a48b37dec662f2bdf0095f3ca15787a4423225e494bdba89700eff53c33009db

Analysis

max time kernel
152s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GoLiveBypass-2.0.16.exe
Size 98.2MB
Sample261110-1lyecsdv71
SHA256 a48b37dec662f2bdf0095f3ca15787a4423225e494bdba89700eff53c33009db
MD5 bb04adc6a621daa6cfcd4cfa16672ff7
SHA1 e512d17b049214a4e97b0647341430b9f4e1654e
SHA512 3956b2923f9b9cd694083a710773ac1a468df6cb96031c2b940e100c106c657b021383a37d1f09426ab7a73b7e4fd626a0409cc561d40e20fd3c33fe1cc0eb65
SSDEEP 3145728:rk15tzGYtjwiwcFTf+grx3fJfypokUpDP0G9Th5EwSl1v0cGU7:a5tzGYtjwPcdjFh6pID8GT5hSl933
TLSH
T17A38334B13564039E7537FB21D3663A275622F909BFAB9C8642C8B8D07F9734BEC5482
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
3260	GoLiveBypass.exe
2744	GoLiveBypass.exe
5916	GoLiveBypass.exe
1304	GoLiveBypass.exe
1508	proton-confgen-2.0.16-win-x64.exe
4548	GoLiveBypass.exe

Loads dropped DLL 11 IoCs

pid	Process
1840	GoLiveBypass-2.0.16.exe
1840	GoLiveBypass-2.0.16.exe
1840	GoLiveBypass-2.0.16.exe
2744	GoLiveBypass.exe
5916	GoLiveBypass.exe
2744	GoLiveBypass.exe
2744	GoLiveBypass.exe
2744	GoLiveBypass.exe
2744	GoLiveBypass.exe
4548	GoLiveBypass.exe
4548	GoLiveBypass.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GoLiveBypass.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GoLiveBypass.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GoLiveBypass.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GoLiveBypass.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoLiveBypass-2.0.16.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoLiveBypass.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoLiveBypass.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2244	reg.exe
2920	reg.exe
4316	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1860	powershell.exe
1860	powershell.exe
1860	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4548	GoLiveBypass.exe
4548	GoLiveBypass.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1840	GoLiveBypass-2.0.16.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe
Token: SeCreatePagefilePrivilege	3260	GoLiveBypass.exe
Token: SeShutdownPrivilege	3260	GoLiveBypass.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3260	GoLiveBypass.exe
3260	GoLiveBypass.exe
3260	GoLiveBypass.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3260	GoLiveBypass.exe
3260	GoLiveBypass.exe
3260	GoLiveBypass.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 3260	1840	GoLiveBypass-2.0.16.exe	90
PID 3260 wrote to memory of 2744	3260	GoLiveBypass.exe	91
PID 3260 wrote to memory of 1304	3260	GoLiveBypass.exe	92
PID 3260 wrote to memory of 5916	3260	GoLiveBypass.exe	93
PID 3260 wrote to memory of 1860	3260	GoLiveBypass.exe	94
PID 3260 wrote to memory of 2244	3260	GoLiveBypass.exe	96
PID 3260 wrote to memory of 2920	3260	GoLiveBypass.exe	99
PID 3260 wrote to memory of 4340	3260	GoLiveBypass.exe	101
PID 3260 wrote to memory of 1508	3260	GoLiveBypass.exe	103
PID 3260 wrote to memory of 4316	3260	GoLiveBypass.exe	105
PID 3260 wrote to memory of 4548	3260	GoLiveBypass.exe	109

