	ZedLauncher.exe	131

C:\Users\Admin\AppData\Local\Temp\ZedLauncher-Install.exe
"C:\Users\Admin\AppData\Local\Temp\ZedLauncher-Install.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\ZedLauncher-Install-4569896bac69\ZedLauncher-Setup-0.1.23.exe
  "C:\Users\Admin\AppData\Local\Temp\ZedLauncher-Install-4569896bac69\ZedLauncher-Setup-0.1.23.exe" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5292
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\zed-launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- C:\Users\Admin\AppData\Local\Programs\zed-launcher\ZedLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\zed-launcher\ZedLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Users\Admin\AppData\Local\Programs\zed-launcher\ZedLauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\zed-launcher\ZedLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Zed Launcher" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1856,i,2167326597682719404,1447140886294786880,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,500872149291310117,15410884379543056753,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1852 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2276
- - C:\Users\Admin\AppData\Local\Programs\zed-launcher\ZedLauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\zed-launcher\ZedLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Zed Launcher" --field-trial-handle=1856,i,2167326597682719404,1447140886294786880,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,500872149291310117,15410884379543056753,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1976 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:1232
- - C:\Users\Admin\AppData\Local\Programs\zed-launcher\ZedLauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\zed-launcher\ZedLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Zed Launcher" --app-user-model-id=dev.redshock.zedlauncher --app-path="C:\Users\Admin\AppData\Local\Programs\zed-launcher\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1856,i,2167326597682719404,1447140886294786880,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1860,i,500872149291310117,15410884379543056753,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2404 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5916
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
    3⤵
    - Modifies registry key
    PID:2200
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq DayZ_x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
    3⤵
    - Modifies registry key
    PID:4148
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq steam.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq steam.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Valve\Steam /v InstallPath
    3⤵
    - Modifies registry key
    PID:4524
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Valve\Steam /v InstallPath
    3⤵
    - Modifies registry key
    PID:5792
- - C:\Windows\system32\reg.exe
    reg query HKCU\Software\Valve\Steam /v SteamPath
    3⤵
    - Modifies registry key
    PID:2836
- - C:\Windows\system32\reg.exe
    reg query HKCU\Software\Valve\Steam /v SteamPath
    3⤵
    - Modifies registry key
    PID:3500
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\WOW6432Node\bohemia interactive\dayz" /v MAIN
    3⤵
    PID:1716
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq steam.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq steam.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1696
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq steam.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5040
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq steam.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3648
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq steam.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 51f886bcae396a144f71c96ff5614a3e94cc07ae9568fa6fbdb3cf1633216e71
MD5 81cdb72c5fbadec914d283693708cee6
SHA1 d4c604e2ef6191bd3ec6ef0ac77879a37f50293c
SHA512 61380c14d3267904628266268756e03b89a18b3263f562f2aedbc991a702decb9ad2ee99ff99cbbb19b33299e06338b6bc2f6b3665953287249b33061f065f92
SSDEEP 384:d1eBaGH1i8GW14bmTJ+8MEa+geCyogPndIAsF41p48WM+fd7yErbfkws8hf9:3enVGWiCTJ6+tP1IAcCp4MagIbf1sA9
TLSH
T1D57286A9516F9DC7D89122B410D601E7FBE4E08CDF7551E8FE2BCA2B5C90AB74EA0520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 4a43836f90dfe4b24fe89649f167866f4c09cede8a32d938489bd95c99271ee0
MD5 227ec53d79dfcad4d214f9ceacc62e3e
SHA1 d8e3e5d523367a08bece6dfae1259cd385cb0f4c
SHA512 d5beae7879c128aaceee952a26334604c594a502f4848b2c0f88b4a1d3b63ac791c3e8399fc3566e8496fa9adc97a881aa3882f5930101509732ac0022b19b03
SSDEEP 384:Gh1eB1nT1iBYY1o0L0nN+geClusWOEkLdIACXF41mcAfMnBDKVkN+kZUJhaRvCh9:G7evZ6R1VLGN+e8N+IAcmifMBGaokZUz
TLSH
T17F72E86D266F9DC7D8A121B410910397EBE8E458ABA251DEFE17CD2B1C41E7E4FA00F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ioihtl4w.l4r.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ioihtl4w.l4r.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\LICENSES.chromium.html
Size 19.5MB
SHA256 e6e6b1f9cb0f32235412be113de7716333e88121f9159a0ea0ff3be652021af7
MD5 d260441f74fb71b91762f3285b4e8f16
SHA1 e119948a919b733a9e4ffcb4564f4fd0a8427609
SHA512 d7448129690721bfc52fc0bb53c5dd14e6cf0377eb9f52fff1b5b58a66fd61af2a6d6a90bf6e251dbc3e45be0b1cd98dc83d880abab5198176d1a9c45eba7845
SSDEEP 49152:ZehWCrdOOoVo5TYp2xnuCQpc3txsJM+QAFId+Qi4WMEAccr:m
TLSH
T12827B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\chrome_100_percent.pak
Size 702KB
SHA256 ab7c4b7b6cb8832a31d44b95ec50ce52294f49422a3bdde4e21968eca2930cbe
MD5 8bd180ba5ae087e7348c8e5d3fc747b9
SHA1 032e54936f0a96b9e008a77666e8739f6ff56341
SHA512 8f52ca1c25bbfacefdeb869ba8b2725a12269f5df40ae50744bcb7f4f68df6cf8ab6a6a63116969d07a9ca80caaadcd6b3542f056cf1317e55e7c1bfe8c2b28b
SSDEEP 12288:QI3HWfJwNjzgsz5B0GDJQrnKs8SNP+QSsEHeilSTe+gnzzmg/YJblIt6kjKQCrC:H32Bw7zEEmPLVbTe+gnzzmgwbc6kGQt
TLSH
T159E412E77370AC7DEEAB1677426614B0FC375A280B51060A17DAF8796923B48D8D93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\chrome_200_percent.pak
Size 1.2MB
SHA256 30fa4a6e27c9ff2fb0f939f01158477e621a67d86e9ecb84cf11b3947db8eb9d
MD5 62dc1994f062c83fce3944c829165007
SHA1 1ab2de2406114a4c4e32ca3dc4d6f8515cb4d6cd
SHA512 1d4b7acedaa54d376764ea1709750cb102b326fa4a993bad7b8ef4c4961950c52541dd79a8789709bfaa5aebbed0c6fe5a781866512c56da660ea7ed2c55befd
SSDEEP 24576:73WBS9n2zLmmibkFR8+mZiqr8BWhQumesXRvQtgIQwuSXAkpbaUGQ74:73P23mNbkFRJmQ+8khQRn1Q68uSXAk78
TLSH
T1754522D7D770AC3EDD520B77939B20E0FD7600271A61190F0B26BD7929276C8DA96B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\dxcompiler.dll
Size 24.6MB
SHA256 01e7375aa240190d7af732941cf601c835eb91fd5b34edd199e8cc1c1d0f243a
MD5 6df6fedc096d6a57b304d1d4a9d55923
SHA1 0d42c721d0adcb0c0ed13e902e564960590ffb03
SHA512 2f0effd8d04e339b477921ea24e84a4935adb883ea334e430614b24c62e1aa13dce3f6b8760996abaca3696167f8405a57a150f830856f7f674da8ef7221310c
SSDEEP 196608:PLygTuWWAlKKzVyTh8TekPfqWNAVKdzMQvGrJT0D64k139WsVBSGzBYT1kbUTCT:PLluElKKByTeesxNACMHRA6dCsXvhU
TLSH
T1464729122646D49CC099C879C7678B268A2C30E73FA7B9DFC0F461252B79DBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\ffmpeg.dll
Size 3.0MB
SHA256 c5d6728608e90550f4de8c97399689f5ae6b6875b8073f74ed2985a68479ae1c
MD5 ee0869d0ec270cd9bc41239ecd6e3455
SHA1 a3b501b2e5981f76cb95f2bd9bf2bd8b2405f55a
SHA512 70ecbe32216a153f4ccf0e6ebcf1b80ef8ef9417fc3e34504cee86c11d5670b70a6a60f760d7c37ca263e54d5d5d3834aba0edb1bd6d4fe9165df179620fb07d