C:\Users\Admin\AppData\Local\Temp\GoLiveBypass-2.0.16.exe
"C:\Users\Admin\AppData\Local\Temp\GoLiveBypass-2.0.16.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\GoLiveBypass.exe
  C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\GoLiveBypass.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\GoLiveBypass.exe
    "C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\GoLiveBypass.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\golive-gui" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1928,i,4665237703284910416,12945793644806717741,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,8717349436567604650,10587945841830927707,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1924 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\GoLiveBypass.exe
    "C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\GoLiveBypass.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\golive-gui" --field-trial-handle=1928,i,4665237703284910416,12945793644806717741,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,8717349436567604650,10587945841830927707,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1960 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:1304
- - C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\GoLiveBypass.exe
    "C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\GoLiveBypass.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\golive-gui" --app-path="C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1794346760396975 --launch-time-ticks=623631873 --field-trial-handle=1928,i,4665237703284910416,12945793644806717741,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,8717349436567604650,10587945841830927707,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2520 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoAJABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAZgBsAGEAdgBvAHUAcgBzACAAPQAgAEAAKAAnAEQAaQBzAGMAbwByAGQAJwAsACcARABpAHMAYwBvAHIAZABQAFQAQgAnACwAJwBEAGkAcwBjAG8AcgBkAEMAYQBuAGEAcgB5ACcALAAnAFYAZQBzAGsAdABvAHAAJwAsACcARQBxAHUAaQBiAG8AcAAnACwAJwBMAGUAZwBjAG8AcgBkACcALAAnAFMAZQByAGUAaQBuACcAKQAKACQAcwBjAGgAZQBtAGUAcwAgAD0AIABAACgAJwBkAGkAcwBjAG8AcgBkACcALAAnAGQAaQBzAGMAbwByAGQAcAB0AGIAJwAsACcAZABpAHMAYwBvAHIAZABjAGEAbgBhAHIAeQAnACwAJwB2AGUAcwBrAHQAbwBwACcALAAnAGUAcQB1AGkAYgBvAHAAJwAsACcAbABlAGcAYwBvAHIAZAAnACwAJwBzAGUAcgBlAGkAbgAnACkACgAkAHAAcgBvAGMAZQBzAHMAUQB1AGUAcgB5ACAAPQAgACIAUwBFAEwARQBDAFQAIABOAGEAbQBlACwAIABQAHIAbwBjAGUAcwBzAEkAZAAsACAARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAIABXAEgARQBSAEUAIABOAGEAbQBlACAAPQAgACcARABpAHMAYwBvAHIAZAAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcARABpAHMAYwBvAHIAZABQAFQAQgAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcARABpAHMAYwBvAHIAZABDAGEAbgBhAHIAeQAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcAVgBlAHMAawB0AG8AcAAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcARQBxAHUAaQBiAG8AcAAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcATABlAGcAYwBvAHIAZAAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcAUwBlAHIAZQBpAG4ALgBlAHgAZQAnACIACgAKACMAIABUAGgAZQAgADYANQB0AGgAIABtAGEAdABjAGgAaQBuAGcAIABwAHIAbwBjAGUAcwBzACAAaQBzACAAYQAgAHMAZQBuAHQAaQBuAGUAbAA6ACAAZQBtAGkAdAAgAGEAdAAgAG0AbwBzAHQAIAA2ADQAIAByAG8AdwBzACAAYgB1AHQAIAByAGUAcABvAHIAdAAgAHQAcgB1AG4AYwBhAHQAaQBvAG4ALgAKACQAcAByAG8AYwBlAHMAcwBSAG8AdwBzACAAPQAgAEAAKAApAAoAJABwAHIAbwBjAGUAcwBzAFMAdABhAHQAdQBzACAAPQAgACcAbwBrACcACgAkAHAAcgBvAGMAZQBzAHMARQByAHIAbwByACAAPQAgACQAbgB1AGwAbAAKACQAcAByAG8AYwBlAHMAcwBUAHIAdQBuAGMAYQB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAHQAcgB5ACAAewAKACAAIAAjACAAWwB3AG0AaQBzAGUAYQByAGMAaABlAHIAXQAgACgAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0ACkAIABlAHYAaQB0AGEAIABpAG0AcABvAHIAdABhAHIAIABvACAAbQBvAGQAdQBsAG8AIABDAGkAbQBDAG0AZABsAGUAdABzACwAIABxAHUAZQAgAHMAbwB6AGkAbgBoAG8AIABjAHUAcwB0AGEAIABjAGUAbgB0AGUAbgBhAHMAIABkAGUAIABtAHMALgAKACAAIAAkAHAAcgBvAGMAZQBzAHMATQBhAHQAYwBoAGUAcwAgAD0AIABAACgAKABbAHcAbQBpAHMAZQBhAHIAYwBoAGUAcgBdACQAcAByAG8AYwBlAHMAcwBRAHUAZQByAHkAKQAuAEcAZQB0ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AAoAIAAgACAAIAAkAHAAcgBvAGMAZQBzAHMAUABhAHQAaAAgAD0AIAAkAG4AdQBsAGwACgAgACAAIAAgAGkAZgAgACgAJABfAFsAJwBFAHgAZQBjAHUAdABhAGIAbABlAFAAYQB0AGgAJwBdACkAIAB7ACAAJABwAHIAbwBjAGUAcwBzAFAAYQB0AGgAIAA9ACAAWwBzAHQAcgBpAG4AZwBdACQAXwBbACcARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACcAXQAgAH0ACgAgACAAIAAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgACAAIAAgACAAbgBhAG0AZQAgAD0AIABbAHMAdAByAGkAbgBnAF0AJABfAFsAJwBOAGEAbQBlACcAXQAKACAAIAAgACAAIAAgAHAAaQBkACAAPQAgAFsAaQBuAHQAXQAkAF8AWwAnAFAAcgBvAGMAZQBzAHMASQBkACcAXQAKACAAIAAgACAAIAAgAHAAYQB0AGgAIAA9ACAAJABwAHIAbwBjAGUAcwBzAFAAYQB0AGgACgAgACAAIAAgAH0ACgAgACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA2ADUAKQAKACAAIABpAGYAIAAoACQAcAByAG8AYwBlAHMAcwBNAGEAdABjAGgAZQBzAC4AQwBvAHUAbgB0ACAALQBnAHQAIAA2ADQAKQAgAHsAIAAkAHAAcgBvAGMAZQBzAHMAVAByAHUAbgBjAGEAdABlAGQAIAA9ACAAJAB0AHIAdQBlACAAfQAKACAAIAAkAHAAcgBvAGMAZQBzAHMAUgBvAHcAcwAgAD0AIABAACgAJABwAHIAbwBjAGUAcwBzAE0AYQB0AGMAaABlAHMAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANgA0ACkACgAgACAAaQBmACAAKAAkAHAAcgBvAGMAZQBzAHMAUgBvAHcAcwAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAAgAC0AYQBuAGQAIAAhACQAcAByAG8AYwBlAHMAcwBUAHIAdQBuAGMAYQB0AGUAZAApACAAewAgACQAcAByAG8AYwBlAHMAcwBTAHQAYQB0AHUAcwAgAD0AIAAnAGUAbQBwAHQAeQAnACAAfQAKACAAIABlAGwAcwBlAGkAZgAgACgAJABwAHIAbwBjAGUAcwBzAFQAcgB1AG4AYwBhAHQAZQBkACkAIAB7ACAAJABwAHIAbwBjAGUAcwBzAFMAdABhAHQAdQBzACAAPQAgACcAcABhAHIAdABpAGEAbAAnACAAfQAKAH0AIABjAGEAdABjAGgAIAB7AAoAIAAgACQAcAByAG8AYwBlAHMAcwBTAHQAYQB0AHUAcwAgAD0AIAAnAGUAcgByAG8AcgAnAAoAIAAgACQAcAByAG8AYwBlAHMAcwBFAHIAcgBvAHIAIAA9ACAAJwBDAEkATQBfAFUATgBBAFYAQQBJAEwAQQBCAEwARQAnAAoAfQAKACQAcAByAG8AYwBlAHMAcwBCAGwAbwBjAGsAIAA9ACAAWwBvAHIAZABlAHIAZQBkAF0AQAB7AAoAIAAgAHMAdABhAHQAdQBzACAAPQAgACQAcAByAG8AYwBlAHMAcwBTAHQAYQB0AHUAcwAKACAAIAByAG8AdwBzACAAPQAgAEAAKAAkAHAAcgBvAGMAZQBzAHMAUgBvAHcAcwApAAoAIAAgAHQAcgB1AG4AYwBhAHQAZQBkACAAPQAgAFsAYgBvAG8AbABdACQAcAByAG8AYwBlAHMAcwBUAHIAdQBuAGMAYQB0AGUAZAAKAH0ACgBpAGYAIAAoACQAcAByAG8AYwBlAHMAcwBFAHIAcgBvAHIAKQAgAHsAIAAkAHAAcgBvAGMAZQBzAHMAQgBsAG8AYwBrAFsAJwBlAHIAcgBvAHIAQwBvAGQAZQAnAF0AIAA9ACAAJABwAHIAbwBjAGUAcwBzAEUAcgByAG8AcgAgAH0ACgAKACMAIABSAGUAZwBpAHMAdAByAG8AIAB2AGkAYQAgAC4ATgBFAFQAOgAgAG8AIABwAHIAbwB2AGkAZABlAHIAIABkAG8AIABQAG8AdwBlAHIAUwBoAGUAbABsACAAYwB1AHMAdABhACAAZABlAHoAZQBuAGEAcwAgAGQAZQAgAG0AcwAgAHAAbwByACAAYwBoAGEAdgBlACAAZQAgAGEAIAB2AGEAcgByAGUAZAB1AHIAYQAKACMAIABsAGUAIABhAHQAZQAgADMAOAA0ACAAYwBoAGEAdgBlAHMAIABkAGUAIABVAG4AaQBuAHMAdABhAGwAbAAuACAAUgBlAGcAaQBzAHQAcgB5AEsAZQB5ACAAbABlACAAYQAgAG0AZQBzAG0AYQAgAGMAaABhAHYAZQAgAGUAbQAgAG0AaQBjAHIAbwBzAHMAZQBnAHUAbgBkAG8AcwAuAAoAJAByAGUAZwBpAHMAdAByAHkAUgBvAHcAcwAgAD0AIABAACgAKQAKACQAcgBlAGcAaQBzAHQAcgB5AEUAcgByAG8AcgBzACAAPQAgADAACgAkAHIAZQBnAGkAcwB0AHIAeQBUAHIAdQBuAGMAYQB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKACQAaABpAHYAZQBzACAAPQAgAEAAewAgAGgAawBjAHUAIAA9ACAAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuADMAMgAuAFIAZQBnAGkAcwB0AHIAeQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAOwAgAGgAawBsAG0AIAA9ACAAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuADMAMgAuAFIAZQBnAGkAcwB0AHIAeQBdADoAOgBMAG8AYwBhAGwATQBhAGMAaABpAG4AZQA7ACAAdwBvAHcANgA0ADMAMgAgAD0AIABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVwBpAG4AMwAyAC4AUgBlAGcAaQBzAHQAcgB5AF0AOgA6AEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlACAAfQAKACQAdwBvAHcAIAA9ACAAJwBTAG8AZgB0AHcAYQByAGUAXABXAE8AVwA2ADQAMwAyAE4AbwBkAGUAXAAnAAoAJABhAHAAcABQAGEAdABoAFMAcABlAGMAcwAgAD0AIABAACgACgAgACAAQAB7AGgAaQB2AGUAPQAnAGgAawBjAHUAJwA7ACAAcgBvAG8AdAA9ACcAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAIABQAGEAdABoAHMAJwB9ACwACgAgACAAQAB7AGgAaQB2AGUAPQAnAGgAawBsAG0AJwA7ACAAcgBvAG8AdAA9ACcAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAIABQAGEAdABoAHMAJwB9ACwACgAgACAAQAB7AGgAaQB2AGUAPQAnAHcAbwB3ADYANAAzADIAJwA7ACAAcgBvAG8AdAA9ACgAJAB3AG8AdwAgACsAIAAnAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwACAAUABhAHQAaABzACcAKQB9AAoAKQAKAGYAbwByAGUAYQBjAGgAIAAoACQAcwBwAGUAYwAgAGkAbgAgACQAYQBwAHAAUABhAHQAaABTAHAAZQBjAHMAKQAgAHsACgAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABmAGwAYQB2AG8AdQByACAAaQBuACAAJABmAGwAYQB2AG8AdQByAHMAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACQAawBlAHkAIAA9ACAAJABoAGkAdgBlAHMAWwAkAHMAcABlAGMALgBoAGkAdgBlAF0ALgBPAHAAZQBuAFMAdQBiAEsAZQB5ACgAJABzAHAAZQBjAC4AcgBvAG8AdAAgACsAIAAnAFwAJwAgACsAIAAkAGYAbABhAHYAbwB1AHIAIAArACAAJwAuAGUAeABlACcAKQAKACAAIAAgACAAIAAgAGkAZgAgACgAJABrAGUAeQApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIAAkAHYAYQBsAHUAZQAgAD0AIABbAHMAdAByAGkAbgBnAF0AJABrAGUAeQAuAEcAZQB0AFYAYQBsAHUAZQAoACcAJwApACAAfQAgAGYAaQBuAGEAbABsAHkAIAB7ACAAJABrAGUAeQAuAEMAbABvAHMAZQAoACkAIAB9AAoAIAAgACAAIAAgACAAIAAgACQAcgBlAGcAaQBzAHQAcgB5AFIAbwB3AHMAIAArAD0AIABbAHAAcwBjAHUAcwB0AG8AbQBvAGIAagBlAGMAdABdAEAAewAKACAAIAAgACAAIAAgACAAIAAgACAAaABpAHYAZQAgAD0AIAAkAHMAcABlAGMALgBoAGkAdgBlAAoAIAAgACAAIAAgACAAIAAgACAAIABrAGkAbgBkACAAPQAgACcAYQBwAHAALQBwAGEAdABoAHMAJwAKACAAIAAgACAAIAAgACAAIAAgACAAdgBhAGwAdQBlACAAPQAgACQAdgBhAGwAdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIABmAGwAYQB2AG8AdQByAEgAaQBuAHQAIAA9ACAAJABmAGwAYQB2AG8AdQByAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AEUAcgByAG8AcgBzACsAKwAgAH0ACgAgACAAfQAKAH0ACgAKACQAdQByAGwAUwBwAGUAYwBzACAAPQAgAEAAKAAKACAAIABAAHsAaABpAHYAZQA9ACcAaABrAGMAdQAnADsAIAByAG8AbwB0AD0AJwBTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzACcAfQAsAAoAIAAgAEAAewBoAGkAdgBlAD0AJwBoAGsAbABtACcAOwAgAHIAbwBvAHQAPQAnAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAJwB9ACwACgAgACAAQAB7AGgAaQB2AGUAPQAnAHcAbwB3ADYANAAzADIAJwA7ACAAcgBvAG8AdAA9ACgAJAB3AG8AdwAgACsAIAAnAEMAbABhAHMAcwBlAHMAJwApAH0ACgApAAoAZgBvAHIAIAAoACQAaQBuAGQAZQB4ACAAPQAgADAAOwAgACQAaQBuAGQAZQB4ACAALQBsAHQAIAAkAHMAYwBoAGUAbQBlAHMALgBDAG8AdQBuAHQAOwAgACQAaQBuAGQAZQB4ACsAKwApACAAewAKACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAHMAcABlAGMAIABpAG4AIAAkAHUAcgBsAFMAcABlAGMAcwApACAAewAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAJABrAGUAeQAgAD0AIAAkAGgAaQB2AGUAcwBbACQAcwBwAGUAYwAuAGgAaQB2AGUAXQAuAE8AcABlAG4AUwB1AGIASwBlAHkAKAAkAHMAcABlAGMALgByAG8AbwB0ACAAKwAgACcAXAAnACAAKwAgACQAcwBjAGgAZQBtAGUAcwBbACQAaQBuAGQAZQB4AF0AIAArACAAJwBcAHMAaABlAGwAbABcAG8AcABlAG4AXABjAG8AbQBtAGEAbgBkACcAKQAKACAAIAAgACAAIAAgAGkAZgAgACgAJABrAGUAeQApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIAAkAHYAYQBsAHUAZQAgAD0AIABbAHMAdAByAGkAbgBnAF0AJABrAGUAeQAuAEcAZQB0AFYAYQBsAHUAZQAoACcAJwApACAAfQAgAGYAaQBuAGEAbABsAHkAIAB7ACAAJABrAGUAeQAuAEMAbABvAHMAZQAoACkAIAB9AAoAIAAgACAAIAAgACAAIAAgACQAcgBlAGcAaQBzAHQAcgB5AFIAbwB3AHMAIAArAD0AIABbAHAAcwBjAHUAcwB0AG8AbQBvAGIAagBlAGMAdABdAEAAewAKACAAIAAgACAAIAAgACAAIAAgACAAaABpAHYAZQAgAD0AIAAkAHMAcABlAGMALgBoAGkAdgBlAAoAIAAgACAAIAAgACAAIAAgACAAIABrAGkAbgBkACAAPQAgACcAdQByAGwALQBoAGEAbgBkAGwAZQByACcACgAgACAAIAAgACAAIAAgACAAIAAgAHYAYQBsAHUAZQAgAD0AIAAkAHYAYQBsAHUAZQAKACAAIAAgACAAIAAgACAAIAAgACAAZgBsAGEAdgBvAHUAcgBIAGkAbgB0ACAAPQAgACQAZgBsAGEAdgBvAHUAcgBzAFsAJABpAG4AZABlAHgAXQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHIAZQBnAGkAcwB0AHIAeQBFAHIAcgBvAHIAcwArACsAIAB9AAoAIAAgAH0ACgB9AAoACgAkAHUAbgBpAG4AcwB0AGEAbABsAFMAcABlAGMAcwAgAD0AIABAACgACgAgACAAQAB7AGgAaQB2AGUAPQAnAGgAawBjAHUAJwA7ACAAcgBvAG8AdAA9ACcAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAVQBuAGkAbgBzAHQAYQBsAGwAJwB9ACwACgAgACAAQAB7AGgAaQB2AGUAPQAnAGgAawBsAG0AJwA7ACAAcgBvAG8AdAA9ACcAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAVQBuAGkAbgBzAHQAYQBsAGwAJwB9ACwACgAgACAAQAB7AGgAaQB2AGUAPQAnAHcAbwB3ADYANAAzADIAJwA7ACAAcgBvAG8AdAA9ACgAJAB3AG8AdwAgACsAIAAnAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsACcAKQB9AAoAKQAKAGYAbwByAGUAYQBjAGgAIAAoACQAcwBwAGUAYwAgAGkAbgAgACQAdQBuAGkAbgBzAHQAYQBsAGwAUwBwAGUAYwBzACkAIAB7AAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJABwAGEAcgBlAG4AdAAgAD0AIAAkAGgAaQB2AGUAcwBbACQAcwBwAGUAYwAuAGgAaQB2AGUAXQAuAE8AcABlAG4AUwB1AGIASwBlAHkAKAAkAHMAcABlAGMALgByAG8AbwB0ACkACgAgACAAIAAgAGkAZgAgACgAIQAkAHAAYQByAGUAbgB0ACkAIAB7ACAAdABoAHIAbwB3ACAAJwBVAE4ASQBOAFMAVABBAEwATABfAFIATwBPAFQAXwBNAEkAUwBTAEkATgBHACcAIAB9AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAjACAAQQAgADEAMgA5AHQAaAAgAGkAdABlAG0AIABpAHMAIAByAGUAYQBkACAAbwBuAGwAeQAgAGEAcwAgAGEAIABzAGUAbgB0AGkAbgBlAGwAIABzAG8AIAB0AGgAZQAgAHAAcgBvAGMAZQBzAHMAZQBkACAAcwBlAHQAIABzAHQAYQB5AHMAIABiAG8AdQBuAGQAZQBkACAAYQB0ACAAMQAyADgALgAKACAAIAAgACAAIAAgACQAbgBhAG0AZQBzACAAPQAgAEAAKAAkAHAAYQByAGUAbgB0AC4ARwBlAHQAUwB1AGIASwBlAHkATgBhAG0AZQBzACgAKQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADIAOQApAAoAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AYQBtAGUAcwAuAEMAbwB1AG4AdAAgAC0AZwB0ACAAMQAyADgAKQAgAHsAIAAkAHIAZQBnAGkAcwB0AHIAeQBUAHIAdQBuAGMAYQB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAIAB9AAoAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABuAGEAbQBlACAAaQBuACAAQAAoACQAbgBhAG0AZQBzACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAMgA4ACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAdQBiACAAPQAgACQAcABhAHIAZQBuAHQALgBPAHAAZQBuAFMAdQBiAEsAZQB5ACgAJABuAGEAbQBlACkACgAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAIQAkAHMAdQBiACkAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAA9ACAAWwBzAHQAcgBpAG4AZwBdACQAcwB1AGIALgBHAGUAdABWAGEAbAB1AGUAKAAnAEQAaQBzAHAAbABhAHkATgBhAG0AZQAnACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACEAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG8AcgAgACQAZABpAHMAcABsAGEAeQBOAGEAbQBlACAALQBuAG8AdABtAGEAdABjAGgAIAAnACgAPwBpACkAKABEAGkAcwBjAG8AcgBkAHwAVgBlAHMAawB0AG8AcAB8AEUAcQB1AGkAYgBvAHAAfABMAGUAZwBjAG8AcgBkAHwAUwBlAHIAZQBpAG4AKQAnACkAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZABlAGYAYQB1AGwAdABWAGEAbAB1AGUAIAA9ACAAWwBzAHQAcgBpAG4AZwBdACQAcwB1AGIALgBHAGUAdABWAGEAbAB1AGUAKAAnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZABpAHMAcABsAGEAeQBJAGMAbwBuACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAHMAdQBiAC4ARwBlAHQAVgBhAGwAdQBlACgAJwBEAGkAcwBwAGwAYQB5AEkAYwBvAG4AJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AcwB0AGEAbABsAEwAbwBjAGEAdABpAG8AbgAgAD0AIABbAHMAdAByAGkAbgBnAF0AJABzAHUAYgAuAEcAZQB0AFYAYQBsAHUAZQAoACcASQBuAHMAdABhAGwAbABMAG8AYwBhAHQAaQBvAG4AJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHMAdQBiAC4AQwBsAG8AcwBlACgAKQAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACQAaABpAG4AdAAgAD0AIAAkAG4AdQBsAGwACgAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBEAGkAcwBjAG8AcgBkAFwAcwAqAEMAYQBuAGEAcgB5ACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBEAGkAcwBjAG8AcgBkAEMAYQBuAGEAcgB5ACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBEAGkAcwBjAG8AcgBkAFwAcwAqAFAAVABCACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBEAGkAcwBjAG8AcgBkAFAAVABCACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBEAGkAcwBjAG8AcgBkACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBEAGkAcwBjAG8AcgBkACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBWAGUAcwBrAHQAbwBwACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBWAGUAcwBrAHQAbwBwACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBFAHEAdQBpAGIAbwBwACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBFAHEAdQBpAGIAbwBwACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBMAGUAZwBjAG8AcgBkACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBMAGUAZwBjAG8AcgBkACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBTAGUAcgBlAGkAbgAnACkAIAB7ACAAJABoAGkAbgB0ACAAPQAgACcAUwBlAHIAZQBpAG4AJwAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACQAcgBlAGcAaQBzAHQAcgB5AFIAbwB3AHMAIAArAD0AIABbAHAAcwBjAHUAcwB0AG8AbQBvAGIAagBlAGMAdABdAEAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGgAaQB2AGUAIAA9ACAAJABzAHAAZQBjAC4AaABpAHYAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGsAaQBuAGQAIAA9ACAAJwB1AG4AaQBuAHMAdABhAGwAbAAnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdgBhAGwAdQBlACAAPQAgACQAZABlAGYAYQB1AGwAdABWAGEAbAB1AGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABmAGwAYQB2AG8AdQByAEgAaQBuAHQAIAA9ACAAJABoAGkAbgB0AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZABpAHMAcABsAGEAeQBJAGMAbwBuACAAPQAgACQAZABpAHMAcABsAGEAeQBJAGMAbwBuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBuAHMAdABhAGwAbABMAG8AYwBhAHQAaQBvAG4AIAA9ACAAJABpAG4AcwB0AGEAbABsAEwAbwBjAGEAdABpAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AEUAcgByAG8AcgBzACsAKwAgAH0ACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHAAYQByAGUAbgB0AC4AQwBsAG8AcwBlACgAKQAgAH0ACgAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHIAZQBnAGkAcwB0AHIAeQBFAHIAcgBvAHIAcwArACsAIAB9AAoAfQAKAAoAJAByAGUAZwBpAHMAdAByAHkAUwB0AGEAdAB1AHMAIAA9ACAAJwBvAGsAJwAKAGkAZgAgACgAJAByAGUAZwBpAHMAdAByAHkAUgBvAHcAcwAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAAgAC0AYQBuAGQAIAAkAHIAZQBnAGkAcwB0AHIAeQBFAHIAcgBvAHIAcwAgAC0AZwB0ACAAMAApACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AFMAdABhAHQAdQBzACAAPQAgACcAZQByAHIAbwByACcAIAB9AAoAZQBsAHMAZQBpAGYAIAAoACQAcgBlAGcAaQBzAHQAcgB5AFIAbwB3AHMALgBDAG8AdQBuAHQAIAAtAGUAcQAgADAAIAAtAGEAbgBkACAAIQAkAHIAZQBnAGkAcwB0AHIAeQBUAHIAdQBuAGMAYQB0AGUAZAApACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AFMAdABhAHQAdQBzACAAPQAgACcAZQBtAHAAdAB5ACcAIAB9AAoAZQBsAHMAZQBpAGYAIAAoACQAcgBlAGcAaQBzAHQAcgB5AEUAcgByAG8AcgBzACAALQBnAHQAIAAwACAALQBvAHIAIAAkAHIAZQBnAGkAcwB0AHIAeQBUAHIAdQBuAGMAYQB0AGUAZAApACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AFMAdABhAHQAdQBzACAAPQAgACcAcABhAHIAdABpAGEAbAAnACAAfQAKACQAcgBlAGcAaQBzAHQAcgB5AEIAbABvAGMAawAgAD0AIABbAG8AcgBkAGUAcgBlAGQAXQBAAHsACgAgACAAcwB0AGEAdAB1AHMAIAA9ACAAJAByAGUAZwBpAHMAdAByAHkAUwB0AGEAdAB1AHMACgAgACAAcgBvAHcAcwAgAD0AIABAACgAJAByAGUAZwBpAHMAdAByAHkAUgBvAHcAcwApAAoAIAAgAHQAcgB1AG4AYwBhAHQAZQBkACAAPQAgAFsAYgBvAG8AbABdACQAcgBlAGcAaQBzAHQAcgB5AFQAcgB1AG4AYwBhAHQAZQBkAAoAfQAKAGkAZgAgACgAJAByAGUAZwBpAHMAdAByAHkARQByAHIAbwByAHMAIAAtAGcAdAAgADAAIAAtAGEAbgBkACAAJAByAGUAZwBpAHMAdAByAHkAUgBvAHcAcwAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAApACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AEIAbABvAGMAawBbACcAZQByAHIAbwByAEMAbwBkAGUAJwBdACAAPQAgACcAUgBFAEcASQBTAFQAUgBZAF8AVQBOAEEAVgBBAEkATABBAEIATABFACcAIAB9AAoAZQBsAHMAZQBpAGYAIAAoACQAcgBlAGcAaQBzAHQAcgB5AEUAcgByAG8AcgBzACAALQBnAHQAIAAwACkAIAB7ACAAJAByAGUAZwBpAHMAdAByAHkAQgBsAG8AYwBrAFsAJwBlAHIAcgBvAHIAQwBvAGQAZQAnAF0AIAA9ACAAJwBSAEUARwBJAFMAVABSAFkAXwBQAEEAUgBUAEkAQQBMACcAIAB9AAoAZQBsAHMAZQBpAGYAIAAoACQAcgBlAGcAaQBzAHQAcgB5AFQAcgB1AG4AYwBhAHQAZQBkACkAIAB7ACAAJAByAGUAZwBpAHMAdAByAHkAQgBsAG8AYwBrAFsAJwBlAHIAcgBvAHIAQwBvAGQAZQAnAF0AIAA9ACAAJwBVAE4ASQBOAFMAVABBAEwATABfAEwASQBNAEkAVAAnACAAfQAKAAoAWwBwAHMAYwB1AHMAdABvAG0AbwBiAGoAZQBjAHQAXQBAAHsACgAgACAAcwBjAGgAZQBtAGEAIAA9ACAAMQAKACAAIABwAHIAbwBjAGUAcwBzACAAPQAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AJABwAHIAbwBjAGUAcwBzAEIAbABvAGMAawAKACAAIAByAGUAZwBpAHMAdAByAHkAIAA9ACAAWwBwAHMAYwB1AHMAdABvAG0AbwBiAGoAZQBjAHQAXQAkAHIAZQBnAGkAcwB0AHIAeQBCAGwAbwBjAGsACgB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA2AAoA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- - C:\Windows\system32\reg.exe
    reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    3⤵
    - Modifies registry key
    PID:2244
- - C:\Windows\system32\reg.exe
    reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    3⤵
    - Modifies registry key
    PID:2920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoAJABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAZgBsAGEAdgBvAHUAcgBzACAAPQAgAEAAKAAnAEQAaQBzAGMAbwByAGQAJwAsACcARABpAHMAYwBvAHIAZABQAFQAQgAnACwAJwBEAGkAcwBjAG8AcgBkAEMAYQBuAGEAcgB5ACcALAAnAFYAZQBzAGsAdABvAHAAJwAsACcARQBxAHUAaQBiAG8AcAAnACwAJwBMAGUAZwBjAG8AcgBkACcALAAnAFMAZQByAGUAaQBuACcAKQAKACQAcwBjAGgAZQBtAGUAcwAgAD0AIABAACgAJwBkAGkAcwBjAG8AcgBkACcALAAnAGQAaQBzAGMAbwByAGQAcAB0AGIAJwAsACcAZABpAHMAYwBvAHIAZABjAGEAbgBhAHIAeQAnACwAJwB2AGUAcwBrAHQAbwBwACcALAAnAGUAcQB1AGkAYgBvAHAAJwAsACcAbABlAGcAYwBvAHIAZAAnACwAJwBzAGUAcgBlAGkAbgAnACkACgAkAHAAcgBvAGMAZQBzAHMAUQB1AGUAcgB5ACAAPQAgACIAUwBFAEwARQBDAFQAIABOAGEAbQBlACwAIABQAHIAbwBjAGUAcwBzAEkAZAAsACAARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAIABXAEgARQBSAEUAIABOAGEAbQBlACAAPQAgACcARABpAHMAYwBvAHIAZAAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcARABpAHMAYwBvAHIAZABQAFQAQgAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcARABpAHMAYwBvAHIAZABDAGEAbgBhAHIAeQAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcAVgBlAHMAawB0AG8AcAAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcARQBxAHUAaQBiAG8AcAAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcATABlAGcAYwBvAHIAZAAuAGUAeABlACcAIABPAFIAIABOAGEAbQBlACAAPQAgACcAUwBlAHIAZQBpAG4ALgBlAHgAZQAnACIACgAKACMAIABUAGgAZQAgADYANQB0AGgAIABtAGEAdABjAGgAaQBuAGcAIABwAHIAbwBjAGUAcwBzACAAaQBzACAAYQAgAHMAZQBuAHQAaQBuAGUAbAA6ACAAZQBtAGkAdAAgAGEAdAAgAG0AbwBzAHQAIAA2ADQAIAByAG8AdwBzACAAYgB1AHQAIAByAGUAcABvAHIAdAAgAHQAcgB1AG4AYwBhAHQAaQBvAG4ALgAKACQAcAByAG8AYwBlAHMAcwBSAG8AdwBzACAAPQAgAEAAKAApAAoAJABwAHIAbwBjAGUAcwBzAFMAdABhAHQAdQBzACAAPQAgACcAbwBrACcACgAkAHAAcgBvAGMAZQBzAHMARQByAHIAbwByACAAPQAgACQAbgB1AGwAbAAKACQAcAByAG8AYwBlAHMAcwBUAHIAdQBuAGMAYQB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAHQAcgB5ACAAewAKACAAIAAjACAAWwB3AG0AaQBzAGUAYQByAGMAaABlAHIAXQAgACgAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0ACkAIABlAHYAaQB0AGEAIABpAG0AcABvAHIAdABhAHIAIABvACAAbQBvAGQAdQBsAG8AIABDAGkAbQBDAG0AZABsAGUAdABzACwAIABxAHUAZQAgAHMAbwB6AGkAbgBoAG8AIABjAHUAcwB0AGEAIABjAGUAbgB0AGUAbgBhAHMAIABkAGUAIABtAHMALgAKACAAIAAkAHAAcgBvAGMAZQBzAHMATQBhAHQAYwBoAGUAcwAgAD0AIABAACgAKABbAHcAbQBpAHMAZQBhAHIAYwBoAGUAcgBdACQAcAByAG8AYwBlAHMAcwBRAHUAZQByAHkAKQAuAEcAZQB0ACgAKQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AAoAIAAgACAAIAAkAHAAcgBvAGMAZQBzAHMAUABhAHQAaAAgAD0AIAAkAG4AdQBsAGwACgAgACAAIAAgAGkAZgAgACgAJABfAFsAJwBFAHgAZQBjAHUAdABhAGIAbABlAFAAYQB0AGgAJwBdACkAIAB7ACAAJABwAHIAbwBjAGUAcwBzAFAAYQB0AGgAIAA9ACAAWwBzAHQAcgBpAG4AZwBdACQAXwBbACcARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACcAXQAgAH0ACgAgACAAIAAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgACAAIAAgACAAbgBhAG0AZQAgAD0AIABbAHMAdAByAGkAbgBnAF0AJABfAFsAJwBOAGEAbQBlACcAXQAKACAAIAAgACAAIAAgAHAAaQBkACAAPQAgAFsAaQBuAHQAXQAkAF8AWwAnAFAAcgBvAGMAZQBzAHMASQBkACcAXQAKACAAIAAgACAAIAAgAHAAYQB0AGgAIAA9ACAAJABwAHIAbwBjAGUAcwBzAFAAYQB0AGgACgAgACAAIAAgAH0ACgAgACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA2ADUAKQAKACAAIABpAGYAIAAoACQAcAByAG8AYwBlAHMAcwBNAGEAdABjAGgAZQBzAC4AQwBvAHUAbgB0ACAALQBnAHQAIAA2ADQAKQAgAHsAIAAkAHAAcgBvAGMAZQBzAHMAVAByAHUAbgBjAGEAdABlAGQAIAA9ACAAJAB0AHIAdQBlACAAfQAKACAAIAAkAHAAcgBvAGMAZQBzAHMAUgBvAHcAcwAgAD0AIABAACgAJABwAHIAbwBjAGUAcwBzAE0AYQB0AGMAaABlAHMAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANgA0ACkACgAgACAAaQBmACAAKAAkAHAAcgBvAGMAZQBzAHMAUgBvAHcAcwAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAAgAC0AYQBuAGQAIAAhACQAcAByAG8AYwBlAHMAcwBUAHIAdQBuAGMAYQB0AGUAZAApACAAewAgACQAcAByAG8AYwBlAHMAcwBTAHQAYQB0AHUAcwAgAD0AIAAnAGUAbQBwAHQAeQAnACAAfQAKACAAIABlAGwAcwBlAGkAZgAgACgAJABwAHIAbwBjAGUAcwBzAFQAcgB1AG4AYwBhAHQAZQBkACkAIAB7ACAAJABwAHIAbwBjAGUAcwBzAFMAdABhAHQAdQBzACAAPQAgACcAcABhAHIAdABpAGEAbAAnACAAfQAKAH0AIABjAGEAdABjAGgAIAB7AAoAIAAgACQAcAByAG8AYwBlAHMAcwBTAHQAYQB0AHUAcwAgAD0AIAAnAGUAcgByAG8AcgAnAAoAIAAgACQAcAByAG8AYwBlAHMAcwBFAHIAcgBvAHIAIAA9ACAAJwBDAEkATQBfAFUATgBBAFYAQQBJAEwAQQBCAEwARQAnAAoAfQAKACQAcAByAG8AYwBlAHMAcwBCAGwAbwBjAGsAIAA9ACAAWwBvAHIAZABlAHIAZQBkAF0AQAB7AAoAIAAgAHMAdABhAHQAdQBzACAAPQAgACQAcAByAG8AYwBlAHMAcwBTAHQAYQB0AHUAcwAKACAAIAByAG8AdwBzACAAPQAgAEAAKAAkAHAAcgBvAGMAZQBzAHMAUgBvAHcAcwApAAoAIAAgAHQAcgB1AG4AYwBhAHQAZQBkACAAPQAgAFsAYgBvAG8AbABdACQAcAByAG8AYwBlAHMAcwBUAHIAdQBuAGMAYQB0AGUAZAAKAH0ACgBpAGYAIAAoACQAcAByAG8AYwBlAHMAcwBFAHIAcgBvAHIAKQAgAHsAIAAkAHAAcgBvAGMAZQBzAHMAQgBsAG8AYwBrAFsAJwBlAHIAcgBvAHIAQwBvAGQAZQAnAF0AIAA9ACAAJABwAHIAbwBjAGUAcwBzAEUAcgByAG8AcgAgAH0ACgAKACMAIABSAGUAZwBpAHMAdAByAG8AIAB2AGkAYQAgAC4ATgBFAFQAOgAgAG8AIABwAHIAbwB2AGkAZABlAHIAIABkAG8AIABQAG8AdwBlAHIAUwBoAGUAbABsACAAYwB1AHMAdABhACAAZABlAHoAZQBuAGEAcwAgAGQAZQAgAG0AcwAgAHAAbwByACAAYwBoAGEAdgBlACAAZQAgAGEAIAB2AGEAcgByAGUAZAB1AHIAYQAKACMAIABsAGUAIABhAHQAZQAgADMAOAA0ACAAYwBoAGEAdgBlAHMAIABkAGUAIABVAG4AaQBuAHMAdABhAGwAbAAuACAAUgBlAGcAaQBzAHQAcgB5AEsAZQB5ACAAbABlACAAYQAgAG0AZQBzAG0AYQAgAGMAaABhAHYAZQAgAGUAbQAgAG0AaQBjAHIAbwBzAHMAZQBnAHUAbgBkAG8AcwAuAAoAJAByAGUAZwBpAHMAdAByAHkAUgBvAHcAcwAgAD0AIABAACgAKQAKACQAcgBlAGcAaQBzAHQAcgB5AEUAcgByAG8AcgBzACAAPQAgADAACgAkAHIAZQBnAGkAcwB0AHIAeQBUAHIAdQBuAGMAYQB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKACQAaABpAHYAZQBzACAAPQAgAEAAewAgAGgAawBjAHUAIAA9ACAAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuADMAMgAuAFIAZQBnAGkAcwB0AHIAeQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAOwAgAGgAawBsAG0AIAA9ACAAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuADMAMgAuAFIAZQBnAGkAcwB0AHIAeQBdADoAOgBMAG8AYwBhAGwATQBhAGMAaABpAG4AZQA7ACAAdwBvAHcANgA0ADMAMgAgAD0AIABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVwBpAG4AMwAyAC4AUgBlAGcAaQBzAHQAcgB5AF0AOgA6AEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlACAAfQAKACQAdwBvAHcAIAA9ACAAJwBTAG8AZgB0AHcAYQByAGUAXABXAE8AVwA2ADQAMwAyAE4AbwBkAGUAXAAnAAoAJABhAHAAcABQAGEAdABoAFMAcABlAGMAcwAgAD0AIABAACgACgAgACAAQAB7AGgAaQB2AGUAPQAnAGgAawBjAHUAJwA7ACAAcgBvAG8AdAA9ACcAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAIABQAGEAdABoAHMAJwB9ACwACgAgACAAQAB7AGgAaQB2AGUAPQAnAGgAawBsAG0AJwA7ACAAcgBvAG8AdAA9ACcAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAIABQAGEAdABoAHMAJwB9ACwACgAgACAAQAB7AGgAaQB2AGUAPQAnAHcAbwB3ADYANAAzADIAJwA7ACAAcgBvAG8AdAA9ACgAJAB3AG8AdwAgACsAIAAnAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwACAAUABhAHQAaABzACcAKQB9AAoAKQAKAGYAbwByAGUAYQBjAGgAIAAoACQAcwBwAGUAYwAgAGkAbgAgACQAYQBwAHAAUABhAHQAaABTAHAAZQBjAHMAKQAgAHsACgAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABmAGwAYQB2AG8AdQByACAAaQBuACAAJABmAGwAYQB2AG8AdQByAHMAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACQAawBlAHkAIAA9ACAAJABoAGkAdgBlAHMAWwAkAHMAcABlAGMALgBoAGkAdgBlAF0ALgBPAHAAZQBuAFMAdQBiAEsAZQB5ACgAJABzAHAAZQBjAC4AcgBvAG8AdAAgACsAIAAnAFwAJwAgACsAIAAkAGYAbABhAHYAbwB1AHIAIAArACAAJwAuAGUAeABlACcAKQAKACAAIAAgACAAIAAgAGkAZgAgACgAJABrAGUAeQApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIAAkAHYAYQBsAHUAZQAgAD0AIABbAHMAdAByAGkAbgBnAF0AJABrAGUAeQAuAEcAZQB0AFYAYQBsAHUAZQAoACcAJwApACAAfQAgAGYAaQBuAGEAbABsAHkAIAB7ACAAJABrAGUAeQAuAEMAbABvAHMAZQAoACkAIAB9AAoAIAAgACAAIAAgACAAIAAgACQAcgBlAGcAaQBzAHQAcgB5AFIAbwB3AHMAIAArAD0AIABbAHAAcwBjAHUAcwB0AG8AbQBvAGIAagBlAGMAdABdAEAAewAKACAAIAAgACAAIAAgACAAIAAgACAAaABpAHYAZQAgAD0AIAAkAHMAcABlAGMALgBoAGkAdgBlAAoAIAAgACAAIAAgACAAIAAgACAAIABrAGkAbgBkACAAPQAgACcAYQBwAHAALQBwAGEAdABoAHMAJwAKACAAIAAgACAAIAAgACAAIAAgACAAdgBhAGwAdQBlACAAPQAgACQAdgBhAGwAdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIABmAGwAYQB2AG8AdQByAEgAaQBuAHQAIAA9ACAAJABmAGwAYQB2AG8AdQByAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AEUAcgByAG8AcgBzACsAKwAgAH0ACgAgACAAfQAKAH0ACgAKACQAdQByAGwAUwBwAGUAYwBzACAAPQAgAEAAKAAKACAAIABAAHsAaABpAHYAZQA9ACcAaABrAGMAdQAnADsAIAByAG8AbwB0AD0AJwBTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzACcAfQAsAAoAIAAgAEAAewBoAGkAdgBlAD0AJwBoAGsAbABtACcAOwAgAHIAbwBvAHQAPQAnAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAJwB9ACwACgAgACAAQAB7AGgAaQB2AGUAPQAnAHcAbwB3ADYANAAzADIAJwA7ACAAcgBvAG8AdAA9ACgAJAB3AG8AdwAgACsAIAAnAEMAbABhAHMAcwBlAHMAJwApAH0ACgApAAoAZgBvAHIAIAAoACQAaQBuAGQAZQB4ACAAPQAgADAAOwAgACQAaQBuAGQAZQB4ACAALQBsAHQAIAAkAHMAYwBoAGUAbQBlAHMALgBDAG8AdQBuAHQAOwAgACQAaQBuAGQAZQB4ACsAKwApACAAewAKACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAHMAcABlAGMAIABpAG4AIAAkAHUAcgBsAFMAcABlAGMAcwApACAAewAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAJABrAGUAeQAgAD0AIAAkAGgAaQB2AGUAcwBbACQAcwBwAGUAYwAuAGgAaQB2AGUAXQAuAE8AcABlAG4AUwB1AGIASwBlAHkAKAAkAHMAcABlAGMALgByAG8AbwB0ACAAKwAgACcAXAAnACAAKwAgACQAcwBjAGgAZQBtAGUAcwBbACQAaQBuAGQAZQB4AF0AIAArACAAJwBcAHMAaABlAGwAbABcAG8AcABlAG4AXABjAG8AbQBtAGEAbgBkACcAKQAKACAAIAAgACAAIAAgAGkAZgAgACgAJABrAGUAeQApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIAAkAHYAYQBsAHUAZQAgAD0AIABbAHMAdAByAGkAbgBnAF0AJABrAGUAeQAuAEcAZQB0AFYAYQBsAHUAZQAoACcAJwApACAAfQAgAGYAaQBuAGEAbABsAHkAIAB7ACAAJABrAGUAeQAuAEMAbABvAHMAZQAoACkAIAB9AAoAIAAgACAAIAAgACAAIAAgACQAcgBlAGcAaQBzAHQAcgB5AFIAbwB3AHMAIAArAD0AIABbAHAAcwBjAHUAcwB0AG8AbQBvAGIAagBlAGMAdABdAEAAewAKACAAIAAgACAAIAAgACAAIAAgACAAaABpAHYAZQAgAD0AIAAkAHMAcABlAGMALgBoAGkAdgBlAAoAIAAgACAAIAAgACAAIAAgACAAIABrAGkAbgBkACAAPQAgACcAdQByAGwALQBoAGEAbgBkAGwAZQByACcACgAgACAAIAAgACAAIAAgACAAIAAgAHYAYQBsAHUAZQAgAD0AIAAkAHYAYQBsAHUAZQAKACAAIAAgACAAIAAgACAAIAAgACAAZgBsAGEAdgBvAHUAcgBIAGkAbgB0ACAAPQAgACQAZgBsAGEAdgBvAHUAcgBzAFsAJABpAG4AZABlAHgAXQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHIAZQBnAGkAcwB0AHIAeQBFAHIAcgBvAHIAcwArACsAIAB9AAoAIAAgAH0ACgB9AAoACgAkAHUAbgBpAG4AcwB0AGEAbABsAFMAcABlAGMAcwAgAD0AIABAACgACgAgACAAQAB7AGgAaQB2AGUAPQAnAGgAawBjAHUAJwA7ACAAcgBvAG8AdAA9ACcAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAVQBuAGkAbgBzAHQAYQBsAGwAJwB9ACwACgAgACAAQAB7AGgAaQB2AGUAPQAnAGgAawBsAG0AJwA7ACAAcgBvAG8AdAA9ACcAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAVQBuAGkAbgBzAHQAYQBsAGwAJwB9ACwACgAgACAAQAB7AGgAaQB2AGUAPQAnAHcAbwB3ADYANAAzADIAJwA7ACAAcgBvAG8AdAA9ACgAJAB3AG8AdwAgACsAIAAnAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsACcAKQB9AAoAKQAKAGYAbwByAGUAYQBjAGgAIAAoACQAcwBwAGUAYwAgAGkAbgAgACQAdQBuAGkAbgBzAHQAYQBsAGwAUwBwAGUAYwBzACkAIAB7AAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJABwAGEAcgBlAG4AdAAgAD0AIAAkAGgAaQB2AGUAcwBbACQAcwBwAGUAYwAuAGgAaQB2AGUAXQAuAE8AcABlAG4AUwB1AGIASwBlAHkAKAAkAHMAcABlAGMALgByAG8AbwB0ACkACgAgACAAIAAgAGkAZgAgACgAIQAkAHAAYQByAGUAbgB0ACkAIAB7ACAAdABoAHIAbwB3ACAAJwBVAE4ASQBOAFMAVABBAEwATABfAFIATwBPAFQAXwBNAEkAUwBTAEkATgBHACcAIAB9AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAjACAAQQAgADEAMgA5AHQAaAAgAGkAdABlAG0AIABpAHMAIAByAGUAYQBkACAAbwBuAGwAeQAgAGEAcwAgAGEAIABzAGUAbgB0AGkAbgBlAGwAIABzAG8AIAB0AGgAZQAgAHAAcgBvAGMAZQBzAHMAZQBkACAAcwBlAHQAIABzAHQAYQB5AHMAIABiAG8AdQBuAGQAZQBkACAAYQB0ACAAMQAyADgALgAKACAAIAAgACAAIAAgACQAbgBhAG0AZQBzACAAPQAgAEAAKAAkAHAAYQByAGUAbgB0AC4ARwBlAHQAUwB1AGIASwBlAHkATgBhAG0AZQBzACgAKQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADIAOQApAAoAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AYQBtAGUAcwAuAEMAbwB1AG4AdAAgAC0AZwB0ACAAMQAyADgAKQAgAHsAIAAkAHIAZQBnAGkAcwB0AHIAeQBUAHIAdQBuAGMAYQB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAIAB9AAoAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABuAGEAbQBlACAAaQBuACAAQAAoACQAbgBhAG0AZQBzACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAMgA4ACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAdQBiACAAPQAgACQAcABhAHIAZQBuAHQALgBPAHAAZQBuAFMAdQBiAEsAZQB5ACgAJABuAGEAbQBlACkACgAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAIQAkAHMAdQBiACkAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAA9ACAAWwBzAHQAcgBpAG4AZwBdACQAcwB1AGIALgBHAGUAdABWAGEAbAB1AGUAKAAnAEQAaQBzAHAAbABhAHkATgBhAG0AZQAnACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACEAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG8AcgAgACQAZABpAHMAcABsAGEAeQBOAGEAbQBlACAALQBuAG8AdABtAGEAdABjAGgAIAAnACgAPwBpACkAKABEAGkAcwBjAG8AcgBkAHwAVgBlAHMAawB0AG8AcAB8AEUAcQB1AGkAYgBvAHAAfABMAGUAZwBjAG8AcgBkAHwAUwBlAHIAZQBpAG4AKQAnACkAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZABlAGYAYQB1AGwAdABWAGEAbAB1AGUAIAA9ACAAWwBzAHQAcgBpAG4AZwBdACQAcwB1AGIALgBHAGUAdABWAGEAbAB1AGUAKAAnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZABpAHMAcABsAGEAeQBJAGMAbwBuACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAHMAdQBiAC4ARwBlAHQAVgBhAGwAdQBlACgAJwBEAGkAcwBwAGwAYQB5AEkAYwBvAG4AJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AcwB0AGEAbABsAEwAbwBjAGEAdABpAG8AbgAgAD0AIABbAHMAdAByAGkAbgBnAF0AJABzAHUAYgAuAEcAZQB0AFYAYQBsAHUAZQAoACcASQBuAHMAdABhAGwAbABMAG8AYwBhAHQAaQBvAG4AJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHMAdQBiAC4AQwBsAG8AcwBlACgAKQAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACQAaABpAG4AdAAgAD0AIAAkAG4AdQBsAGwACgAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBEAGkAcwBjAG8AcgBkAFwAcwAqAEMAYQBuAGEAcgB5ACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBEAGkAcwBjAG8AcgBkAEMAYQBuAGEAcgB5ACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBEAGkAcwBjAG8AcgBkAFwAcwAqAFAAVABCACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBEAGkAcwBjAG8AcgBkAFAAVABCACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBEAGkAcwBjAG8AcgBkACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBEAGkAcwBjAG8AcgBkACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBWAGUAcwBrAHQAbwBwACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBWAGUAcwBrAHQAbwBwACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBFAHEAdQBpAGIAbwBwACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBFAHEAdQBpAGIAbwBwACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBMAGUAZwBjAG8AcgBkACcAKQAgAHsAIAAkAGgAaQBuAHQAIAA9ACAAJwBMAGUAZwBjAG8AcgBkACcAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAgACgAJABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAKAA/AGkAKQBTAGUAcgBlAGkAbgAnACkAIAB7ACAAJABoAGkAbgB0ACAAPQAgACcAUwBlAHIAZQBpAG4AJwAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACQAcgBlAGcAaQBzAHQAcgB5AFIAbwB3AHMAIAArAD0AIABbAHAAcwBjAHUAcwB0AG8AbQBvAGIAagBlAGMAdABdAEAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGgAaQB2AGUAIAA9ACAAJABzAHAAZQBjAC4AaABpAHYAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGsAaQBuAGQAIAA9ACAAJwB1AG4AaQBuAHMAdABhAGwAbAAnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdgBhAGwAdQBlACAAPQAgACQAZABlAGYAYQB1AGwAdABWAGEAbAB1AGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABmAGwAYQB2AG8AdQByAEgAaQBuAHQAIAA9ACAAJABoAGkAbgB0AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZABpAHMAcABsAGEAeQBJAGMAbwBuACAAPQAgACQAZABpAHMAcABsAGEAeQBJAGMAbwBuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBuAHMAdABhAGwAbABMAG8AYwBhAHQAaQBvAG4AIAA9ACAAJABpAG4AcwB0AGEAbABsAEwAbwBjAGEAdABpAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AEUAcgByAG8AcgBzACsAKwAgAH0ACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHAAYQByAGUAbgB0AC4AQwBsAG8AcwBlACgAKQAgAH0ACgAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHIAZQBnAGkAcwB0AHIAeQBFAHIAcgBvAHIAcwArACsAIAB9AAoAfQAKAAoAJAByAGUAZwBpAHMAdAByAHkAUwB0AGEAdAB1AHMAIAA9ACAAJwBvAGsAJwAKAGkAZgAgACgAJAByAGUAZwBpAHMAdAByAHkAUgBvAHcAcwAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAAgAC0AYQBuAGQAIAAkAHIAZQBnAGkAcwB0AHIAeQBFAHIAcgBvAHIAcwAgAC0AZwB0ACAAMAApACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AFMAdABhAHQAdQBzACAAPQAgACcAZQByAHIAbwByACcAIAB9AAoAZQBsAHMAZQBpAGYAIAAoACQAcgBlAGcAaQBzAHQAcgB5AFIAbwB3AHMALgBDAG8AdQBuAHQAIAAtAGUAcQAgADAAIAAtAGEAbgBkACAAIQAkAHIAZQBnAGkAcwB0AHIAeQBUAHIAdQBuAGMAYQB0AGUAZAApACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AFMAdABhAHQAdQBzACAAPQAgACcAZQBtAHAAdAB5ACcAIAB9AAoAZQBsAHMAZQBpAGYAIAAoACQAcgBlAGcAaQBzAHQAcgB5AEUAcgByAG8AcgBzACAALQBnAHQAIAAwACAALQBvAHIAIAAkAHIAZQBnAGkAcwB0AHIAeQBUAHIAdQBuAGMAYQB0AGUAZAApACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AFMAdABhAHQAdQBzACAAPQAgACcAcABhAHIAdABpAGEAbAAnACAAfQAKACQAcgBlAGcAaQBzAHQAcgB5AEIAbABvAGMAawAgAD0AIABbAG8AcgBkAGUAcgBlAGQAXQBAAHsACgAgACAAcwB0AGEAdAB1AHMAIAA9ACAAJAByAGUAZwBpAHMAdAByAHkAUwB0AGEAdAB1AHMACgAgACAAcgBvAHcAcwAgAD0AIABAACgAJAByAGUAZwBpAHMAdAByAHkAUgBvAHcAcwApAAoAIAAgAHQAcgB1AG4AYwBhAHQAZQBkACAAPQAgAFsAYgBvAG8AbABdACQAcgBlAGcAaQBzAHQAcgB5AFQAcgB1AG4AYwBhAHQAZQBkAAoAfQAKAGkAZgAgACgAJAByAGUAZwBpAHMAdAByAHkARQByAHIAbwByAHMAIAAtAGcAdAAgADAAIAAtAGEAbgBkACAAJAByAGUAZwBpAHMAdAByAHkAUgBvAHcAcwAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAApACAAewAgACQAcgBlAGcAaQBzAHQAcgB5AEIAbABvAGMAawBbACcAZQByAHIAbwByAEMAbwBkAGUAJwBdACAAPQAgACcAUgBFAEcASQBTAFQAUgBZAF8AVQBOAEEAVgBBAEkATABBAEIATABFACcAIAB9AAoAZQBsAHMAZQBpAGYAIAAoACQAcgBlAGcAaQBzAHQAcgB5AEUAcgByAG8AcgBzACAALQBnAHQAIAAwACkAIAB7ACAAJAByAGUAZwBpAHMAdAByAHkAQgBsAG8AYwBrAFsAJwBlAHIAcgBvAHIAQwBvAGQAZQAnAF0AIAA9ACAAJwBSAEUARwBJAFMAVABSAFkAXwBQAEEAUgBUAEkAQQBMACcAIAB9AAoAZQBsAHMAZQBpAGYAIAAoACQAcgBlAGcAaQBzAHQAcgB5AFQAcgB1AG4AYwBhAHQAZQBkACkAIAB7ACAAJAByAGUAZwBpAHMAdAByAHkAQgBsAG8AYwBrAFsAJwBlAHIAcgBvAHIAQwBvAGQAZQAnAF0AIAA9ACAAJwBVAE4ASQBOAFMAVABBAEwATABfAEwASQBNAEkAVAAnACAAfQAKAAoAWwBwAHMAYwB1AHMAdABvAG0AbwBiAGoAZQBjAHQAXQBAAHsACgAgACAAcwBjAGgAZQBtAGEAIAA9ACAAMQAKACAAIABwAHIAbwBjAGUAcwBzACAAPQAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AJABwAHIAbwBjAGUAcwBzAEIAbABvAGMAawAKACAAIAByAGUAZwBpAHMAdAByAHkAIAA9ACAAWwBwAHMAYwB1AHMAdABvAG0AbwBiAGoAZQBjAHQAXQAkAHIAZQBnAGkAcwB0AHIAeQBCAGwAbwBjAGsACgB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA2AAoA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- - C:\Users\Admin\AppData\Local\GoLiveBypass\runtime\2.0.16\proton-confgen-2.0.16-win-x64.exe
    C:\Users\Admin\AppData\Local\GoLiveBypass\runtime\2.0.16\proton-confgen-2.0.16-win-x64.exe -session-file C:\Users\Admin\AppData\Local\GoLiveBypass\proton-session.json -session-username -json
    3⤵
    - Executes dropped EXE
    PID:1508
- - C:\Windows\system32\reg.exe
    reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    3⤵
    - Modifies registry key
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\GoLiveBypass.exe
    "C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\GoLiveBypass.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\golive-gui" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAQgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1928,i,4665237703284910416,12945793644806717741,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,8717349436567604650,10587945841830927707,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3464 /prefetch:10
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gui.log