SSDEEP 49152:Kagye0i1JBlvS0ZU3oAQULMsvpTwDowaY9/Gz/YaLuPkuf0E6OOlz271:KJ1lS0ZcoAs9HaLuMhe
TLSH
T1A6E5AE02F6D251EDD019C03497AF9213F271780A8F205AEF17A05A253F66FE86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\icudtl.dat
Size 10.4MB
SHA256 da53f0b69843aaa43315f0f210a67e4a874b0be338f3dae08ff57b8afe76ab0d
MD5 d5136270d87d40d2c1c6df098f53002a
SHA1 d167e8c8183258dc8714a84993b823dbd7390add
SHA512 55709f3a14e9402860ff2648bde887e7bb7674278c088e36ce20e6b107735cca68a210a091ca72f816803d27998e188b78aedf18cbfa24ad17cbfd4caec9376b
SSDEEP 98304:g/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjnd0p89s:g/cBhORok2HiXUxO/RJk3IWhlYntjdPs
TLSH
T136B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\af.pak
Size 621KB
SHA256 3017b141bd16e24190d810f0748612f0fd4352ca8553002b9a63a7f77f7154f8
MD5 cd886deabac5d290bcfe505aec6d2936
SHA1 33b05211957f11d5d5bb563258b585c30ecd8870
SHA512 b1c79724837e2b52e5015dcb9c0b93472dca52e1c392c5b6bec3f554d3b77f74b1a0d118ea18ddf6abc8dfa175b8717a1a6c7344d479c7246bb1783e5cb9ae96
SSDEEP 12288:M1MEn7kwUPQ6tRGtAX9F17ZrzgNslCFW+pyGpgvi4H2Jyn4NsmUAAL/5THozvbjx:Mr7APftRGtAX9F5ZrzgNslCFW+pyTviB
TLSH
T103D41B0AEBC1273D09A07696FA0845F7BB5D626CC770F2BADDA982310966DFC10BD1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\am.pak
Size 1005KB
SHA256 67b938d162bc75db067120bb8366b5bafd9a75fa99a0ca9ad4f46b47d1d37634
MD5 6d22dcd650f3157f3b500d609c630b76
SHA1 fb063a5bfae0bdc3649e772e9fd86c285b26f954
SHA512 c27e6ab4b09c527ad462b968b02d1bf85205a62f16a63bf0b97a26d1f979c69113799cf8794ff2ddf3f1a3d360d267811fc4990d1932a788b9b6e653399bd091
SSDEEP 24576:O8VvT31VYRThTCKHyWVt10RTjHgvvevzFI6XdOdvwilgB1VewHZtPoIp:ZVZBF
TLSH
T1DC25AB547EF9F7570F8E8A1994320E4F9594AE4652802C38C35AE3FC2B2DF1B4DDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\ar.pak
Size 1.1MB
SHA256 560244ecff0d522b6fbf97693bdde0a318c5bc516615cb15751ee2527a6eb730
MD5 68cd651ea59f4073e48adb8b2b5f2af6
SHA1 c0c49b8204b19d06163b14d7043b278e21ba79b5
SHA512 8daf9e21b0aac533b4945d3fde2caca22942dbb0edf37070486033268dc75a2c7d0cf0c0d65277413d4e9afced2e5199be3064846163b0c0854e581beee2e34a
SSDEEP 12288:rlzDhAe9HBHApLxC14Gei8wj3ri2XYrvZU4pDk26ISeQN7+E6W0ZYJ66:z+Ej
TLSH
T1AD357BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\bg.pak
Size 1.1MB
SHA256 2eb9c74c67e4b13b45a73061fa978738e335bc245da71bab0ea9b205fe91074e
MD5 651366d5dc136aee8364ec625a917f9e
SHA1 9bfa9240d8e675a00c77608668775d9036c9a0a5
SHA512 90b84232f84cd67e88ea99af7f274629286ae02c292dd610ef4efeaa7ed4154ba7048e415f62a5c98fb785c8e4377deabead87aba2cefc1fed7a3d3429d52019
SSDEEP 24576:uuI9WglWLYxgCzQkEC1U1Vb6lNs7e373ZGm+X4KxUfVDIohD74uOVnaNmu8BtTJ1:ux9WglWLYxmEU1Vb6lNs7e373ZGm0dU4
TLSH
T1D24524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\bn.pak
Size 1.4MB
SHA256 415621a5c0b1546e6e447d43b76414425a8703cc7681d637ec1f283ad0c787e7
MD5 668f9188aa073a9a1c706fb67bd1de92
SHA1 9e0b1912544d3c722d41ebbce8abcec30d606c69
SHA512 60071949463a9029c15b5f85aee8c2be008fa97bae2e07d11bda922ad92066cf92dfce0d25115c12f785c94fe1d5aed390fd29cc47fdac6620a6f16bf401a5da
SSDEEP 3072:cCpCO+qbfG/1xsOktuHrcKqt2DOUzhUygJfGCARuItWNAypbjBbLR3QXQcjC8wkz:cCpfFfGr7ktuHlIAypbjBbmwOqM
TLSH
T16865EE209C6E81B6A8C5CDC9434C6370C123AE9B9B65F74DDC17A25538ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\ca.pak
Size 700KB
SHA256 6f28297c1ccb628f534d65dade167ae559f83eace359acf47e48ff890b9409d5
MD5 ddf227a00ab2b50a8de153edd0309499
SHA1 aad2e096c7b13afaaafd01261602fee51723eff7
SHA512 f10992e172cf225450dd4c90496201b19f30a57247c87a63313addb829551e1d07028f53a22cc6a94f4413963da6517aafff2f54480ad25ad327da95d8967010
SSDEEP 12288:2ztZe+rqQR7IO4yCiX7rmipFa8i5PsFzN3Mw2juwwPR9zejm0t3ltuFTjK85nCRC:stZeYqQuI59L8wWqTM0zrcC77JEw
TLSH
T1C5E4F8239BC93B7744D3331EFB46C253B48CA9847A06D254F4AE0B1622CCA9CD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\cs.pak
Size 725KB
SHA256 799a789ce531991cb975425730db310f9a8fe74091eee568f3e65fcc7ef0cd57
MD5 3a0e295c5386eb3ad6e45a38fa8e47f4
SHA1 f5b447f009a49210af0d53358be73b737df8390c
SHA512 6abd677d06ef1297beb437a8e76907d3ca69d005b3616280e2761e690a5a2a390059786e59427685796a80d75219dcb0276d861f93e0e57e775c9ac89a33f81e
SSDEEP 6144:1ozOsvAJKTtn9093lBlu+sV5ApvDEAdzBzB4DVw8OCJSBs78QXss:m6SAJ2aWJV5ApLHzBeVw8OCJSu
TLSH
T1EBF4391EEEA36425584002487FBE4228BD5E83540B6EF5BB7CCF9C912575B7A8EF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\da.pak
Size 650KB
SHA256 236b73e0bd8cf984609f03612b40d4583525b0293f994ef5bbddecfaa3aa1e7f
MD5 77472a30dff96f8fea198d44f93e79ea
SHA1 51cfb2df2d45c5bc5614efd90bc51554df410e28
SHA512 8f5c47cf3c513a8b5b562a3629277fa9bcca89950a45afdce24ec691a846aaecf7bc18c5ae291a21303d19177e30398e1325ec43faa79f2cb940f30f28923715
SSDEEP 6144:Sy/WWvBdzVmf6J/Ql5znDXyefnbI6E/92IY/wlUYJwQzbFNVSpPzvwTLqGs5LIoC:SjI+dI5avwXDsaJH
TLSH
T1E5E45B4BDD9C732FD9A90729F3108DA7EF6D543CC684664F64D8943A09CBC6092BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\de.pak
Size 701KB
SHA256 52b9d92d2d09532a6016ce07a355e7acb385a9ea245436e0db188a76b8b7f622
MD5 877b3c30f6a33fd85e26ef410d0436e6
SHA1 a6cf26c9f8bc00483b508b921b116d73e43404fa
SHA512 842b3340b454cede697373256c195e62f2b6db8c5b51b3278b87cfebfaaca8756b9770c9549ecf454d95231f15262b7ab5b080d7f22c971f4643378f201e425d
SSDEEP 12288:GWdv/MbgMwVkW3K7UpkZ+gyOqc9l0VJUbQUeecCtO:NcbgMdW3K7UpkZ+gy9c9OIoCtO
TLSH
T137E41803ADDB625ED78673617705CDB77B19E36FD342312A88EDC02B650B5B283AC522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\el.pak
Size 1.2MB
SHA256 37d2e1ef69fea9bdb1e0902cbc61a458baa9009fc3761029bd1c1882a7a0c9b2
MD5 6b335073ea816b2193fda87420a8666c
SHA1 008e233d6450160f6de6527ab577312eb2708e3a
SHA512 c2f9f9070a605611863d52c42320b08a6dd6f36a148042f969dfe461f68707591575b9625b8f47301e2e9c6183cf67662271fbb613058333026faff2370d789d
SSDEEP 24576:BD9dSFbrxq539bk2tHZucYAJXDsSj8msAcByz2HSegLC0LqvMIvNAHx+4BWyjsHW:BD9dSFbrxq539bk2tHZucYAJXDsSj8mh
TLSH
T1D355BFEFB4582DED8046950785D8B07C2BC66D6CE749CBD8622DCB60BDF80719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\en-GB.pak
Size 566KB
SHA256 56ea59d5f21fbd25dfc02a6de4504cb134464f388e64509b2ea1657e238aa427
MD5 ba5ae59583875bac84711febe3c7a6b4
SHA1 9e6fa299d4001617b37ab409f83f1823c3be9e29
SHA512 1a7a282445f0927e16bbd523a78502b4a530830b597ce0c7e1c7516d9e2bb68813b543d6e09f842373ea344e86f1fff893530804b138ffc2f366976af3659ebb
SSDEEP 6144:q/Jlh7uqK6aG9NZxjTixh+4EYDNSPzELMxNiMP9Uh4bifaY1x+VKpDgBc7RKa:qhlxEk7Zexh+kNvM+h4bUhDD
TLSH
T14FC44C1FF784122A05935162BB0AA562FF23D07CB36112667CBD811C33B6766C27B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\en-US.pak
Size 572KB
SHA256 23b271e8009bfa14783700cd0712b4ecaa5b8f2ea28a4d81ae1d7e05bc0c96b1
MD5 3d66180f21df40a9eb941814676972eb
SHA1 b74b6ceba72cd5ca9e662acca19285037995c362
SHA512 4ef14702236e389409bd875dfc0b3f467f8b15c9e97c13dacedfc751642445141de31d6ccc574c8aa4dd788c2e756a16ded3262eb0c577b2b0e82ff526638efc
SSDEEP 6144:pUTO8xSUd/7b7/wg7HfwKOF7Nt3/p9XhMP96hgREfaY+43Um8tjmngcs/wEwj:mqL8f7/weHfwpNbMUhgR2uj1wj
TLSH
T12AC44D1FF784122A05935262BF099572FF32D06CA36112663CBD812C3376B66D2B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\es-419.pak
Size 691KB
SHA256 530e5b8edc93f95a64700178c2a3fbb55f4d4eadec8cabba25fd21bc5835c63e
MD5 a319e4948bfd95d451ee2391339a5c70
SHA1 52e6914467275a88ea476c491020100facee40b0
SHA512 5ff89f1a9a9aa0d2f1983ff9b41684bc962871e86ab75dfdfa0e17f9dfb4d0ccb7bbbe1775e53a06f6f8147b435cce0b6026733d8e737e10df717914f4e77cd7
SSDEEP 6144:7VfkPE+IJODXsrqM7zvsYTHoZ2hgrOJJ85A26+ZTGm/X:JkcyzsNr/0OJIAoBX
TLSH