Path C:\Users\Admin\AppData\Local\GoLiveBypass\logs\gui.log
Size 4KB
SHA256 a311a0a38042204fe5b81d8db75b4a0726549a0bbd1d86b5fb62c77475225210
MD5 d4bd2b52a0f64259b0ed2979d05ca285
SHA1 13b7ef15fb3ba4a464cd712463f6d8f914e25fb1
SHA512 a18f36d33d94c37c56532b5712a69b9a242f2881c2e2c0b7b63163c4945b64564801cb2df55097586082b5e05ef7ae64d9b954bec73f1ca740c998f033a6c31f
SSDEEP 48:oJH94xbCiV/qt6r3wS61FV+qQ6r3HNecJP78L6rBrm6rZI7m6rijpvaAs6rR12I:oJd4xRT9XiZgPlI
TLSH
T1BA919613001317FFA6A20FB4E96951454B1F98EB95CF90D0989F829E8C2497A7DF1A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\GoLiveBypass\settings.json
Size 56B
SHA256 a1d1942c4e4334d950627d0eb9356257a94631eccc0f4954759bbbcb2906e936
MD5 ee91c91762ff429042b7e653fcbb756c
SHA1 0805cc39288653243690d7cfdec37400cc1a066b
SHA512 74e671833a4932991641ce2d8f3db21c48d47ce2ea1d22bdaba2e48d2dff7b5f6949b1f66902cef0a8dc1acca2aca68ace080f0603c6d921e526b2737be292b9
TLSH
T1229002F8D9485A2A00905205552D24011024848345191164B304421A9F4DE6B5028414
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4d47a40794efeb139d62fea50994ff471a3ed4d9431057f413711fa74f025b54
MD5 1f063c9cce6819d556f4e1f29c6aeb26
SHA1 3e7dd85cdf8a093582438c76357b768c8c9cc8bf
SHA512 4cb4d69d58b30eeee6a05a7211fbe3a8b984cfc6c3646019e91af29cc03ad92b53a4433d4eb74bb619d874560760758cd9a3bdc8fb3ba0336ca442ea4360d864
TLSH
T108319B63B3CC869EC84A503A55CA9D10327A86FBC0DEDE97BB94C504B46B688DE54164
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\LICENSES.chromium.html
Size 19.4MB
SHA256 b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd
MD5 c8e8384bda055e42bcdc54cda98574ba
SHA1 eb7da46ad66f356437b4e7a41be3b41c52396f11
SHA512 c3fb288e7d25dbe61b132c81811d6d3d4deaf1ef227f1c9d8e56063c55e7204be57899f84492ad554553f21ad8642f27301e3ea12a8298247cf6dbb0a5c312f7
SSDEEP 49152:rP2/kdNTzeM75TYp2tzwC0/J3r8xsJQnFTCa7id+Ui4WMEAcA3:q
TLSH
T18627B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\chrome_100_percent.pak
Size 117KB
SHA256 d76fe8fa3a14cd73e4c858746e2ab2d2fa6f2df38a906fa5814b50a8a895fc96
MD5 37c48e66c39832d32fa2e926ac503c4a
SHA1 2400135b49193c9786f1faa8d00169ce3d38ca98
SHA512 e1b631c3834fb84e96ab9fe44b12a8fa6c6b3c767e00a17ed8c3d8f8fbe7bc2dfe83fe33e7aca4f32439bdbad21d25af6b9e263d412922e40d09d4e421f12941
SSDEEP 3072:Kw4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:UYWFUbGz8LI1TdjQBQCrC
TLSH
T19AC3E0E773B0AD7DCA464BB743560070FCB30B2D06C2170A4A9AE479652AF98D9D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\chrome_200_percent.pak
Size 192KB
SHA256 b74ad439f3d3762657f3ba533a6af3ac63315c838ed46519891366f43d834a0e
MD5 e6a75313c720a6ebe3182b4e1db48328
SHA1 d60a503cf4604c816d9146d7fe4041018d445888
SHA512 3c8699b998c53c0414933ba18e0cf561488b9e209523a9b4093b68d38393e9a6bc683cdffc32a8050be25b473153b71743acf9c33f070166f1e15f2a453e8eb4
SSDEEP 3072:+FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:+IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1D01401D723B4AD3DDA530BB3A26710E0FD7A20291EB3514A569FD8397925E88C9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\dxcompiler.dll
Size 24.4MB
SHA256 058d8cb8b821e390830b3e1b0bf2d9107789cc5dde24dfb4f873ddac2c389904
MD5 f8cb4fb7957eceeaaad55e5690a7b928
SHA1 e6ec2a75310d75817eb077d8c35969eb8249fe18
SHA512 ea2245f6b1a29e5dc7431c928aa03d8e9f2e56f9cc399fd9f13a81dffbe61beb5e8bee98ebb9542431a14fa4cbe36520cee2e910b3fdc5786e7ccc6ad65c2c5c
SSDEEP 393216:YIMjdwv9XK+t9FjJmBIA59jWw9AeNes5C:msmPrjVAeJC
TLSH
T19B4729122646D49DC099C879C7678B268A2C30E73F67B8DFC0B461252B79EFC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\ffmpeg.dll
Size 2.9MB
SHA256 31f21b81d743dcd2dc16190b246854e6b86211d2dc2f26b84b96e02dfa43d798
MD5 ea95fdd2f3953bfa10b1a6fba5481fc2
SHA1 98e830a6fc5b3a488d863714b45a75e87c236945
SHA512 70636ee4b31dee4ea9ca2cc4b0001afb6822e54955af6e64aebeb6ff6276c328416d2be1bce60b93bc2d29f2991ead9b04c4319e67dca7941fa59b24e2068b99
SSDEEP 49152:+iL+sa87V2L4I1KZIBASdzKKtBr4ZjBnx1y9J03U1aLuoqH//kgpM2Ca:ZS87VQ1KZcrXvaLubXbC
TLSH
T106E5AD02F6D251EDD019C03497AFA213F271780A4F206AEF17A05A253F66FD86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\libEGL.dll
Size 457KB
SHA256 5e095f229d38c57c2f171f38b4a3ce0f7bed03ad2d9e1e99d674ddce85b9f968
MD5 5add6db184777f6dc2baa49252af56ff
SHA1 73f746d9c9ef3913691660185948a8ef4be9c06e
SHA512 bff061bb606100df5f6aaf16e5c243b338ab5eee1563d97062ea120be8c4c87e0196b96a5528436afc70e68404c520ec2cd92d04d1d9a611ea3857d397988fbd
SSDEEP 6144:bfpQGi1aKmiB0qowlUdpCB+cdOYP7tWJcUuxVJlfzUIB5:bfp8aKCqYdpCB+cdOMtW3uxVJZ
TLSH
T1D6A47D15B3E549B9E07AC138CA538642EB72B4560B61F6DF02A0D2792F77BF45A3D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\libGLESv2.dll
Size 7.7MB
SHA256 5f87edeb72ad594c757e5594407ebf63c42ea1b2fc6c64452e971fc87e1a3943
MD5 f936784468a0942a8200ad0ece70a565
SHA1 58ff189e27b76c1c6bb6f1d62824d7222a4c888c
SHA512 a7cf3008e0b8e5d799eaa0eb71a7ca6b6cb84bf43bca0806d5c570d5f4e190338c240433c7c8ff8300fdbdc6b26202a270196b23a302d6c64ac5784629fecc43
SSDEEP 49152:B1TVz10trpBhcQOATyMIQmKMyxbt7o5erb54eyliLrjO+V/4+P6oRD+50nsbKgAV:B1hghLtRv7bHsbK7C/Kf1VJJi
TLSH
T1B4867C03F69681D9C05DD2788B67A223FB74B4450724F2CF2AA457152F6AFE0AB3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\af.pak
Size 599KB
SHA256 dcf39c3edbb6b0a625baee0263a9b426eadd1a6d1bfbf03a209501a18bc4b0e4
MD5 f351564453e36318d0442e29db7bd5c2
SHA1 d8dbe32c5656468b4f96a799dc7de3bab37b41e2
SHA512 07050f6b0c484d07b345200fdc6d2394201d3d1befa7310d15decfa2e67ed27724c53da2175148588f27822f28b31dff75e44b99658c141392e08a7d8be82789
SSDEEP 12288:ayyCh2E1FPQ6tRGtAM9q+ZRwBgNYChF+plGnVbi4H2JynDNsmpiALjKrFozv2nIX:nmyPftRGtAM9PZRwBgNYChF+plibi4HV
TLSH
T112D40A0BEB81173D09A06697FB0845B7FB5D626CD770B2BADDA982310966DFC10BD0D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\am.pak
Size 971KB
SHA256 b1d444f2346105a6e15f9b14fc5653e1edaa2b435290fb8f1238347a4d4ca8f9
MD5 79fad5635b13538c17b92b87df28ac9e
SHA1 81e142d7dd601f69d2f9b8c63b998adc926e8286
SHA512 3158dd5daaf08933549694bf952ebcc14c3db91afc2fac3a942b8d1d30892ab57e4dce966dbaa7dc323c2deca1f1145e7517be25020b48a2ea9bf7f7de5575d2
SSDEEP 24576:LtXGVoTx1A5t7hTCKPyaEVxsxHjnwvxehz/dIXV6sciy4VdeZtP9oPYOH+:LBGVr
TLSH
T13225AA547EF9F7570F8E8A1994320E4E9594AE4652802C38C35AE3FC2B2DF1B4DDE219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\ar.pak
Size 1.0MB
SHA256 74bc5cd1c0a5957aa41d719a40f4975ee71023ab6e144660308092d32c86c055
MD5 c9407f70fe89b63d9e2fbcd835b29c5b
SHA1 15e428a215a7d05dd67f9d627ab8ec89d5e9ddd7
SHA512 6b6485f797b2f5a1fa45d77d0860db6929a8bf7ed5a9f2adeaf5434a44b00d0b2d3bcccbf1375caabd5e9b5e01049e0f44305fc52e26b12b49e8dc20015a1f28
SSDEEP 12288:1yWqoQec/BmdpLFB62Ga9mwj3o0oCbv4UGPFk82/S+GNj6EuDb6NP+:1KotEG
TLSH
T14F357AE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\bg.pak
Size 1.1MB
SHA256 e4a5bea23a26a06af611a7cb518b22a1d53ec5df45a6322f0e264b99c7318441
MD5 077df43e5adc6bf502d5bbf057a0afe5
SHA1 6e608c0a0f3a3e19f63840c35ffc7d8c7dd0cf47
SHA512 b1996aab50923361c352acfd92c177d53e2336656e6ee29312227e685bf3d1202336ec51c9b757752b199f2c69a4d5185a5db05a600fe5b26f145e58da4191dd
SSDEEP 24576:81oSpWclYLYAgCzQkECRUPVb6nNo7j373ZKmiv3p1K4UfVDiiJw74uOVnaJcuSMQ:5SpWclYLYAmUUPVb6nNo7j373ZKmy3pG
TLSH
T1B83525A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\bn.pak
Size 1.4MB
SHA256 137cf9cdba13ea7286584c5cac05dd34c6394f89036e367aa032ffb34f17dcc9
MD5 ab1bdd5b62d9bec69fa2bcb90ac9d584
SHA1 b0b4446c815b27688f54de71c99cb3f88cf744a9
SHA512 f68ccd81deff5a13512ba1838e925df7a59e037fd1f1d0086c2d31bd9582990f7f719f0f14f96ab18ef1a1c48077e257738e931fc84d8b820bccd590832c2e61
SSDEEP 3072:ddX4lzPWbrCCslNmU3IW32C2COUzhqygYfj8tRq+vyQZWUBbIUOQSakwi0NdZGAM:diebrmP3TeyQZWUBbswdTM
TLSH
T15A65EF209C6E81B6A8C5CDC9434C6370C123AE9B9B61F74DDC17A15938ADC7C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\ca.pak
Size 676KB
SHA256 8a472eabdc3f30d94c56367d526f6d345ad65732827097aac747438f233a536f
MD5 d9fcb1db7e6b754a8ce0fa3a6820171f
SHA1 d08d78e30eaa0ca60fb26e04726d9bd1f2116748
SHA512 37407233c0ec069de89eeef6998a1b4ce372ce8c02f79f0f246acaf63f7ef60b6c469213177f93aec9b55d86a8690691d73c74d640db48495ecdcc2f58d78a4e
SSDEEP 12288:Y5llu0PrR7IO4yCiX76gpFa8H5PsFBN3Mw2juwwPR9zejm0t3l76FTZKmXCRYJim:SXDre/yoLnl18IM0ahfilziQ
TLSH
T186E408239FC93B7704D2330EFB46C257B48CA9847A16D254F4AF1B1622CCA9CD673A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\cs.pak
Size 701KB
SHA256 5804ba5b76974b48b15922cf91c3e9dbbf549e2d88218dc767e4650520503135
MD5 c81b387a9b4a0ec57d264cecdd778028
SHA1 a5a6ed3dc60fd87e98fe421efed160faa54f0ffc
SHA512 5682eb54fe53f2eca75fc72d497bbf06241685bb5790ca67db5d2bc0351d48b0a6b977daf4c4c6a1294f1b46fd601379b579a5af1f8595cf3d3e97e38dbc262b
SSDEEP 6144:CcaDSJ8LfunUW5A1SBJAxp0zBXiZ8OvJSBsx8QJ:0DSJFUW5A1AZzBXiZ8OvJSa
TLSH
T1CDE4392EEAA36425584002487FBE4128BD5E87140B6EF5BB7CCF9C912575B7E8EF0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\da.pak
Size 629KB
SHA256 57f4637094de41122da569415c16c5524794bc90aa3af226da14703d04981db0
MD5 b041878ddd846f351b5774223e2937af
SHA1 66f577a834df7d1df2c8eb9c3b456e3fc010de27
SHA512 fefeb244924305ac331abc2a128522039fef3dfe98675e5c613831e920cf6534331e6f52cce0134b94f46d8d35d88bbebcf364a420a44e8e27bf2b24c3991367
SSDEEP 6144:VJG+clLFIr9UuFzVmo/QZ5LnhXGej9VZIE/9lxbuwlpqJwWobFwdSpI22VBqns/J:m+LKu+Vxhd2j2sejQ
TLSH
T1CAD45A4BDC9C732FC9A94729F311CDA7DB6D443CC684664F65D8943A09CBCA092BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\de.pak
Size 677KB
SHA256 6201f0c314340a272e6cd7b57e13c4e20e3bc64f053f2c6f8e98f1cf52840908
MD5 3860591c89d817ca82a24e0760102ff7
SHA1 86b06322c23c6d59272dadf96b779aa4f4ad3692
SHA512 006ed1f7ec8f5e1330919318ea45aa3738271e61f53067cd81925025453819365ed288151272782346192ddf74b1e154b9ed5bf6d425efcfde2ff59626622f9b
SSDEEP 12288:Gbuc1JL9h0U3K7UpRLgPaVhN9JOzbZ1UbyQC0O:vxU3K7UpRLgPaPN9YyC0O
TLSH
T1C5E40713ADDB625EC78673657701CDB77B19E36FC342312B88EDD02B650B5B282AC522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\el.pak
Size 1.2MB
SHA256 48d430dca8785ce24fc605851b2bb739164b8e5fb5588909329a82e58f6902d0
MD5 90151b874b0e9a258f285d0d0199193e
SHA1 8bb1278b220e9a79dcbc55780c59c33d69833e2a
SHA512 df70ce7f387864e5045d838dd36786bd01486ca02faa09e31ab02d252d576d476a465781e378e24cd4dc6719b08ef167fcd43c00b8bfe8b50de1935e99a2fb4b
SSDEEP 24576:y4FyjdSFbrxq539bk2tGZucYzJXDsS4km7dq7z2HS5gLL0CxNAAyKGyjYHvydIVM:y4FyjdSFbrxq539bk2tGZucYzJXDsS4n
TLSH
T1FA45CFEFB4582DED8046950785D8B07C2BC66D6CE749CBD86229CB60BDFC0719A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\en-GB.pak
Size 546KB
SHA256 7ec690d052afdb64188a148feb9a97f8d357d010a383dae29c07abb724cbe60b
MD5 af20834df91edd2374cb305e6d962d09
SHA1 f120f912f3c6b936e8b76cb315cffa83b63ff787
SHA512 0d6aba648c4f9dd97f1433d4eea277c85392c4a0f194e0ac287893cde7766a57bfe5077f6373bad1fbf3e6a8cb19ba1bcaa04cd33fde270f2eb72c648f63ea15
SSDEEP 6144:7STDsCYW+OsIjSj9cxhLREtHZEsf1+eMP9hhRbyfaY1BLOcyDtBcARp3:7STDP7ZsIjQcxhLEMHhRbomD9
TLSH
T133C44D1FF744126A059312A2BB0AA5A2FF23D07CB35112667CBD811C33B6766C2777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\en-US.pak
Size 552KB
SHA256 74404352908184e834397df60b238f23462e77d69ac4136b4f20af2db6191436
MD5 9ee099df7e2df2080b3525217eb4fff3
SHA1 b040c8d76ac420afc85bbd04979a6f15119e5f3f
SHA512 9c89be421dff94da03bb56662c87a6e8f0b89fade83283c54d8aab4f9556b1e7befccc8c4bb533580362db73bf428bb4304ee0e98b85025d678425cf8a26b2cf
SSDEEP 6144:/4tBJu73IiH33HfJTO6fU3h4QMP9hhbRrfaY+F38SEqjangts/3hwj:wnU73IiHHHfJMMnhbRW3j0wj
TLSH
T1E4C43D1FF744112A05A352A2BF0995A2FF32D06CA35112663CBD812C3377B66D2B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\es-419.pak
Size 667KB
SHA256 55a36991fa1e523fcdbc49e4227d66bb83d28bfdc7d08dcc659837d1beda3281
MD5 dfc615a93640edee28280f1412e0d1e4
SHA1 4ce9e50340b98fb18e7dc22ebc2bda85e4cd502a
SHA512 b7d4edb13fb92bb446fb63288e5707e98a3572b0d4d058e21154ad63125db0bcc8d03091753593617d68040a1f8bc4d4a50134930b87263a0c29e6f8a3993632
SSDEEP 6144:IkoRBgNHUrPc+NvMqILGYLEoZGG+vpOJU85AKNtIj6V:IRBVPRNvUFBUOJhAROV
TLSH
T116E40926BAC81F6310E3A348B743D757E8989545B408D29BE4EB876522CCF8CD877ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\es.pak
Size 663KB
SHA256 9ff88eabacab95f8bbef9e95f63d3619fa8d640ec03523d80abb26243b059a65
MD5 6f1b03ab2fde3f54d7126723e6b7d743
SHA1 a47453a75dc89c8bf81b4f107d9443760bb97c3c
SHA512 3f339feb0a6ab4f64d87f27cc70dc141ce5932dd8dcad5e63add0ad8189500d1cd8fb62f377b499a3fd8cb300136939d75a36a0aff2c10fa34c07a03a5ee5c5b
SSDEEP 6144:bEv1HqZz37xI8zv+1Rgoh7g1Sv+5xt7hXlNj8jLkFhJkav+fE04U6PZCMd:8J6G6vuhGf5hXbj8jY3JXvcF4sy
TLSH
T1C1E4F626AACC1F6310E39349B743D753E8D49549B408D29BE8EF866621CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\et.pak
Size 605KB
SHA256 0292298736847491828465a3dcf04cf4a0d9bd63d4b1a9d183c7eeb389343d26
MD5 46b380bce93b409a65a77f6153c4d2f4
SHA1 b282dfbfafdb06a9bd8e8812f61de84f8585ed26
SHA512 cd1993875ba18946b769fe017cf51c11904a7e9ae1ca571b441aa081def5393dbf332b872bda16666347ea7463b3bcdf549029ac98f721e4e0976db493a7218d
SSDEEP 6144:3LCqMXD5F6vw7L7e2wBzUDa+0HTwyW0unFaYX74zczkemPOTQy8gXKxV1aXtCUQK:EDe+L7eboOHTynFaYqv1adCU4qDP
TLSH
T159D43C42A27D771B242412F9E737E937DC9FD3D8B4000D9668964A1970EEF8C38B6B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\fa.pak
Size 1002KB
SHA256 7918a47631aedf01a95cbfef88d3457bfafb3f4461084ab314051d7d80309830
MD5 9cd998e1da4cff3c8840a60cb102e8ea
SHA1 2672a11e9777858d920ed908d79b891bb51d93bc
SHA512 92faed3df307db44f287c5d8c4df3d23a6db949d84fca61c6cc67428976431a31124f505f23944dfadc92ed21560fa89a17be367eddf63c210855b7af092a4ad
SSDEEP 24576:RY/lNhgd8u313uyqoz+sw2LYRmXnloThXtCfGk62Yha826JfiVQ0MX44OqlUSkkW:KGr
TLSH
T12225B1957AAC9AB15747CA0341D33838C773EF12D349FE40ACA1076609A5B139B5FA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\fi.pak
Size 617KB
SHA256 0535e2acd4517ce8099aa0a4a3e562af37ca6a699faca1de3b348b8bfacf2a8b
MD5 39b5441e5dc938273b63bd63559231c5
SHA1 63c930a716a528d39aaf7edcbae9e1b459933aa6
SHA512 d412d9faee63b196d90aaf107a7ea0ebf2533538d207b198486631e7f015cb95a1a1c32dd6257d4a6626667e6b0e04225cc7d1553bdbec291dec4939e61c5fa1
SSDEEP 12288:5UyfLb2OoU193RaQ9Xao4pL6Ifp3WamZIR/:rTb2OZp4gId
TLSH
T199D46D915215C32237C8D29EBDB0903AF5E5E3DC8C284D96E843C7D849EE9887D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\fil.pak
Size 698KB
SHA256 f9e86324deee168d160a51402588da9987646c8c5899b76b6255d7e3a46a7bb5
MD5 00fd6fe8984219392037af2396af9a32
SHA1 25f670a7c82ea0f724fbc75841732f691150367b
SHA512 e3a9216088dd6ba39461218444bad0891a81dd5b691935063749c0cc56309c42fa58fc3167810166eeb1937f2e84d29aa52e59325b506167aa7cf65043d97a5b
SSDEEP 6144:5zw/03eDcPs/XBS7ZnIehaDQ4rXSg+Rl04pdIaOvzP3YoZHA1rIYW:/3ycPMSdC5vr
TLSH
T199E4D615B3401748DBC352E96260682FAAE564BC3F81786E0FFF26977BA7CD5D270182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\fr.pak
Size 721KB
SHA256 dcd5c008c6b74000c2d95b6193059c9435b417d54e6991283e92bafcc5fbcc50
MD5 37a4fcb275bbe0029bd2ea31c5b9bb61
SHA1 4fdba052cb2b9ff5a1b0e9032358a0236e67900d
SHA512 bc01c13c66e899ffd957191479f169613c51e167d220f2ac0a75953ef28dc9cea579ef492fb2a38f57f79b9c48e36cd7646460b82969477b908e03ce3797b1e1
SSDEEP 12288:3s+ZgZL/gW84VGbcZ+jGiu06Qua6gV58hZmvTeh0/3SJYnYm8jw2wDVN1XUqCnDz:3dQl6V88C/f
TLSH
T1B5F4F76FB9D431CB19C612B7FB12D663DD348248F215E340D89F4296129A8ECC39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\gu.pak
Size 1.4MB
SHA256 34e4d54d66a0b0471542ee76c55cc9d3b27fcaf15cdf63c3d7e7b46cfdfb3f4f
MD5 5fce925a1a47c2258e4c11d22461eecd
SHA1 706fab7b309cb5cbce013b9176fcd8f8f4dd3bc1
SHA512 7335e508614a9edeedd8e851dbb2d11331d3747ae0235c566b522ebe13dc5612a52c64967c45592d7f654bda44e309a28952522ce23262875a3dc46279abdea0
SSDEEP 3072:4tsY5SqqKzsRkVkHUtvxiD7viUAA9UiPjAwREJKVMjNiT7llj63rA8lDcSi5NnW+:4tsY5RqTR0BvAviUAA90ws/h1CL1KsoK
TLSH
T1526518D0D3B9F07119DA9F7E819E512086699343D57E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\he.pak
Size 877KB
SHA256 b90f6b709886c37ac52fb8eb1e4d40931b0558b084dcda69e3e4b5ba537e23f8
MD5 1f4de6f7a6d3b3c5f2822e3f956012c3
SHA1 1d1c2ef812c3f8971307cd83aaa654fd2f51d2bd
SHA512 f71fb1ad4cd663130aed542bdff27be0d96caa5624ea4c08eeb4d37d86d8427598b0ad22f8b4f369fa587ec0f4088afc08d7d829f81266ddf40c309896a0f365
SSDEEP 12288:uaUr75TZdHh/aPAdcOT4E4xu/rwZ03nWq+/TBNgszaQArrXRQeQCajvMzf6Wa/A6:zUp96P
TLSH
T13A1599C4B2E492255131A9C39FA9FA285FF3CAB53CA27512CB14526CAC774F0BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\hi.pak
Size 1.5MB
SHA256 57432f987cd26251065245e62b9ec47c1a90bd6ab2f2c4227c3c9becca3994f6
MD5 275f892c9505e31011bd8dad9d362354
SHA1 b9b85f38709ce9aff24743e26f218ea70d429fd9
SHA512 0cc81497ea07ea1f144ff13c1fd3f703367a5ac262dfd82dfadbec92abfcf0f6021df968031ef8f8737f5fa61be8bc6adeab91924e277db637f2235831037a0f
SSDEEP 3072:cfjn1vOt8UJEtcZKUv2Vl8zPJd2lJYR6V5NV/B90ZV1dhuBlOvXoCDtDWepenPs5:Aj1mt8UJICOVKVdCQ6e3g46SdE3W
TLSH
T1F965040CEBBEF3B55DEC3C8A32890D37D59D3674A3E5521348D5B3DB9844CB8146A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\hr.pak
Size 674KB
SHA256 9ef77921560c91e5d6e42df6504589b8b7efb84c9b5119ac51e9a10d8c83a089
MD5 250eeb9dc43c98511b01deee4f6e6a2f
SHA1 78128ecb1848c8a8279167c265c86f3e31d98f9b
SHA512 1c87ad70caca770deaf1ddecf1a74679b79634295606fadda463d7f1e23ad586032c28bfaf497eea55582e3d00de2edb333038312a7432eb88ea5b5b117831ef
SSDEEP 6144:56FHwc6hxI/g2+iLkbMr+EnpXVOWuynptu:5oKIo2x/t7O30u
TLSH
T141E42B7DBEF3570A0897B24AEFAA43547DBE08DCE56497B7684F522E0003F4C6AB4149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\hu.pak
Size 721KB
SHA256 31e407f43bbd0cd0692755f961bb39d10af1f9f0af205455dd70fb4c7eeb85a5
MD5 adb5a8e932893ea20a9551c2bd0acfad
SHA1 19cdb783a41fe80c4590eaca5b5bec2254fc2e88
SHA512 5b0771c622b64841a8ceadb04268056f1e90d69cbf68133fc07d8d073a36eacf1637b64347905789876ac858e1ce44cdef8411fa5b3cefc858b520c45bc3ee31
SSDEEP 6144:c3bE8BltK0jrT6jUJHORxGXlH2N0l/gxAPIpau185n85Z49KadYhNTPLsMKc/beW:oEuD9WAo85n83PPOVrWb
TLSH
T157F44BB79376944ABC6C179778643F16592E481BAB2B31F72883846D34A178D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\id.pak
Size 598KB
SHA256 e7957c9c58f890b5d053ea50c5fcb4b66cbc3c47478c42a5962810cb15814249
MD5 17e78911ece04f7367d310e0336a1e7d
SHA1 bbdb669cdfba585744ba14927b2e92d7d4973d85
SHA512 9bc86d34dbab4b0b7990aad19c79704cb0192da5a85d190c9b9355c45d5189c8557895c0bdce2cf87b13155553a31907dce5c9d6dc2330906bd7f2b705b75b26
SSDEEP 6144:hXLc8FlSuh0KBS2ndNklJ7MmVVgxffTTFjlFD0mBWVnk6FpM668WhB4Tm2iTvP/x:F48FkuhhMlJLe9TFjlFgmMVs66Zvp
TLSH
T12BD4E8632ECD310C194842D5F2DEA91E7CCE233BAF05B76E8E348F7055A67686716B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\it.pak
Size 653KB
SHA256 88220058e902f05d7a2e61ec21667a5ca44c543ad0042fe530d698aa55836aa4
MD5 035928a9f0662e60c3e676cbcab7bd70
SHA1 2c12ff56708b9abb855826b99b7d9bcc39bdeb12
SHA512 193af83bb9ed2d3cba7c00c313f8637d679c287528b419a13fd704826e73932d7d504f9027f358ee1eb43b98958ef0c8cd6a95fa8bc6d82e3c6fbccb512e94cf
SSDEEP 6144:5nkvqo8bQZjtuWhaikwj72NTaUcSbmCfEs61ltUVbjhOebaQcrCqpzSj9f3wXYBY:CvquJuW2/8yEzfSaO285lLpQ
TLSH
T156E41C3AA9DA212559876359E611F085FB6EFCCCFA41721CC99B031C22CFE44E1ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\ja.pak
Size 796KB
SHA256 092cd118f2a19b2e914c8b43da7b5369b61c745b42ee64b505a2c599b7cfb1b9
MD5 68746004421befd65388da11a65e6785
SHA1 001741699df2c4c33cf8ed811fd20e63f2bda7a5
SHA512 8ecac41d14d3b1449c67c7491f7dab5f03f05e0e545733abf375b3ddb5ce78a0a7aafae323dbe835ea5c360fcc47fe3a3e49d4dff5c54c34b28d352a990277a8
SSDEEP 6144:7nlCaqgdDTlXeLIQHL5SinZOQ2J/iDCdbtJnKj9SsVJ:7nNLDTlXeLxHLlnZOQ2J/ECjhKj93
TLSH
T1F0053F7CE3C969369D6153A22C4E36E17506AC5BFCA23A3A443DC074BD70BCEE415AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\kn.pak
Size 1.6MB
SHA256 9744dbadbb7c31cc6393a0682daf91045be270bab934dff7dbad79b76287616e
MD5 b3783a9b59b5e6a2c6fd95371b803213
SHA1 ff155cf0972233eb8f623df42c2e5ae22d040362
SHA512 5fa60c33e634a335ef3f4a2121653ee5bbdbf72a7f8b918033ce547cf4b67840d91186b76610b3b975ac83965002af5d0114a30d5c2b3ca88e97ee7e011189bc
SSDEEP 12288:I73RiG2L/DzVSBSWvaKgfLbHVVR7o7WR2Mn40WWF5J:e3AG2LBoMF
TLSH
T14075CC18ADBA7D311BD5006B24EC643ECFF16BE29CA907D2F4DDD7802C66C6A90825DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\ko.pak
Size 677KB
SHA256 ee01af13e4e4b804e48d7126a38a059e210c7f4fba0c37fd2dfa9ef4c106b9d3
MD5 69e4b52a023a6f1fef283fd26afaa60b
SHA1 44e4a938442f09379ea4d133a145943cd220722c
SHA512 812fdcef443413a19db80717b2914f06476760b8a34ae51fb5f0f0279cdcabc1ada0e169bd0899e52d049b5c4d7c01e373a7b639fd7857351d0f5492e381845b
SSDEEP 12288:DbN5xgbgcpb+kIM1WNiPszcbifYj4ZGRyrD1IF1gwWOXCcIJ/xESJGBG1KLhwFqu:DbNcBKIv1rE3GhwZ
TLSH
T1B0E4B5F238DF63C91193CD82AEF4FA198382D976F7530294ED44CE449E145D7488AABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\lt.pak
Size 734KB
SHA256 bc5d99751f1b252ed074bfc4bf6dc94321b3f785a0a0d4300209acae40220f74
MD5 a8be0cf8fafaf996c10c5dc5a808b6bc
SHA1 1f759c0fe979ba2cc55450e348a5c0e3a158a27c
SHA512 4e26f0902d71beb6098c4b403268e452d27e22711022362615705127c401e1d2a21eff5dc1986d8f20d827f4f622cbadafbab9658b2225f49dde58a202fd31eb
SSDEEP 12288:kXA3AXEMrmBq97MCUl2AiMWmshNp96StH:MA3AXEM4Vi3msHpp
TLSH
T1DDF42C0069E3AEFB9A4467C981A4CA74DEFD50009727BC61ED69C78BC43BF4625A0F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\lv.pak
Size 731KB
SHA256 e91342ed84e1847968b40194250b4d76bbd2ea13133675b8b099dca45ee0f197
MD5 8e12cb07be6636b43abee71905887578
SHA1 bc0f96e91933824e05053b18986aa7a1f29b44a9
SHA512 6866a95a0ad90b908328bb7761c4c880f6529eddb3f230aca5887c8101555f6a4355a6afd6ad1c5eb1b5da2732581d4efd7bd453c008ee417f178e8c145cbfe5
SSDEEP 12288:LgV9vjUN9WUEPQhcGKA+rB4mnTchTeRtZ+tv:CUN9WUEPQhcGKAaB4mnTc+twtv
TLSH
T16AF43A959AC68FAA4D904DCB7336D133A8CCD740FE07E112ED798B3A650F52422B5EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\ml.pak
Size 1.6MB
SHA256 a45bcebcf69244bdbca6c0a4fe68c89430c6531e9d3cbddaa85758385b877934
MD5 a5b11c3de095c55c0f9b640246af5ae2
SHA1 389e008b24a5f290926f2145f14de26b4cc9927f
SHA512 7a3c77b343c8124c6aba91d2cf537af15c155a60252d5670277b119291760fe87cc6b064ff3ae274361d7f42632c292e2de353592b614c2a0213f0c6cb4c845f
SSDEEP 24576:4K9A/xxIL/oZAuuxyYl+9y9XBkx/etz25KfijHeBYJzXsY+v2riTD3QahWjW3y:9W
TLSH
T10385AD5BA436CD3B0FD002167B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\mr.pak
Size 1.3MB
SHA256 fa87d519a8545b2748c52ccd7704b320877b2d03385991ceabe75c2745200331
MD5 e3e0d59887c06f04cb8eeb560f8cdfe8
SHA1 61f97257632b504a870d163cbfdde93d3c6e75e9
SHA512 33070811a2517b09d4a4d8a38f2a4bfb83b790e3cce59a297707fcd368cca3f57dfe6c44de14d4dc328575618e1dac15b4ba51d19b95ea61ac7688a51fc62b12
SSDEEP 6144:7hKo7yofVgP3UUKg+XhiiWUT3maPIafNCsS3mvycy6:f7yBUnJwafNCsS3mqcy6
TLSH
T1FB65C24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\ms.pak
Size 629KB
SHA256 2ab44645c1ed7b68c9121ee0ab9cdf8c7b9d1721d131b08f258b8a85b8ed0af0
MD5 9f0163e9f290339a5b50030f21f9fd83
SHA1 a0008221bb59a32c06165583f6444567695891ff
SHA512 02d677341b76d9974bf74626970baa71d145baa6a13d4609f5fb88d9130406486973c1acef69d0234f134f4da8b069e7fd5c55c67ac3a5c034bbc39e09c917aa
SSDEEP 6144:3MoNgXwgvIUwLRtE06SEhJHuqwvhQ8cNL6l/nmJUlECCn9kk:3MZA00SHuqwvSIXlE1
TLSH
T149D4C6579EDE3118085843D9E2DEA91B3CDD3332B705AB2B4DB08FB0166E7A53315B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\nb.pak
Size 601KB
SHA256 8eaa23c418a3fafb9e85b5445e73fb2f5e13be1f033ff2487c4081148aaa2f4e
MD5 327b5967d7699fec83649bd90271e957
SHA1 bd117f91af26488c400f213e8d30e03f407abad5
SHA512 5d0953136272834f87def5738279e2e810844b37a843550e76773a13a65cfc4e8d47c8b16936c52c3ba5acdf7df337bff8e46f4bad131a2804297a614b29105d
SSDEEP 12288:tsGCAdpZQpLJ/Op7fGQH4fDcc355Blxuj2GO3:tsGbALX9fDccp5BbBx