T122E4F722BAC81F5314E3A388B743D753E8D89545B408D25BE8EE876522CCF8CC967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\es.pak
Size 687KB
SHA256 f0982c7ebc30101e609225e2011339378c96075e094e082b694a467eca1108cd
MD5 fcecec127830a0c0d60bd2ec73603c1e
SHA1 f9277d50fbcad745d5010b97bcd58e7a05578b9d
SHA512 7afff6d63adacf1ab8ff1bab7ce941899525ef51239112dca3f66b774525040a5c1340f602107e906f7383221a84b21e0acc2d56954ec625452a7324df9374dc
SSDEEP 6144:waivgIdbrudhq1GFhiUgdNo+TU3cWFkBZ8jAOwhJ8aW8tWf6k8+6PZCud:z0brudviBaMWFEZ8jfCJfW/fb4
TLSH
T1E2E4F626AACC1F6310A39349B743D753E8D89549B408D25BE8EF876621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\et.pak
Size 627KB
SHA256 1e3b4eb21d233e3adaab469310a8c6c61e045379771cbc381c4c000e1716ab28
MD5 1959c622084de3cfa353222f49c2ab1f
SHA1 0a324593855959b0847e7b1bd6e49b9969f7f828
SHA512 2615e3ab5f9150570a5ddc1f540219d09f2fc7eb98b2846434f6583676b56aa8d1c433e3c1c6b20be3dbe85ec0a419b21ee1c09dece7d4af9770dca66ff37a68
SSDEEP 6144:yGJvIIlg3SnkZu4VcBzVOL+vynnyW0inFaXSOJ44LsxfBPOCXy1gX8ZV1aBYvNpy:yATgioVVcG4ynfnFaXSyd1aqvNxqnzP
TLSH
T1CCD45C42A27D771B242412F9E737A937DC9FD7D8B4000D9668974A0970EEF8C38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\fa.pak
Size 1.0MB
SHA256 0e57a54b3be643b9f5e3c46d40a26d40e00915828b0ab9dfd39991cff1283240
MD5 29083b4cb591e2e3b847181a4398c0b3
SHA1 88111303dde0ad05ee471a616533e054c9efa60b
SHA512 9857d814823796cc90ba9722825221a0dbea626ae633c1c08bb643e07ab24e8241d9e384d02dc9708d15f3d2929d8095281ac8675a7634cb56c2e426a7d9f980
SSDEEP 24576:gSKg58u313uyqoz+sw2LrRmXnloThXtCfGk62Yha826JfigXnMX44OqlULakI02p:m
TLSH
T16B35B1956AAC9AB25747CA0341D33834C773EF12D349FE40ACB1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\fi.pak
Size 639KB
SHA256 1f3123d7fb5c22a95b5250ea17450b665c3c6cd6a6dfd28bbdde15e1bf684a0e
MD5 26071a88b56d045fcafb610c6af8f9d8
SHA1 553bbd02c6e97cc47aab8c3f03c45c55ad168983
SHA512 8ece18be3e368a03b95092c65e3a27b2030286144ec9815cb011264249d938ec651f4f8901d9bea2a1552607cfe60dda85156ae3d1fc10330aaedabf6f89f7f5
SSDEEP 12288:J21mh0Ki36193qYvS3aAYNpv6IGp3Wa9q7Hg/:JVh05RRaQI2
TLSH
T1F7D46D915215C22137C4C29EBDB0903EF5E5E39CCC288D96E843CBD949EA9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\fil.pak
Size 724KB
SHA256 02e2c70d3d85b0deb677a9ae576ae3cf89e80774532cb3315c14f1e8ce64b310
MD5 bc775353314653b56a92b19e25089e2e
SHA1 deca4713ed0d95a96b6bb857c683d9b7d8149181
SHA512 a59e0fcbae921c3f33bd2b9de052fb4958d1ba8e73285b2ac2948433dd13c7d95bf8f1fa5d257372375ac522dbc7b94ebbe68fd3958207556013a23ee5a1049d
SSDEEP 6144:sq4QFQ/1nfokC3ZQoM6qFYNFDQIG8xVz7A0gp2ua5vwg6MoZHA1JgiW:shQ6/xwkCJthNvI
TLSH
T11CF4D715B3402748DBC352E56264682F6AE560B83F81786E4FFF269B3BE7CD5D270182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\fr.pak
Size 745KB
SHA256 8bad7fd88072ac66649dd9307da9163962f8ab00313e627bf1c5ca4450a48b4a
MD5 e72107838fc5ed419d9fe6c515d8afa4
SHA1 4773f93e95e604c5827eeea8cc9dd53921645169
SHA512 7922202c6a800e4218ed71b39fe9ac92b289c9e8eda04e0b7d0a8b18f90e4698083320ea928474238a640d970ffc56dc51ebcffe7728705ec63451eb1d768810
SSDEEP 12288:jrzrRByD21UfcAZLF0W14PGbVAZgjgiu/WAMnS16Qua6gVA8DvjH48Kh0MVSiYnC:nRY2LFXV6lSC6o
TLSH
T154F4E66FB9D432CB19C60277FB16D663DD348248F215E300D89F4296129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\gu.pak
Size 1.4MB
SHA256 e86e8c240d4b6283abb03c49df9e8899607ef9def6d4933c7a541d63b5835271
MD5 d951d00d45269c6850524c5ebe07de7d
SHA1 bfb100d437d2d94095b99111af48e41b6bbb3e31
SHA512 1d12fb98bc3f99f3781c8f6ea9b8686ff46195b515597362c980455d0c4078b8a708bfa8814831420452aae32aba4292e6fc68d3e23fcff8c58d5e40342c9bc8
SSDEEP 3072:3l1X+w3eMGwqlcdzHnfWGtduO5uNCPv0QaPjAwREJKVMjNiT7llj63rA8lDcSi53:3zuEXljWGm6YVsAU+hCR1Us1C
TLSH
T1BE6518D0D7B9F07019DA9F7E819E512086699343D57E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\he.pak
Size 906KB
SHA256 ddc1f304ab1f4489d19ae2b31e7f8e3ffb47dae439520159e8975422c65e4115
MD5 d4b804bf7dc9e7118cd3d38f128cd7f8
SHA1 7a95738e91da1499c3c551fb3f27218798aa2c7c
SHA512 2a1eeeb23c4c18e06592f4af4cdab369463919f359e81a5ab23c3e20bc74895a217603b8d826a125e67a13764ded1583e0af7f083f26f0dfedef79c033ae0007
SSDEEP 12288:PWPwMLpWzu3h/aP4n6nZT4SCVu/rcW0rVWvIxLdN3Za+uiJAEVXRQeQCaj4MlB6t:PWwpf6t
TLSH
T1CB1588C4B2E492255131AAC39FA5FA285FF3CAB53CA27512CB14526CAC774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\hi.pak
Size 1.5MB
SHA256 015b3856dc05e8635a48e749e6970fe43f5d620b8dbd04e5abff586178213f6e
MD5 1be4fa16db685e94007a0a30702b656a
SHA1 ad9208400427a3c649ec4b834093e45fab852977
SHA512 86d481794a185e783ec53936f8f63091e6816e8b4b23de6598e324abbac00a20dfafb5b73176eb23e24dee6acf8a603c18610e15ebd0d212ed46952492257886
SSDEEP 3072:3WhTplLLsvMLgWH3npvDBq7u7VSeTNY44V/B90ZV1dhuBlOvXoCDtDWejYX55nFO:m+vwpvY7u7VhY49II8iidSm4
TLSH
T19F75F40CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\hr.pak
Size 698KB
SHA256 d46c64ae8af3562e37eb80438aa2bee228fafda251d58ba4d0991291f1c72aab
MD5 8f8a2f1da61e896c7c2cf641726c081e
SHA1 867aa42a911833025ebb4cc30c14614732815be8
SHA512 90e299305b136736934dae850abbce858c5910995259a94468cf47316880fc00274e6f53fe5c6615c8f98c0185955b908f4f08dc144721dcfbfb76bda32c5716
SSDEEP 6144:Rb+L1GEcwOCRAHRG28sirAIu51KrX7K2wVO/ujQ52u:RsUEXOCRAHQ2VVggOmju
TLSH
T189E42A7DBEF2570A0897B24AEFAA43447DFD08DCE56597B7684F522E0003F4C6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\hu.pak
Size 747KB
SHA256 0a46fc8d50f74effd1cfe1979e677df3de6fc47e6b551267303d93d57bd83f50
MD5 d6cfdd7c401a644dfbcd8e66c9702192
SHA1 2a1a0b58795ea033e5f8b28cb4046180db188800
SHA512 e0cd08e23dea8065656832f696a8e0aabb6c29874ee5140c1db4a211828dd45580b4a82e07518066c099b9aaf0afa70d88d720d4d336015cd48ec201ffdb80ec
SSDEEP 6144:q8auaOrooql8FACP/XDGBrT6Nn4HIuxiXlH27lm7FW3gAezpruS85S85Z49Ka0Yn:q8WOklmxP7zXAi85S83y/7LY1k
TLSH
T162F45BB79376944ABC6C179778643F15582E481BAB2B31FB2887886D34A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\id.pak
Size 620KB
SHA256 f567569c42a25bb2dfc5c33e13aac558c0e2a1d5d4b969592bbd0841b36438db
MD5 3fc5ddd09ea15b88504ae0671979f58d
SHA1 a7f2450660f45e1a860fe036a892a7f5648ef1a0
SHA512 2985a83b41ef90095b49214ac4261b873bce9b16f5eb2b7c974281afcb130650e6c176923ad6d0ad5dbf42541a866ae5663902ae6505e2ed6143814a68c1d7a5
SSDEEP 6144:6/0X4JMvgCGCBUZD1z70mQVqpffhTFjlFlLmBhpvh3xE65jXhBVbm2iTvxePHsE:6cIAGCBuzaozTFjlF9mj265bvz
TLSH
T185D4E8632ECD310C194442D9B2CEA91E7CCE233BAF05B76E8E348F7055A67686716BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\it.pak
Size 677KB
SHA256 0a4090fd79acda3b75ea4cbf59c299b7fbb2c8ed69696158c6f3620bf1901955
MD5 6bf95b9c617fab187e99ba865858ce36
SHA1 750b6a91f28ab95db76d65dd294679528b35375e
SHA512 7c898f5d1fa268ad5e5a83204f61a155a8bacc44e4a39b05d5727a73e58005670a073a8e8f1dc0d4294062ac33c9529337bc54654bb7e2a3d2acc71c5ae77a1b
SSDEEP 6144:1MJWMPOFn+yqLxl+07erxtwaiXBRB73N+5aIwSbmCfEs61ltM5jhOfB+QcrMppzg:1MoMPWFqL/wLLW8yW5uPHfIYH5lRpW
TLSH
T1BDE41B3AA5DA211519976359E611B185FBAAFCCCFE41721CC99B031C22CEE80F1ADF47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\ja.pak
Size 822KB
SHA256 65a19121dfdd2163072d104cfe71970d132e76847d6ead6a2c103212314e83b0
MD5 75568c6a55b3f819552f4327ebb6ace4
SHA1 541b9ac9ef9ff0535f5f51b7e4d5d564f572b5b6
SHA512 821945701040ca23d7815757b7a51113748ac6183e9f87577e5611a807dfff85d9893eb25c3b0ed5cedc65b2c4a454e6f527ea9522a982bbe43a351d0e3cbde5
SSDEEP 6144:iECY7x5lqzLgFh72ODGuL2QHciyp7ZEQ23O6fP0bhJaHczchoVa:iFY7NULwYMLrHcR7ZEQ23OSPCkHczcb
TLSH
T1C405407CE3C969369D6153A22C4E36E17506AC9BFCA23A3A443DC074BD707CEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\kn.pak
Size 1.6MB
SHA256 af5fed2130102ecc0c878059c88faed9d6db2e8b147fb5ae9e15e3fe69706c8a
MD5 254a621dfdcda79b0e130eea6b295e4f
SHA1 0a619e7167c51f8130e815573fd9d6b35b339dec
SHA512 62b112893735452519ae2e10a4dda74bfa42bdbd67ca41f7006f5eaa8e0599e686e2c2f05e09b60f8953decab47590d9ad36230da777ca00c076c8418429fbe6
SSDEEP 12288:Uo788nG/ywDkewDScrOagfNuLBCj+7l7nmsMh4iVW9Tmv:hlnGf6Mb
TLSH
T12E85CD18ADBA7D311BD5006B24EC643ECFF16BE29CA947C2F4DDD7802C66C6A90825DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\ko.pak
Size 701KB
SHA256 56449cc28bc41af4ccbf35b98dd30019839e8cc193f7ecf4ccd8dacc26302303
MD5 192ea46082583e9f659e59271b5b59bf
SHA1 295e043317e0e4433c674c63f5c5eadb3411fc1f
SHA512 b49b4b347114b5437fa3562b129dc2bc7317bf3e8e79e29b8880a42c65c7b1104d194f4fb5d42e193e74ac15f1a77c0b9c8e4ab077d9d5cfe8937f76a0f53a7f
SSDEEP 12288:JzkgWqcZ4kzM1WNiPszcbifYj4ZGRyrD7zIFPgssDXCFGIE/xESJGGLhwVX0CX/Z:JUJIRPUr3+6WZ0y
TLSH
T1DFE4B6F238DF63C91193CD82AEF4FA198382D976F75302A4ED44CE449E145D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\lt.pak
Size 759KB
SHA256 af969f4407c190dd01a426fa1244cb1ec7cdf2909d1c3ba5b87ff662ba567303
MD5 d67db6a28c8f559d1273a460e93a5876
SHA1 d26c98cc980c9817d9e2b53be6d848036374059d
SHA512 7f9dd0b418089e214fa4f16c994d7c1bc9a4fdd816e0ef2fb9a93877c4fac7b72401804ac2eb4fc43ba81d9d4778b7f3da6c3b8cdd1e88287a9713b71f5eccf8
SSDEEP 12288:0Yl5uPBw3krMNeep3Utdpy2L71aQYj98wN6j6SFH:0Yl5+O3uMgqSwNOa6f
TLSH
T177F41C0069E3AEFB9A5467C981A8CA74DEFD50009727BC61EC69C78BC43BF4525A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\lv.pak
Size 756KB
SHA256 4455ab7c06172c2c80796a99558e41f452cc3b33be76654d70440cf4ac7a2d34
MD5 9c83376228a21c11f5edafc719424d27
SHA1 a59e8782855560fba290e0631d8d176f06abc4ed
SHA512 f4e806f54a19280dd343172bd4709406e1fdd0b6ce97223bc3b4da2a2244fb82dc4815a56731b17e7cea068f305441c519c27ffe3f5ee1100e4173d3a6add651
SSDEEP 12288:AWDthJkmQkiXWSlZ70XMICPPrJ0mn8cBTtStX+Gi:RDtakiXWSlZ70XMICPDJ0mn8cituGi
TLSH
T107F42B959EC68FA94D904DCB732AD122A8CCD740FE07F112ED798B3A560F52432B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\ml.pak
Size 1.7MB
SHA256 b5606265910e45098a88e989202a550531f6d00333c6b112ed4c5cbc07b2ff6a
MD5 9c29191c67c3d9539df9c936d31ca2aa
SHA1 7554192d90ed72687ae5920e464f94210177825d
SHA512 ce792fcbf46b0aabf6099904ddb9284d641f1dcf8b5ae75fdad04147affa78e0c3f109e5e31e3e884bb4f89c57c1d38c558c00e945fc54c3059c94e205a25f73
SSDEEP 24576:WiF/U/oZAuuxyYl+9y9XBkx/etEWaKfijHeBAzXT4+v2kiNk3Ma/W0b37:91
TLSH
T1DE85AD57A036CD3B0FD102167B4E2FABCD5B9FA140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\mr.pak
Size 1.4MB
SHA256 8465d4077ed5414cbcb7d9bdb00d85e515a1a069703cdc1d4d67c9d6e5623fb0
MD5 00192057578bcf97c8fdf81963e473aa
SHA1 d3441e0dd2dc3e840dca38400710ce017855d53e
SHA512 c623512e7ae3ca0acf7a65e757715449892c5241822d9f473866f742ca52fa5e041e4e5fb0d9a590870d27198e3a72fec86bb59a1831f0c9f5cb0ea1473ec4e9
SSDEEP 6144:WUASC3+M3K2rwb2XtiWUEFBhAaYRbIl9Bk5mty/DK:WUASCuMaWwCh34bIl9Bk5mA/DK
TLSH
T1B765D24DF77AF3685DACBC8E36540D3BD8FD31B1C3E9925648E1B3A74884CB401996A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\ms.pak
Size 652KB
SHA256 af7021a00befa586aa067ae3ccb339079e6f13ee0cab1621836f6abb608b6f2a
MD5 4d315df981e03002091c3320cc9caaf1
SHA1 4d3869a0c4d59d808918687436c3b56d6763c6e2
SHA512 969345b9b60fa3b9344e07a14cccb48df24ca09e3d1872546d897c64833fe7cd81ecee03dc7871f87002ce2ae5a4001603ce9116192b418a4dfc686d87d920f7
SSDEEP 6144:8O3AorsPjhhrF/t3pAHglSobUHuqwjroR+DhyWSzAbaR+Ulw7QCy9h2zR:jwfrBt6gMHuqwjTwrlwP
TLSH
T13EE4C6579EDE3118085843D9E2DDAA1B3CDD3332B705AB2B4DB08FB0166E7A53315B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\nb.pak
Size 623KB
SHA256 d97a2b0cbe6adc99add2ed3ce0d15d0bb124b778086c466c126634d60ea72608
MD5 820ea44fba453034b2a8ee9bd7e76611
SHA1 bdc2faf8211ab4ce0f175b6f380ba1d252661d8e
SHA512 a3fb0a5e05d597840aea11a3105fd3c6f6cbdf15440df3733447c1359b0669ae4be3a94d669dd3e27f2da93e58249956af2dc3babad45e9a4259a03ae75c2f44
SSDEEP 12288:fGkyTyHOJDAlQSoU/Op7fDYjG7PGcu5lBoU42wW3:OkyTyHK8ofZ7PGcAlBrN
TLSH
T116D40883EE86B72EF69442A8F518865B9B7D943CCE98199B54CCC52E0CC7EF052BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\nl.pak
Size 649KB
SHA256 b642c8ab5ce11438e9a8fd4639244fa8f1d55cfd70269565490bc55ee907b048
MD5 f23d20dac8528a02a179d6956f0e4fda
SHA1 c8dd7a94ff2ed337071a7ba1c729121d85fbb354
SHA512 3a4a7cfb2734c334f8c32b62c1d53dc2c16442c591fcb7f75a8833f190b59006b76a634945e2001e0c7c52514a5f763c709478ee18736caa870facda79434410
SSDEEP 12288:HwEuhAPlbJWQuslUeAKg3MHkTFBy7K9qHhG1J:Hluh0lbJWQuslUBMHkTTy76qHhGX
TLSH
T1C5E4F907AC8E253E59C0A349FA084BBBBF2ED22CC26CE67DD4EDD5341443F6851AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\pl.pak
Size 724KB
SHA256 8a0969fc743d3e2f5111387d53c0d79e8c1d9f68256ad6553b87fca2bcaa7e6e
MD5 bfb7498aaa8f4252f8fb5e521a3e61b8
SHA1 c89c6944d186987a9cb5be348d01bd52c7287bde
SHA512 9d73a56e374df5b135f85cf3fba9f2d99fbaf89110563db007d85d6e3e14c840c35905c20b3f5015bd79499f5b17de18d21614c4611b020c980ad87da5fb5e12
SSDEEP 12288:felyrOtK+N2tfQfuzSJQbZ4brnPjCUdye3m2UawMAmo1QhalNRPvLoolyOXd:GIgNrjwMQ1QhQVt
TLSH
T1E2F44B0E56E59A4E8CA008E6F6EB1B7CACDCC808F108D35FE45F452A619B19FC9BD5C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\pt-BR.pak
Size 680KB
SHA256 8d893475afae1f579c7199f245aad184650b0224e697e80cfe700b4061f6c16d
MD5 7b708a57ee3adb8f71a17789a976a908
SHA1 a9c4e1affe13315c4c8703744a2a6d24dedf1755
SHA512 ca19795258015b817c9bfc810b59a53ebef9661855d2f4c91b92e6ba991b655fe798f0fff0a2e855d3e02885c888ea6172c2907b0efa4e462c23ea20c74e2120
SSDEEP 6144:czUp9/xYIZ01Z9NBXBL5C3OaNyza5E34zu0LsRyU1y4:tP/xYIROEExasRh1P
TLSH
T152E42B2E6DCA136615226350B71EEB07E5C80645FE06DA87DCEF4B06A3CDE40D933BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\pt-PT.pak
Size 684KB
SHA256 bdfa7264dddf70f936f1785737969559a577b51d1952c820a468c611d18b17ca
MD5 161594d74a17bb74189e1fab6a3a99a1
SHA1 41332934f91785e616fe675317adad4a74f275e2
SHA512 81c22b6a5f2c3217d56f323cb63596ca7361a9636a314e192674c38e4807b6258c2127a603ea8b827c703abec0bb6f2675e149b0d3aaf522ab5e1d35452be40a
SSDEEP 6144:GSp8Fahf2pW8kuvFieJVJJxh/SUxNwyf8mBn9ITNKSRLc:G3ah+pW83LBn9AKSRA
TLSH
T1F7E429286EDA136605235351770ADB03FAC86655F809CA87C9EF0B4272CDF84D6B7F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\ro.pak
Size 711KB
SHA256 1e6b5b0dac63a9e951daf523de310f6bd9e5c53e281f37706d41bd35d2a08bb5
MD5 42b62d8b4ae6c44d00e8324038884bce
SHA1 4227b5185310d602cf78b9b181afee118b7b739c
SHA512 279b167f4ee8902259095e6feef515848926be23fbf566dff20520a664f1bc048444f119e8f12084c53ca6c633ff261b694e28fcc6786282303500153490e992
SSDEEP 12288:mtj+AUFtka335aKPBJ4RJBDepv5m0tsr/+Y:mN+AUb5m0sH
TLSH
T1ECF43B23A1C82A972D5152B2B73935D3EC8D105DF640E28DA4EEC97910CDDDB852EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\ru.pak
Size 1.1MB
SHA256 a9e76536472c45b39e7ae2af5f3ae1bc0e50a11646efdb6fb3ca373b5f2e2c70
MD5 b39c9f236b40c7a5be478df8684713eb
SHA1 7fa692f4ba15edd2dcf12c8d1f7ac5b73f392386
SHA512 8d25dc8b8b2df588cf7bb156a25db01f18ff92d4a27b08eeb5861a8100932da045d8a12de80d59ca11134730d9c9ee48df69cd144d153859fd583d4edddc4644
SSDEEP 12288:vrYo1AfQeRo4YeeMObzJ9sF8aTjBL1gJqSvYsqCQKki6NR3Fo8N5K4ZM+MYHenO2:DYoG72o3A
TLSH
T103458760669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35219A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\sk.pak
Size 737KB
SHA256 8eff7365eff78623cd26e40d40540f52b511df96c2824f62531da65f0d3a8087
MD5 c013059ab8aeb68fd20ef20919a32479
SHA1 f536c647fd555d5d1a7685b4836b903ad1b97fcb
SHA512 e3fb3245b93bcb74cb84f530e4621c1e2b6d506da9f2e6655ad77c4cf802fa51eb84e2400f7c9c29d29edb1fc7bb26e94e105e23c633b4a909dc81c942765dbb