TLSH
T160D40883EE86B72EF6A442A4F118855B9B7D943CCE98199B54D8C63E0CC7EF051BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\nl.pak
Size 627KB
SHA256 43a15f2dfda6ce1c908e9913eb02aba9602e3f24c6c96f7fed7852d61a1263f6
MD5 9b4e60704c0c686aa632990c7b51e0db
SHA1 63f6a5b5b8a022dfe391780661635927dcff8ed8
SHA512 b3dd9255337a06404eb23074e94a4c334b97b8c06d60b20d539c7c44e959f204ee514a24c053a70a33c410decb8fc1da6bd32ea51f77041ffa69f3208edacd1d
SSDEEP 12288:/fPtUXBfhlbJWQusgUe5Fg73+59F8yRv9qH2GcJ:/3tUXzlbJWQusgUV3+59+yRFqH2G0
TLSH
T1AAD4F907AC8E253E59C0A349FA098FBBBF1AD32CC26CE67D94EDD5341443F6841AD589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\pl.pak
Size 700KB
SHA256 5e47475490d1514e3670c44f55a2061672c8e7f6219211b3d907bacbe5aa0a5c
MD5 2e771e90cb0aa444036793b40846d653
SHA1 8924e0def0728487c04dd7504d401cef39dac29d
SHA512 cb0abffd3752132ab14392e0b446cfd5f6ebb7cb517c5135a6b63b8b78c3ce9e40703cb5a726b239b09618269c63aa4c1b52e4af2c12ca804905d5186b0f7762
SSDEEP 12288:7k4KnG2tfQfuzSJQbZwbrfEPHCUdPe3m0UyRMAmo1QhlhNR6pol4WMd:7kxGLf5RMQ1Qh/w
TLSH
T101E44A0E56E58A4E8DA008E6F6E70B7CACEDC808F108D35FE46F4526715B19FC9BE584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\pt-BR.pak
Size 657KB
SHA256 36ac257c8863e6029b1a855c47ba58b99534c42b38e0cc9dddd20c5916658dbd
MD5 21e02b974938ecefee9bfd2464430cbf
SHA1 77d278013f0a36c11680f70e3f9314200ffcf3e8
SHA512 3de3382afb68820b348c2b861053df63dbd443d122a113538c5a90f37a6933fd5a24df3a6ac4e3bdd099cb6d8cb3de1eef08fa814e5a9f06c6ffc74a8deddaed
SSDEEP 6144:34KgJ89LqfWu4v2dF801NBXBLEeamTNyO3aETy7oGnsRoU1bb:oH8V2d2mIEJWsR31P
TLSH
T1BAE42B2E6DCA13660522A350774EDB47E5880745FE0ACA87DCEF4B06A3DDE40D933BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\pt-PT.pak
Size 661KB
SHA256 98daa1072e7c405e3f5e030bfe25ef1e12b31a96e0b1db245d6805a564390f75
MD5 e822fe7d1510732825f459498290fb1a
SHA1 f124d74d6c0ef0c0cc91d0fc3730249b216708f3
SHA512 919dced860100cfbf822278029357ec63f3fce7006564e8808182e659bd5ae0c1ce072ea49abf37781cfacc011a99e2f14545ad34aa8ce9646982df8993b6c3f
SSDEEP 6144:tifQHbMZOh0ARCRi2uJCieJVJJxhLw/5NSWf8YhnVwRYhSRhB:cfQHbMZO/rJthnV5hSRn
TLSH
T13BE4182C6EDA136605135341770ADB03EAC86645F80ACB87C9EF0B4272CDF94D6B7B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\ro.pak
Size 686KB
SHA256 da5c79d06ae972aa460724ef378f91bf4afda911b167a896963f6e0d4daf9aec
MD5 48219b6c5a69bafd975625d2da3336e1
SHA1 84a6e7793031af8af9febce898cf9655c438473a
SHA512 1e084801d613147a8d9ef23558bdb15bf0298679cf89b7f4076e87b37bac21b5d60959c05f2708b947574b3b6a11a34f2e7d7b8f24da59899eec7f0aa25e4566
SSDEEP 6144:giDlFSlj7Cx6wM53WPBJfGgnyiirQkAarGycOBCdK5w3/s2osWL/FrMY:gi/SR7Cxo53WPBFPyiwKcCE5eosY/OY
TLSH
T1E0E43C23A1C81A972D5152B2B73A24D3EC8E105DF641E28DA4DEC97910CDDDF852EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\ru.pak
Size 1.1MB
SHA256 b0977b6a115c6836189200423b44202c1329ff702b68ab9a72f996fe42c6ec81
MD5 19872473893e1badb73a74b0671092d1
SHA1 7aa97c29e230eee03173d774f9e0a22b4b8c2b61
SHA512 5ce55d4551eca3005c5f9f77add7e4b25e3468db66b0935b2d8bf11846e075e6c9edc0ef52548a14dcd1b9050deede58e2b5359e1f202457e05c71e93e9f4b12
SSDEEP 12288:v+Fx8bfQeRo4Ye7MObzJ9sF8aTj+ZQo6HzW/ZqSvYsqCJKkEj/R3Q8N5X4hNYHnI:Y865o59
TLSH
T106357760669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35219A42D7F35F2024C67E65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\sk.pak
Size 713KB
SHA256 de1a35198ade6d854211fc6b2e65fbd18eb2b52c496e3773b23a10362fb463bc
MD5 def3b701a03f567bff87d7595a9ad72b
SHA1 ee04828adc3a03aa3a2c5ba85d9f38038e5dc4b6
SHA512 5994a6b071b9a8589b139c60bbb6e9b3f645d575f9e61aabf695ae11e553dadf7ab583bb6626c7ac5941ab36cf12178ead7a3c23057dc8e91967cbeccbb1db31
SSDEEP 12288:J9FTFucyojAI3OBoiIJr2nsbY1XlJpTjsxt9wB:LF5so6BUYXYtaB
TLSH
T1B6F44D7FDBE7181E8E8D0148FFEA7110FDBE8650864DB0A6944E364714E26EDCAB4E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\sl.pak
Size 682KB
SHA256 2bc385d457dc844794f9396458c4090e6233afec5a08b4a5a92e45ef31e07b78
MD5 7f5efe708fdd9a2022af9081dfe2193d
SHA1 fdc5cfe26c59d1cfea3df709cb6695cd8791307b
SHA512 7485e14a1cd10ca28651b9363c8935b20b438cbdd9c77f34fd0d98b159c19567917787fea10dda5a6125231f51d79814c32eae9b2fbfdb86694dcc1277dfa6c3
SSDEEP 12288:o+XbapXutC4rZcB2KDRXgSWHFxJi/fzxMJql/aA:5apXijrIXg9HBi/fzxM2
TLSH
T15CE42B397AA75E0F0C9AB2CEFEA206107FDC044CE251E6A1FC4F336A5415A3827BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\sr.pak
Size 1.0MB
SHA256 c3b4a5aba1e86ea0088e5c33002bb055ed567840b2859b277014be0a7283013e
MD5 f15516a912b4d3958e34dc078eed2849
SHA1 6d5af2127f34cab240a295f4cd456209033193bd
SHA512 43bd493444e00753e47baa3a2206f18be8c91e65bcaf1fad3db0f1e1d1a788bded8e7b6ad1ea047155899c35241744ba59aa39260fdc774b0ae4a85a47675322
SSDEEP 12288:vKkdRtCl5ytpmIMdmSldRnCY1i4zFJKQpMsh1PCoxVfP37VuuJH/k/p:CkdbCX7zCUa
TLSH
T1763556B19B9E64DB0501F41BD808BE4A3DAF41FE3FAB975211601DBD34E10B847B929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\sv.pak
Size 609KB
SHA256 3af85c15ce3e76344404c37325a60932ce53763539c8cd8b3120424f709f73de
MD5 6aa60b4d011fa4eaad33c81c241b2586
SHA1 ae077d7a8cdd9900e65846abeb9e59a05e319026
SHA512 48589812bd89b945e571534492aa5f9dfbb61764ac8a799c4f4b084de9dca4c989f35d85c9c9c8c6a8e3b38bfaf62f90525b2a93cd25075aceb9729160a7e2d3
SSDEEP 6144:hUVc3CZJTOfZ4iVEffYwn1oFVFBwUxNxSQIluSwRLkRRFczd5RtGmIe37MgmatSD:B3C3TY4iCQXx3Ni8yT
TLSH
T15ED41B438A50F526FA72530DF608115B0AEDE25CE3F2958EB8D9883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\sw.pak
Size 645KB
SHA256 a806d782b21930ec6243b8e5b393e7fa970ce9d297e96b02e6596fa6ce6c8a86
MD5 a8bc8fbd29867cac98603594c45b4a4d
SHA1 740b6a554114fa56d40ba2218b7ea909bd1a830c
SHA512 cae89812bbb6a17914e707c56651a75e1667f93362466b0ff9c8ecedb94dadc763d88b8793087054b9ae1f52036fd6046e06524a68bdad378726f0aab584d65f
SSDEEP 12288:8/ymPZHE2QuOuexGQ2qjOWd9rGIqg5OmedqUBjRdpgaywd+cbiEpSLjGJFGSE47M:OpPZH8hQFCiIBl
TLSH
T1E9E4C6629CB1D1191233518A03DCFF732BDCED5C692B29935A46BF0F218F48C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\ta.pak
Size 1.6MB
SHA256 516660683214c01341300fa8d15c7e39aecc38792b76fe74bdcc464024f4294f
MD5 8f4dacad627730913799d6610a54cdc8
SHA1 7ef0222a459e781b47e12cac964cf25cebc3c16a
SHA512 09f41389c43ce33a3cdaa77d487a1ef806f635d4f3d8f760b03b24a72d782c290ec074ed7f5ef79e253cb582542a7f384f90309e0e44d74c0f06406506ec8b9e
SSDEEP 6144:JCZxLlT05Lta6k5rBGPGKqatRoHtm1vYpiMyB:JExo5taTBGpqdtm1vYpiMyB
TLSH
T1D3750BCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\te.pak
Size 1.5MB
SHA256 5439181ded31f8cc5dbcc1eed358753d4b7449ad29380baabe4cb893d8751a06
MD5 1ad6e40410015055cdd8ce9eaa5c7657
SHA1 931053efc56de20dc8d360b5cbd9a224900d45e7
SHA512 b81d7e1af85af809c133932637799ad3ace90b5253bad0a859bdf4a493a2dcf4fafe5bcb8b84205c5df950b631e3fc19396f9115d7c97045c5c58ac7f46613fd
SSDEEP 12288:3STFNdDlD7MZKNby4cE1SF602ZL6gIC8ymoQRT51bD+52CMlRWmB6PS3p1Fqzh/L:iT1DGwbkcJx
TLSH
T1077592023A6AD310DBE60273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\th.pak
Size 1.3MB
SHA256 946b4a45a9d43b15359927f33307fc35f50d7e880f02890b07bdfd1160f2db59
MD5 a5b725c3244def3ec90dadfa3c151866
SHA1 b81b482e7db57ce30e3060dbf1912a79449fcba9
SHA512 0a8d67354e46d572f21234c165db69cb6acad6e741140e26eeaa16d010ad98c342fb9dc01d9fbab94d0a4f921f78375704595bc2ac2cf348cad87957f8657091
SSDEEP 12288:mLDaTE65yUvN9LyZYAbzALaB6s6ouhCQskJUsewPsO5eXwpbDFDS6Sud2mKHlJjU:EaTE8PpMsV
TLSH
T1EC554BB37247DDD479441B5B262A7789672DAE693F73F8E00089215A73F071A8422EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\tr.pak
Size 656KB
SHA256 37619e7084337a839d8ccf7915381cf9975d0ffc9451bd37d210bc7322645219
MD5 b4e498d7d54287001e8c76bee17e6362
SHA1 adb07b63010b9286e3088437176f3f00b0c4b83d
SHA512 adc5bab4c6fc34d54c1edf322a09b619927b208e64d767be1fab053ace694a5398148fc92450276de278248facc8488e88ee76ee0d522305471f71caea44d414
SSDEEP 12288:ROYNHfcKfFZWaQGHz6sgwhqlZFIgGnI9drH4k:wYtnY2I914k
TLSH
T13CE4EA8178EF282C8BB9278FD6E90666F89F0766B331F4469B168636774535703E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\uk.pak
Size 1.1MB
SHA256 1e25a84007245d7a2ac4fb7644bf242e3c5aca8fa58b1bba7163d99a17a6ed3d
MD5 8dc9a495ac78cd8ae720348c2255771c
SHA1 962b251f429889081bea190c5b11bf0f0485c634
SHA512 483f6577394d8cd186eeef936beb189c854a5ab5c4c29e5643b25f19214eabde45397e674d6764b4ab90ac8520ed3729214ae541b2dfa29142605ce0a42049ba
SSDEEP 12288:e/Dg5Edh+kg+QKjbjIrwk2zeRQUhuHsSr+UCnJSB8hQxBCSOo5NndaA6Qvqz8Wuf:cDgWn+yq8Wg
TLSH
T10745A9A19AAD54DF0105F05BE94C7A0D7DA740FE7FA6871625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\ur.pak
Size 986KB
SHA256 d57cd219249e207d34c21a619935d0f0a7814a0ccdd36051a42400c60a599e47
MD5 dc42faf460b398e953b2ccb2cde92697
SHA1 ab3811f4f0e5341116b124734c48bacc615ef92b
SHA512 98838ee7acc6ed57f1635af2924143a917639908561c262ad000da0b0d629827ab958078af7c2f164b6d410ddfb59df634dcfca91eb4fa0f520f15bca8e7b579
SSDEEP 12288:F7Fd/iUuDDy8PLDLqtdQQS6daywsMfvTFgfAE88GDOJdeQYrjwYjwadcJKwUluEG:F7FdIGGUH
TLSH
T1B62500D2A6BC96B34A21D92780D33C34CB735F13D34AF285E56246C54E9A0139F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\vi.pak
Size 781KB
SHA256 37f2c01a308ad8bb93d9525d81480880f97d54191dbe7c1c1e75aa9fcf009450
MD5 ffc5fa19d6e85eeb94fd03be613da7a2
SHA1 0800c629fc49ee032f8ba8341396628351437e0b
SHA512 2484334af1e19dfdca3ff806132dacb1d8415a753b3118150bfd5113522cb533c2e82df5bedf2989bada7d9f1b6e1aa1dca3112a6b7c24850feb651bbbbc6842
SSDEEP 24576:D7+cYCVP4DMqoCsEwmC6lrTiOGNoq1ljx7:SnTipT1ljV
TLSH
T18305855216D0302680AC553EC6CE540D6FCEE42FF7C08FE56FE429787A221A55F25BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\zh-CN.pak
Size 558KB
SHA256 0386ef8bf3ce4e24c604ee039273e452d12f8b1d6e5ac7e746995e8b39fab379
MD5 ff47ad2437a3b3ed0c5a485da62b201c
SHA1 15d9670eeba6c7be829d21ff598bc976ba462824
SHA512 91625549fafc71abed3cd35fa85f776782ff6e4128838d986afc93ab83ae528cf29081375c8cda5e7865409e3bb3528c1a04fad418f67bae7719367119b51960
SSDEEP 6144:zde+VWlzvkdB6ExlnE7FOUwr4LJ/l029CTSIloUaYZDMG2Cy1xK1ylE:QHO6E3ngOUVLJ/lDseJvYZDMey3g
TLSH
T114C47DE420F9BDEC004A90E13729613D7C40764BF62BAF366ED248ED1A95FAD0757A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\locales\zh-TW.pak
Size 551KB
SHA256 740c2da1eedff44b57d8700b6f81f1acf17e67bdf534220553b448da42f62b66
MD5 f86c77e811dce24940abf10c705621d8
SHA1 84a4b9d9da9aae1fbe7b55f4757db9c4d1f4ae05
SHA512 3096d18e09e7bac9c70df32634b7a56d486f43301a6c0dc436dfb79ff42abdfb637ec0194d1043898e32a74b8a7f7da6812db1b7c78245c7bea1335eab08b756
SSDEEP 6144:UPaXw7lc0FeCIh8L5eC25DBz6JxVaMX2BuUaNJ+zSLHtD14/tt9aUmQhiDcTZ:GVciL5eJsVLCaNJOSLHS5v
TLSH
T180C46CBA0CFBDBEF0901F484B7C9923BBC8B386DDD377636FC4918941E69A5409A2145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\resources.pak
Size 6.9MB
SHA256 0d9e7c94b4cce317da85238f36cda73c942c8fccfe976431313cc79f1173bd1d
MD5 ec602c00f670c4900ff16c71ccb9efca
SHA1 73d3e23189a491173c79af28636affafa6158f28
SHA512 5a8f3ca9c1e0d3c3b9c699212c76520335909b2a9e270504b0775aa8e0e6893d00dda6865d24f7954b9204d51681417af9c0742781018be883bc71fdb2e507ec
SSDEEP 196608:8S6FtJkCXvfT1dT9x3GBkrR9NK+EHB3wBi3cGiklILmzuLz:6+Cfj9x2BkrCpcGlCqSH
TLSH
T1657633D272DA4C0BCD50537A09184736C29EEF6935D6B09286CC629CDCACB6D5FC2C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\resources\app.asar
Size 8.8MB
SHA256 cf5f70d680006ce23ddbe46ac1ee51fbdf4ee84b0467e5c801a053a38f7836f9
MD5 b73b2373c02555eab0125c7e8312543e
SHA1 9003068f0dd3112b23ef8584a6764a343a4d0d08
SHA512 db91c90509b2bdb8b299003c3157a2d35384a7e7e86014eadd581b0d3a0bf249a23a2dbd805d455f1ce386e472fe5feda10ed27702055660cf59097ca690a3c3
SSDEEP 49152:8vMZIlnhbYE7IgsiUVUuIEkcKaT2nt/WGNGcC70t0IFl4KInPFFg8WISxHBlHOOY:ClnhTUjIzqCJa7OgQTEwIVk1G
TLSH
T19D96174533F7A036061723AB8E5F8545B73B9417390598187C5CA2986F88F38E2FAFB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