SSDEEP 12288:eAigNPL7DPK62AexuBYinyVeLBo1nsaYkxz+mpTjsxt9we:piIfK6NBUbYkQdtae
TLSH
T1ECF45D3FDBE7181E8E9D0144FFEA7110FDAE86508A4EB0A5944F364714E26EDCAB4E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\sl.pak
Size 705KB
SHA256 0e1c50e529821f318e4200e024d863daccd78e15de1a5658fa3fb1ebf6312bd1
MD5 03d20ea7c0b27152adbeae81d6ee754c
SHA1 94f62fdc89dd21d0a8e3b0da80f7130c07ea55db
SHA512 d7e22a8e31a9844c86221468df427c5ab3e32c52a1911c855318e737e745dc74ba8d734c56e09e142be86b64c3236031a84d72096319cc51f492db8460d9f187
SSDEEP 12288:keaCIF0cB2t2TraflWH1TgJfi/fzbanql/aA:kbfFv3af8H1Tqi/fzbaE
TLSH
T1BFE42C397AA75E0F0C9AB2CEFEA606007FDC044CE251E6A1FC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\sr.pak
Size 1.1MB
SHA256 c42a674e3f43aa70cef005931915c8b7ceb34b29566fba3309f8da931dc7861f
MD5 dc46abb0351f9f6dff99464090e12453
SHA1 342db31df56aaf55eff4b8eb51d31ec4cc1225ab
SHA512 0f5ad3101e4cda8a3d72dc6d48c48ebc0340e7e601c5ef65ce652a19b6e963e1e7413a37664b157d8d8afcca9809e1f9f4d54c61dfd46cda6eac931ebf06690c
SSDEEP 12288:eVgvEHg1Hc1LcIMy3S1dRBCm3i4xsJmExKVVhHPChxV1T37Vbu9D/k/E:0gvECzZChO
TLSH
T1AE3556A19B9E64DB0901F41BD808BE493DAF41FE3FAB975211601DBD34E10B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\sv.pak
Size 631KB
SHA256 7b0399a206bfbebe77d1a4fc598c8a6636a1bd940d3ab56519cf4af0134b6edb
MD5 d39fef87ff37175c1c8535deff59ab4a
SHA1 c6f5986a54d655149dced800f67a19d32f6aa15b
SHA512 1c8bd081a2aaecd866a1262277174a621f2ab24436df2141440efa79df3c973f02f6b74198a1baf7efbf59b58925a2a676803df6f05b4130a0daa3c5cbda169d
SSDEEP 6144:uCPEq+/Il//1VCfjdInisqkqQCJYxqxEFUlTOe+9kRRFczd5RtGmNS3210hiMSOW:T8q+/INNgy5xzLixM
TLSH
T13AD41B438A60F526FA72530DB608115F0AEDE25CE3F2954EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\sw.pak
Size 669KB
SHA256 bd41ea707a0d90d683ec8d5d0f0c79f3e925747bc4ea1982562dfb75080199b9
MD5 cc80a2829e04f124c210052045eed62a
SHA1 d51e048229b517e3f018df6a1e160ae9d1e1c4b1
SHA512 ec07236462896a7ba59d5cb49f212068f5ecdede5869a15501fc6635e399ad19c3cdb58391a286004fe2afcea60cbdeb6ac06966da4562bd6c0b12432f283b2f
SSDEEP 12288:khHZuBsIh7sKOuexGF2qjOWd9pGIbJ/BEB5WmedqU6jRdkgbyddYDhibWShgnJFA:khHZ0/SzFCiYBr
TLSH
T1ADE4D6629871E1191233618903DCFF732BDCED5C692B2D935A46BF0F218F58C56ABE48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\ta.pak
Size 1.7MB
SHA256 91fb1460711df108d8d435a378c8be1d1e80b0886c0158d8c6ae92f35812681b
MD5 7afd6d96cfe0cfca886da43d0ac33b84
SHA1 7b4f97d8a8775d1ac5ba56654c2bb075cbcea5f2
SHA512 58e944b4e889d3d7ee9f0a6c2ad636f2e2ba7d90ff0e16067db3826f26ab3f53210a94d90740bb525b5f0a397327111711e655af9fb1d65d34a41bf92bcf69bb
SSDEEP 6144:fqE4cGuBERDmPH6kHJgGPjkqwtRoKtm1vYpiMyZ:auYDmPHzgG4qetm1vYpiMyZ
TLSH
T1A0850CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\te.pak
Size 1.6MB
SHA256 fc8c2706c5dfd36e7af8e380a240e0f697cc5fe969b512092a2185896512c4af
MD5 2341fc51095d918c2c32d95d9f4fd20e
SHA1 1f0e537d5e4f0751df65bb7757b9014b544ac6be
SHA512 44db2301b1686fc878249a93d76ba7d68bf936db1f1468d253add22c6c6dc51b68d5ae0f0338e73b7588a84f06aa7be72278b968aba362924ce36cf380f7d964
SSDEEP 12288:/qSLrojq7MZKNby4cJPISF602ZLHgKmoQRT51bDC52CMzRWnB6Ic3p1Fqih7Rsrr:/qSLEuIhEced
TLSH
T1237593023A6AD310DBE60273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\th.pak
Size 1.3MB
SHA256 c1f4235c31bc05153230b0e55b7aabc9020d7460d5b0a025c386885e1e4bda3c
MD5 17455a1ecd74aba39c2244730346c97d
SHA1 f5b737951c6f2dda2299e6440650661d67cbeba1
SHA512 259dd57dc99bc055c604032c44009ee58b50f43656cedf4daf4b7d3358b63c3fc12a7789b3ab9f204eb0aac9812b43629d075ceeaefc7d2deb7de8f017749a62
SSDEEP 12288:JVdax6N9LyZYAbzALaSBs6ojhCQskJUsXw+sO5eXwpbDF1uRHKHlPijR5eysD5UC:fdvsn
TLSH
T1CA554DB37247DDD479481B5B262A7789672DAE653F73F8E000C9215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\tr.pak
Size 681KB
SHA256 3a3bc4efffaf53859a9b2d8488f2ea4862a6a082c2af68a125923cc01f69a79c
MD5 333de2977bdd3a5f0d95965dcb9e9646
SHA1 310cab5096489bc56decf8d944f587e9282ea49b
SHA512 61f475574c9a5a32c8349698bd2c72dc657d05e21bc0cd1d04607c8038031026edb5fc66e05c91b3ba10303b5fd56fd0b759af5ba9955cd1f351701e36224071
SSDEEP 12288:Ay5rzzhvT6EuSufIHl6sgwhqlyfFfgdjbeRrc4V:5rQEun7be64V
TLSH
T11FE4D88178EF281C8FB9278FD6E91666F8DF0666B331F4469A1A8636774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\uk.pak
Size 1.2MB
SHA256 ec5d0b426e289c064e8f2d63636ae2a544ff30fc1e99dde04fe1920971e4d060
MD5 aa30f21e772b4a28c564b08b21c426c7
SHA1 a7683f5c6585b050d0fc78300d2d32cd427dc8a6
SHA512 3538fec1115f9d530078824c24eb6c6b928a24337b9ac80367915c39bf21d6d4009fd339e5314b3519a242a009773b66fb32bbab0e230156f4cbe561e131ef81
SSDEEP 12288:URMFZOHsZdpk2ub+QKjbzI9wkfWd8SihGx2sSr+amnMtBps7Q1Bq3gKINnsoA6QQ:/7OMZd3xp8Dqux
TLSH
T10D45A9A19BAD54DF0105F05BE94C7A0D7DA740FE7FA6871625A43DBF28F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\ur.pak
Size 1023KB
SHA256 c218e21744df2ff0669a87d497d65d76333073577360d4c662c592de146bf82a
MD5 37e3f75291ad8763ab34dd68aa05ba05
SHA1 e0c952ecfcf67cddf9b39eac7dff3bc7a6bb4508
SHA512 38b0eee7af8e0b6e4d2f92417a1ce84ba056fd5257f907aa8f4dcb2755023e8b46ae89257b6074ea14dd234aa85afdb8c0eb18667491bff294a1d5aeb9e95144
SSDEEP 12288:9QKK9e0uiT58PPPK8VSzqtdQSSidbyKFil2iOETcE88GYOa9NQYrjEYjwadcJKwN:9hg9G3b
TLSH
T13E2500D2A6BC96B35A21D92780D33C34CB735F13D34AF285E92246C54E9A0135F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\vi.pak
Size 810KB
SHA256 b3171c4c3c1b7803c606eee280456b380d57984745f6719afeb8d95591071c25
MD5 4c87a296ccde7e552b56e3bfd46e98fd
SHA1 a26794d846beaafb55541dd993ba624af423d851
SHA512 09c6491a7e942c597b88bb8c6ab45366c0c89a8c1c23e1f2d68262b4e1b1fb8ee5feaa700b546dc4531f0f93f20be5a96a2d80f130e9a12a37348057f32d4899
SSDEEP 24576:+YZK9+cBAV2vdMkTxEEwwe8lJ4NiOG2oq1ljV6:aMNiST1ljE
TLSH
T18E05951216E1702680AC553EC6CD540D6FCEE42FF7C0CFE56FE429746A221A46F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\zh-CN.pak
Size 578KB
SHA256 66c3984c1345b5aba722005458b9cc0af54496260ad06f2509c7afa011d4981f
MD5 501ac93d802646f7ebb23987f0f7c036
SHA1 3f3c77f9c43197c032f913218a3b1373e56592d3
SHA512 150b2959fd675c97075713af499bf971e91e1a0609997475203f1122f02c48fe69b1882a6c782c2d19c7c1b036f8e0441c3c6eca709ffa62509a70eafab1849a
SSDEEP 12288:cnPkrd3cxd0HMaOIOUzQiXlUfj26wYeDMEbjT:0krcd0HMaOIOUz1Xlyj26wYeDMEvT
TLSH
T15FC47CE914F9BDEC004A90A03729A13D7C40764BF627EF266ED248ED2A91F9D0757E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\locales\zh-TW.pak
Size 570KB
SHA256 45f34b57f5b54ba521561d4f818e650430114a713de36b72603b880db939ad37
MD5 6f51a87aff5216afa415a1feadb17719
SHA1 0a27de4a85b69fcf6e4f2482cef6047fc160ac1f
SHA512 33d7b89703b8808eb0a5a2fcb6ace23621c4aa33e05a171c7814f02f490e9d7d36c1f657b5ad4444814e146e6f8c277bdeda66b005e725d610aa04e27928f693
SSDEEP 6144:rb52VFaWfHB/OT+lAPElPJxgaB22IuGpu51zOLHHDWqYi4C9aUmm1OPnTs:rbQVFxmTU5gYepu5dOLH/1b
TLSH
T1B5C46CBA1CFBDBEE0901F484B7C9923EBC8B386DDD337636FC851C942D69A5809A1145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\resources.pak
Size 11.9MB
SHA256 9611f9a65a37eea7d7f631eba0ed2cc49205f47aaa8a2937694ca2de2d821bd8
MD5 833e5095756c9adfd7b0448db0bab21b
SHA1 0517ac1f2294885172054feff643f31dc1288fe2
SHA512 952c59cc681c141292656918bf07eb13f019dcd716cacbbe90b55533e46cca084b158e47ae07f17ed923626ce11dc486097a907788b98e24a4c4072e2ba5514c
SSDEEP 196608:PRR3ZeqsPzZOgYimq8oR/5e7sbaQSX2CeVh2uDK3Q12OmsE5OkrFAceC/Zh2tX3L:PLZelLgg9mno8sbV02CM8fOkrFJeCD2N
TLSH
T109C633983764286FDE2123F3822D1237DA69DD0B156550E30EAC3058DEB396C9FDE939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-update.yml

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\resources\app-update.yml
Size 122B
SHA256 05cf5d7ac07943a98d4df5d7b0a9cad5312f9050f00f05a3eeb7d2bfef9e8719
MD5 e84b0f9e9aa7bb2c34cdfcc0c056c469
SHA1 cbc0e14f2a6554569e35b5de5c5b889c0e5d70c6
SHA512 8e69a1d261f0e8a22bd43a7b58f813519ff02989ca655237d9a666e2212ba2e59ed231fc38e9044bcec812848316da08dded8723672af0fc96624554ba400779
TLSH
T18BB092B9A143D96844710979BC2C59B6009C8488D73A87B8C2B602ACA04F8381C861ED
MD5 SHA1 SHA512 TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\resources\app.asar
Size 3.5MB
SHA256 ecba849750d3cc830c8ed96ea260de95a0c0923bb8a8959e7e70216eaaa7918d
MD5 cd0b7da4519b691959e1df4feba0debd
SHA1 17889f037faaeaf05f92b5c6f81936e3ee6cfabc
SHA512 e499243f9a50bce19d9a09f7e6eb6dc88989f5fd563267eac404355f828e659055e3902b701b7a73e108bfb439275c0f2692617a962d46a5be823e0dbd378970
SSDEEP 49152:xvMZIlnhbYE7IgsiUVUuIEkG2nMo76NI8QFThgw1nehIkGrkrDyk:flnhTUjIb8rD5
TLSH
T11A063B4525F6A0361A53A2F6198F4016FB35900B2909D954B88CD340BF91F39E6FFFEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\resources\app.asar.unpacked\node_modules\steamworks.js\LICENSE
Size 1KB
SHA256 11b6ba47ff9ad2792cab88d2934b0cc04133807494a45586561493353bab6b92
MD5 e17d1ac930271959f9063ed566955da4
SHA1 c9d7810a2bfeda4d203e098265c6b271f3edaf2e
SHA512 2c2f2bdddab19183f1d84c2a152285154568851f167e7eea77625540061e828c3c0fd7aeac88197c5cb19d58cbb0036315654f51374c218b4ed501b38f1528ab
TLSH
T14911865E73500B76189B23A055786CD5B23BB15B7A5F2A84146DF345232A06CC5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