proton-confgen

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\resources\extra\proton-confgen\proton-confgen
Size 13.7MB
SHA256 1424a4d5449d52f21d63cff1f414dbae3818f0e420e8af81fcceed8b214fa67b
MD5 4023c2abe5d9a855f6ba49b1067256d5
SHA1 e06820f6df0489fdfd0a62a4940678d5a155d95c
SHA512 27a7ba8719891826d345691548789426893ce2d08cf3fa9625e07a25987700f665bec0e0b3b52142a7060334df49b8b535abacd426d9d4e117e021a19c560626
SSDEEP 196608:4fvZRzyp+ioUGRvlDvAcsjik89HsOvVhw5bei:4HHzyp+hRvli
TLSH
T195E64B57FCA505E4C1AD813589A696127F32BC4A1B3023D72B50F6387FB7BE0A5BA350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

proton-confgen-manifest.json

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\resources\extra\proton-confgen\proton-confgen-manifest.json
Size 364B
SHA256 6e9807c1eb048595f24c2ea04ad3eb72155d10e0384db0ee34bbe74dddb22852
MD5 cd42f1ef680eacd333bf9a22cd9627b2
SHA1 35e3cd436b69ee7273b044feda4c3ffd1d5436e3
SHA512 9625ba6f690f500057dc17e32dc17d334b6bbbed614d468b10e48ad86f0d8888d51323a5b880ab8ad8d6708f133b25fb0cfa30930bd98ce0fdd3b4f47f777d8d
TLSH
T1C1E02014C1284C87506D5A51953504575113014B6D4E3D247D0EDEF96F48A6E151DBF4
MD5 SHA1 SHA512 TLSH

Submit Download

proton-confgen.exe

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\resources\extra\proton-confgen\proton-confgen.exe
Size 14.1MB
SHA256 42f69165582aba4fea56c14f1ad0331c81f7b5c27475d8ec8a42a8d5d5a0dbdd
MD5 e83581d66e6d857801e0ebb3e23c446d
SHA1 1875d7fe28579a90102f07ed5d6f6f13da8bb6f6
SHA512 eac858f03cf166c28026b8c883418f10bc8b5516203d35f6b5303c2911ec7cd918525f2cf10d6e6b235b86c2efda7e17261247a46138582d39f8358dc502d675
SSDEEP 98304:+rbnESyH3GIDCxMQ0keI+DxB3sS2uMjDI3fzFwNH9OV++IEHimAE7:g4RJknRr+DxB3sSyjD+R57
TLSH
T1B9E64B5BFDA900E4C1AD8170886696527B32BC4A4B7073D72B50F6287F77BD09EBA740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golivebypass-standalone.sh

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\resources\extra\standalone\golivebypass-standalone.sh
Size 212KB
SHA256 363329cbf1974b05d1bf63d8e144ba29a3837cccccdf9998129112d8baa26ac0
MD5 7d9e58328b2083d3386ec97e5a20d368
SHA1 f19b541d5785c1d7b44271a6c8c5dd8a20b7c790
SHA512 4c494d40ae23d467bb8307a00cde4e731726d4a1fa2505a729de8ada6bfb08b181c46e2bf8fa5a5bd8e1c3c6abeafad251b4fbc52c6d435512da3dc7ea9ba910
SSDEEP 3072:Jw2pa/4fJN48CkIsBRkzyuULzzzegqeiJpxMd4JxVoc:Jw2pa/4fJN485IURkzFULzzygq3bN
TLSH
T1E3241A56ADC616B826578228EA97A002B7CE150740AD7015F46EF70C3FE8354F2F5EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wireguard-go

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\resources\extra\wireguard-go\wireguard-go
Size 3.2MB
SHA256 ac44c064190f2a3b19185ed802f6ffa6b1ee82ef7a49197ace039e9ffc5d68fe
MD5 b170daffd19d6bbe74110eb55b31e117
SHA1 866b43f9ba18a5b0a3d94972be298a1b10c07343
SHA512 b35c6e5fbdedc379ab1451267a28d3824c38f46b5ae1f2446ad65e47f0743406910e3b751c4e47f707022bcd58fa5bbec0a511616697d7f5e3d4057d2ae0b3cd
SSDEEP 49152:gITURG7PS03ll8i6xBZkG2HDIhDheKlKnhlMEe5Ew:gIsGb8iG2ONEw
TLSH
T141F56C17FCA519AAC0AFA1318AB656927B71BC491F3163D72F50F6382F32BD0587A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wireguard-go.sha256

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\resources\extra\wireguard-go\wireguard-go.sha256
Size 79B
SHA256 de5b395f9342fa65e6603df293a5a4865bb9cabeb416b56ba81a08f6823069f2
MD5 e4e23f98777fa23f32b6e3624f24f470
SHA1 69bb0e761487ed7c6c13efa04b6c00ab47d8f1d1
SHA512 2172c77213f58bc2c8e1f5d29587d58b7b1655615d6d37c4747df17c9bfeb8defd0568279064eb94e0e5d134b1d33fa4bfbd411955a22afc1025f4b7a10d5219
TLSH
T12FA024301C44303C11CC441C551534410305070030FC17143C4CC103C513113F3C354D
MD5 SHA1 SHA512 TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\snapshot_blob.bin
Size 356KB
SHA256 acc3f67cbe66b00f922d806f90c81a8e00550d708b9691665564e485e54a8cb2
MD5 6070dadf700af5b95d245955fce2ba55
SHA1 e78efdf2bd0d47ad91014799b7a5215e1d87b505
SHA512 8a1ef28527f929c454e3feb0de8c08d8842a0820651682dc0bd19e1a6d38f9c69f7332b6490c8a2b3fa216d077d1d58f32a710f168e2927ed6a7c03f7c6f93cc
SSDEEP 3072:GiOt+xbRt2N4RP7iT6MBRbnStHpH2U8Ww8Eaws4UiRDpWx6nokhFlRVjJJ:ut+HxN/kiEaR8DQlkhz7z
TLSH
T18474CE12F709CE26C8B2267C8DF5CB942E34B18D9E99AA5B314443FDB4797640E2B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\v8_context_snapshot.bin
Size 722KB
SHA256 315058ae62b511f60c4e7b8960370c4a6ce0c8cb83a9b78822264ad62118f450
MD5 84245ed02d2717506369368a998dd2dc
SHA1 1b1d7d1457a386727633ad410973825796e549b6
SHA512 374e9c762398e95f6e8f6dbe1a26b4ec82739abbd7828a9f08a678ccf9c3f5b8a4bd31b0deacb4b9f919512c6c60228509508ecfa1331a47361955b36dd53715
SSDEEP 6144:et+HxVkiEaR8DQz2N6mXJp575pxLGTAz7Vqe9lCY15fFA0KMuuJe:uiPmQz2N6mzLp3ge904ARvN
TLSH
T1BFF4B7B5F70B8E36C8B526BDCDE6DB463A34B18D8E86E507304257BC74B87744E26248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\vk_swiftshader.dll
Size 5.2MB
SHA256 1aa115d30719543180a8ab944ba97cca293bac77cf1238fcfed83910fd07df46
MD5 21268b8d783029505e4b2c2f059483b1
SHA1 7164f13ece2873cf5fd452d689e22127c4fb3f60
SHA512 5455ca9a1faceecec336562a1466522ee0dd5317988a72723cfc6046a4302cbc5f1c453cbe827e3fc24e1cc0891cb4298fcdcc2282389e569233258539aef363
SSDEEP 49152:nVOkvxrdlYd3I8MhFDAc/xRg4SN6Pihghb2XhRoZgFUGE9V8+ZyenG+7VS5H5xyq:nckvxAWZ5DxKxy3RQF
TLSH
T1E3463803F69681D9C06DD578875BA633F632F8804B2276DF56A00F192E66FE0AB3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\3LhrAFsbVtPIheGJbEoIQERORt3\vulkan-1.dll
Size 902KB
SHA256 c3739d069c01d7600bcd7de6bba48059110da413436e912c1bb0eee31d8146ea
MD5 1ae5c1da6daa6b62acb4c37b2b0b734a
SHA1 9997a57ad5a69774763a3c83b307de8bb36c0688
SHA512 9ca92bb5d5cee7613d64043a58844f56d3613fd4f79ea17893b4872a5eeea8f1ca76e4130a74bbc48b22bddbd9b85b8f9a50f435037ab6b83e75a3e034fd73d7
SSDEEP 24576:5O0CYRbRudu9UaDSOdYZ3Y0gAi6Z5WzcADYsHkDn6g3P0zAk76oOH/WQ:Y0CYRbYdQUVBY0g56Z5WzcADYsHkDn6E
TLSH
T150156D12DAA48A69D676C034D9D18A039AF178C11323B9CF07B817147F6EEF46B3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ydkzx5hz.23q.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ydkzx5hz.23q.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk744D.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk744D.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk744D.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\golive-gui\Cache\Cache_Data\data_0
Size 44KB
SHA256 e367c8da15bc5cc8240cb904116cdde96b0893230c8865e276f6ed9daefdebd5
MD5 589bb612f5d5ee6904b694e479cfda39
SHA1 ab4471f93b84e165bead3ed701fb0d6ae9a16292
SHA512 88ac7135ee76705cd2bf7295ae8f04ebcf0242c19d7d3ad1d7755db6160b45cb7fc9b3c720f56051bc2c2a3f2f489ed3e37c4c5dacc50e6c051912bd5de76af0
SSDEEP 3:MsFlYhXllLlX8lmhZ/uX1H+ell+:/Fiz10maee2
TLSH
T18F13021D9BBAE455C2042531489A876857ACDC0445BE03675051351E2CA57538C8812A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\golive-gui\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\golive-gui\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\golive-gui\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

4f51f3b8-679f-4f64-a693-ff8f87533ac1.tmp

Path C:\Users\Admin\AppData\Roaming\golive-gui\Network\4f51f3b8-679f-4f64-a693-ff8f87533ac1.tmp
Size 665B
SHA256 c56cabf98a1be083bb0835e6d7ff073079e9a0835e7006df56567f54a7c4b08a
MD5 49aecff1beb006f00a81fa79423c666d
SHA1 b30c6a1e517c4109e81695cde02835f32f5f75bc
SHA512 64518f3a4690415c73f595c1d85ccbe8948b4b8140f2de5e3a09f156ffd4e8c72e7552d66cacd32d53180e1de187ebfd79ccec93e6c6ddca7b892c194cd8c7d7
TLSH
T1A40176A6C3D889BE494212F42A24B923C5BE082952283C03C8E8AF8E93F1435060098F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\golive-gui\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1860-727-0x0000018CACF70000-0x0000018CAD498000-memory.dmp

Download

memory/1860-726-0x0000018CAC870000-0x0000018CACA32000-memory.dmp

Download

memory/1860-717-0x0000018C940E0000-0x0000018C94102000-memory.dmp

Download

memory/4548-782-0x0000013110720000-0x0000013110721000-memory.dmp

Download

memory/4548-780-0x0000013110720000-0x0000013110721000-memory.dmp

Download

memory/4548-791-0x0000013110720000-0x0000013110721000-memory.dmp

Download

memory/4548-790-0x0000013110720000-0x0000013110721000-memory.dmp

Download

memory/4548-789-0x0000013110720000-0x0000013110721000-memory.dmp

Download

memory/4548-788-0x0000013110720000-0x0000013110721000-memory.dmp

Download

memory/4548-787-0x0000013110720000-0x0000013110721000-memory.dmp

Download

memory/4548-786-0x0000013110720000-0x0000013110721000-memory.dmp

Download