steam_api64.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\resources\app.asar.unpacked\node_modules\steamworks.js\dist\win64\steam_api64.dll
Size 293KB
SHA256 1add7f151fa644870a735ae86e68d1f019f296130d8e7c0a7ed3ecc7482dccbc
MD5 240d8c3d2988d66d1329d38a92525bf4
SHA1 20e6879434cb715e59eed7d4dd8c2cd749ac10e0
SHA512 f602c0838e8deb32b440d857489e8d25f6c9f25e9ea50bf3fbf269e10f36b9cd0e67715ed596732361b24592e5c841917262a4c508ad762ae4bba77ec1386bd8
SSDEEP 6144:KT91MKEQSBTYn5kH3nu7c4DylO2CuixbGU:KT91MKEnM2Mys2CBhGU
TLSH
T1E254493AA2710CF4E176C1798C565E0FF672344B27219EFF226053368E536D21A7BBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamworksjs.win32-x64-msvc.node

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\resources\app.asar.unpacked\node_modules\steamworks.js\dist\win64\steamworksjs.win32-x64-msvc.node
Size 1.7MB
SHA256 1042713f701ace880260e5dcc90cf9a85dfe0ee1768140f650d3268ef8985f17
MD5 bf89a641055c302fb5aeb2ea8479df58
SHA1 72e0ae07573db4734ef94164d71d9c1073990530
SHA512 9efcbe1d4ef7ea5654526a8eb497fd2d7527d91f4d67b15fd5561d32eaa129125688dcc319d860ae263e093da185a302039d7b835a7997c6d58bb5143136059d
SSDEEP 24576:B728mslkT/dSlzTdM5qcKL6TOvxWpVJNPq:928mgkjdSlzZM5qcY6sxEv
TLSH
T16585F7257A5A986DC45AC4B083974A666A3170CF0F39B9FF45C886783F79BF02B3C254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\resources\app.asar.unpacked\node_modules\steamworks.js\index.js
Size 2KB
SHA256 564ccc2d04cd0238bddc3d00a6360d293ce1be2488c1a95d69e115a0da606f1f
MD5 d0576435e810b1a8b39c97c9949f2873
SHA1 03585a35f3376e38e3f544c687627244213ec833
SHA512 ce5d93855b8778cbbb12111efedd86d6ae5f446eb1d94c663fd769522d31f7387653a68ea0da45a30e141d0e7b37d65ee0965347f49479f51e2f17f789801aaf
TLSH
T1A851656557FA32324FAA92EA80CD414FA1B88023154D5994740D57DC2FDD5B213E8FCE
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\resources\app.asar.unpacked\node_modules\steamworks.js\package.json
Size 741B
SHA256 d09fb8cc0ca44764beb90b114c3de3e117522c767d9211253464257ef7ad0e01
MD5 5a5278d7302672aba3fb70758d0045a9
SHA1 b323c53ddde3dfb93e2977aa19c6985547736f92
SHA512 9af735df3574828c129a3dc4a139da2d83501044981e737fa0d0d233b0b773648b1f533b6a6f3c03b03e978e9c3ed410d267ee87305e23d014d516aa50922d81
TLSH
T1E601D665D6685D231AC8A9D0C8BE1B47A6620C4B5C187C2933DE013C8FEE25F25FD6AD
MD5 SHA1 SHA512 TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\resources\presentmon\LICENSE.txt
Size 1KB
SHA256 4c949341b1893c8c6ad82f7fb4eedf622cd1fd9c22a9af8f19b2dac19d1947b6
MD5 2e2b7dda22082683dc14c60f627b5a5d
SHA1 e9845dfa423846ffc462d9ee937160bc150948c8
SHA512 64399062e221bf05b0d7fe3381dde66b07f5bc7b74cc58ff4fa2db1a202ffdd1de686be6b3838418497d16068cea29ec2026a35b8e561dc08e73c4bed28f1b9d
TLSH
T1B811821E725003A22C8B1361557D68C5B26BB24F79AF2784206DF380232A06DD1FBC44
MD5 SHA1 SHA512 TLSH

Submit Download

PresentMon-2.6.0-x64.exe

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\resources\presentmon\PresentMon-2.6.0-x64.exe
Size 957KB
SHA256 b2a706bc6ad475749e3b7e3409263aa1e6906d45bdcf993f6dbc0f660188f1af
MD5 91332f300b34191527eb52424bbb575b
SHA1 8c5518c5d5e0430e0b60613c4d5777af45eff3e0
SHA512 7310c886b698d8405002fa37790babbe9acfdcdf79e500886e803136c6e2e2efb5182da3b2f692ef6329d855388189786615c7590902c3beade9f5ac57833ef8
SSDEEP 24576:3lGIH1lRDWig0ZhLrcFh0lhSMXlMLjkK43:N7ZhZBv
TLSH
T1C4259E19A7E841EAE577C2B98E668913EA327C45073096DF03E0D6561F33AF05E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\snapshot_blob.bin
Size 360KB
SHA256 4f8015b3871ce90702be73bbe41117a6e4cc4952fc820a34602bcdf99f11f998
MD5 2770cd0e818db9a5ce38ab99ec814363
SHA1 4ceb2a58d8197b26ff61fc849e4b4661a3479f47
SHA512 c07f79072a64c6c3c757adf60ffcb88b94490c63ce924cf85d88bfac93f7f15f51e5f69ee2915f495eb17509803c92dd8820e49d93ce707ae453c69636323bb5
SSDEEP 3072:/lOt+xbRt251Ry9re/1c9aT0wcJbwsjiiiCk2W4kPdMwjZ9xkzd5RKvhRgRpi:wt+Hwd1c9ansuiq6I9kzdjTi
TLSH
T19974FC46F15AC625CCE212384EF9CED83AB4F5CDDE46C21B328047BDB4B96609F9258D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\v8_context_snapshot.bin
Size 725KB
SHA256 680a4b467361d5ad6b716c5e2eefc2546f9714465daa624b0cc753c1f72147eb
MD5 fb5d95952e89400b890a34599d902798
SHA1 4acba521344d6dd0a4e16a289c2c9662177dbbd7
SHA512 98723e055c779af1acbc3ff2bca6d18c363819a55fdcd573076094da387ce4fca2bd1e0e1ac65bece5b619782cda3ce53fa4f8f681dc61dda421622e91f855a7
SSDEEP 6144:+t+Hwv9h/OKyRfqz2W6twrYVLrgV2wXuIr2ffLkzdjTncO6vTB5lU7HqpAO1UjM6:wHWKEfqz2W6dPsKXCwlz5DHtM
TLSH
T15EF4B3B6F50B8B35CA951B3D8EEB8E4B3A74F09DEE87C10B3151577C65B96A08E4240C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 1dbac4d946220d6366fbab3d4a9497ce5d5600f66c26af3765b35242dbfa3cf6
MD5 c8cb79e118f2d0ac29f84c735fca1007
SHA1 aaf849fa315e60195806e82a6b6589712aa82418
SHA512 edaf4dc454cb3d8f679df19f49da27de69146b2df69d2dc1943bc0f092420e771fda06cf71096e836f3f6f3c17c203fa98ba1ef69044be9a0e372b49749e111c
SSDEEP 49152:F3v1Y/e+xZsCaRi2C77pGgxaOT6Pw/NLni/DkfOq4/deIIGtKm8bp36mVQ3kCzzZ:F3v1dHgGgzSwOMu
TLSH
T122464903F69681D9C06DE6798B5FA623F631F8800B2276DF56A00F192E69FE0673D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\7z-out\vulkan-1.dll
Size 917KB
SHA256 c88f5feb10dbb7e2712ea674695c54017f36a6df1787e99b4dc54d55e0fa3a46
MD5 100b68274e23b51762bf09e4737a9a3c
SHA1 d5b662d5a0357bb03214615ce90fa0da63001b90
SHA512 1f6e4b3ff47f0e81e9b98de8fa1061cd1205575bcde39e6c51456ca28041187f12155416a394f5e2cea22402051a6ded6ba1022fb271016eb188c4c99e13669a
SSDEEP 24576:qHzMfR00pJ8YRlEcGX0GoJyKqPHrKNlC1E+Dkw7+DQ6g3v0TAE7yoeHYV:czMfRbX8alio8KqTKNlC1E+Dkw7+DQ6N
TLSH
T17F156D6396948AB9D6768034DDD28A0389F174811322BACF03B41714BF5EFF46B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA290.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Zed Launcher\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Zed Launcher\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Zed Launcher\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Zed Launcher\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Zed Launcher\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferencesc13c8f39-baa0-4d11-8478-458092e69266.tmp

Path C:\Users\Admin\AppData\Roaming\Zed Launcher\Preferencesc13c8f39-baa0-4d11-8478-458092e69266.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

Zed Launcher.lnk

Path C:\Users\Admin\Desktop\Zed Launcher.lnk
Size 2KB
SHA256 54e9281a87d624c60bc227270a094c0287f8b41ccf81cf5ec15ff1782467cf9f
MD5 6e4015c02ca83012028efa754c974030
SHA1 885ec9648cb704e7d47129ee8d5aed02c64f9b2e
SHA512 120693b72ef71793529436094cd568bbea7e55ce610cb18488845531fccb5ef00dc460b6f35f112e3417ea71a5888e05becd820e8a26cc5cc7ff6b053c2bb243
TLSH
T18E411F019AD7066CE37F9BB029F625218AB6F42667150E2D8140C3134E3BB14DE48F2E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2092-77-0x0000000007660000-0x0000000007671000-memory.dmp

Download

memory/2092-76-0x00000000076E0000-0x0000000007776000-memory.dmp

Download

memory/2092-71-0x0000000005B50000-0x0000000005EAB000-memory.dmp

Download

memory/2092-73-0x00000000706C0000-0x000000007070C000-memory.dmp

Download

memory/2728-13-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-4-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-11-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-9-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-0-0x00007FFF15F2F000-0x00007FFF15F30000-memory.dmp

Download

memory/2728-609-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-1-0x0000016CB7AA0000-0x0000016CB7AC2000-memory.dmp

Download

memory/2728-2-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-3-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-10-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-5-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-6-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-7-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-8-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-20-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-21-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-19-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2728-18-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/2956-86-0x00000000706C0000-0x000000007070C000-memory.dmp

Download

memory/2956-89-0x0000000070820000-0x0000000070B7B000-memory.dmp

Download

memory/5292-56-0x0000000007790000-0x00000000077B0000-memory.dmp

Download

memory/5292-50-0x0000000006780000-0x000000000679E000-memory.dmp

Download

memory/5292-58-0x0000000008180000-0x00000000087FC000-memory.dmp

Download

memory/5292-57-0x0000000007A50000-0x0000000007AF3000-memory.dmp

Download

memory/5292-53-0x00000000706C0000-0x000000007070C000-memory.dmp

Download

memory/5292-42-0x0000000002F20000-0x0000000002F56000-memory.dmp

Download

memory/5292-43-0x0000000005D40000-0x000000000638A000-memory.dmp

Download

memory/5292-44-0x00000000058B0000-0x00000000058D2000-memory.dmp

Download

memory/5292-45-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Download

memory/5292-46-0x0000000005BC0000-0x0000000005C26000-memory.dmp

Download

memory/5292-49-0x0000000006390000-0x00000000066EB000-memory.dmp

Download

memory/5292-52-0x0000000007750000-0x0000000007786000-memory.dmp

Download

memory/5292-60-0x0000000007B70000-0x0000000007B7A000-memory.dmp

Download

memory/5292-61-0x0000000007D10000-0x0000000007D3A000-memory.dmp

Download

memory/5292-62-0x0000000007D40000-0x0000000007D64000-memory.dmp

Download

memory/5292-63-0x0000000070870000-0x0000000070BCB000-memory.dmp

Download

memory/5292-59-0x0000000007B00000-0x0000000007B1A000-memory.dmp

Download

memory/5292-51-0x00000000067B0000-0x00000000067FC000-memory.dmp

Download

memory/5916-651-0x00007FFF374F0000-0x00007FFF374F1000-memory.dmp

Download

memory/5916-650-0x00007FFF37140000-0x00007FFF37141000-memory.dmp

Download

memory/5916-707-0x00000248A2F10000-0x00000248A328C000-memory.dmp

Download