Edit tour

Windows Analysis Report
RP.sfx.exe

Overview

General Information

Sample Name:	RP.sfx.exe
Analysis ID:	1347830
MD5:	e335f71c0f053c393626691bd60a58a4
SHA1:	0cc99df70cca24c5f96edf36672ea297fe71043f
SHA256:	af0c48ca1ed3431b936d489bf1e8255a5d4182bd6164946bd6179ae3f212d0b1
Tags:	exeGloomaneStealerUKR
Infos:

Detection

44Caliber Stealer, Rags Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected 44Caliber Stealer

Yara detected Rags Stealer

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Tries to steal Crypto Currency Wallets

Contains functionality to capture screen (.Net source)

Yara detected Generic Downloader

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Machine Learning detection for dropped file

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Queries information about the installed CPU (vendor, model number etc)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

File is packed with WinRar

Binary contains a suspicious time stamp

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

RP.sfx.exe (PID: 6496 cmdline: C:\Users\user\Desktop\RP.sfx.exe MD5: E335F71C0F053C393626691BD60A58A4)

RP.exe (PID: 6660 cmdline: "C:\Users\user\Desktop\RESOURCEPACK\RP.EXE" MD5: 513286E3E241F1C93556F45DB4F8DC23)

unarchiver.exe (PID: 6704 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\RESOURCEPACK\RP.7Z MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 6796 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu" "C:\Users\user\Desktop\RESOURCEPACK\RP.7Z MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

Threatname: 44Caliber Stealer

{"Discord Webhook": "https://discord.com/api/webhooks/1162710207558852689/c241__Tv-C5fSE0jsivUVIhYUTy9AQG_2q-Wedc4i61WcTidBFF8dAoQzbri3Cz5u5KI"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
RP.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
RP.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
RP.exe	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
RP.exe	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
RP.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x379c2:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
RP.exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x39096:$s1: \VPN\NordVPN 0x3913a:$s1: \VPN\NordVPN 0x391d0:$s2: \VPN\OpenVPN 0x3923e:$s3: \VPN\ProtonVPN
Click to see the 1 entries

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Desktop\RESOURCEPACK\RP.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\Desktop\RESOURCEPACK\RP.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\Desktop\RESOURCEPACK\RP.exe	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
C:\Users\user\Desktop\RESOURCEPACK\RP.exe	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
C:\Users\user\Desktop\RESOURCEPACK\RP.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x379c2:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
C:\Users\user\Desktop\RESOURCEPACK\RP.exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x39096:$s1: \VPN\NordVPN 0x3913a:$s1: \VPN\NordVPN 0x391d0:$s2: \VPN\OpenVPN 0x3923e:$s3: \VPN\ProtonVPN
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xbf7e:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1a38c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x377c2:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: RP.sfx.exe PID: 6496	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RP.sfx.exe PID: 6496	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
Process Memory Space: RP.sfx.exe PID: 6496	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
Process Memory Space: RP.sfx.exe PID: 6496	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x123c4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: RP.exe PID: 6660	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RP.exe PID: 6660	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
Process Memory Space: RP.exe PID: 6660	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
Process Memory Space: RP.exe PID: 6660	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x2de52:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x512fc:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.RP.exe.192d19b0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.RP.exe.192d19b0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.RP.exe.192d19b0000.0.unpack	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
1.0.RP.exe.192d19b0000.0.unpack	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
1.0.RP.exe.192d19b0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x379c2:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
1.0.RP.exe.192d19b0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x39096:$s1: \VPN\NordVPN 0x3913a:$s1: \VPN\NordVPN 0x391d0:$s2: \VPN\OpenVPN 0x3923e:$s3: \VPN\ProtonVPN
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.0.RP.exe.192d19b0000.0.unpack

Malware Configuration Extractor: 44Caliber Stealer {"Discord Webhook": "https://discord.com/api/webhooks/1162710207558852689/c241__Tv-C5fSE0jsivUVIhYUTy9AQG_2q-Wedc4i61WcTidBFF8dAoQzbri3Cz5u5KI"}

Multi AV Scanner detection for submitted file

Source: RP.sfx.exe	ReversingLabs: Detection: 65%
Source: RP.sfx.exe	Virustotal: Detection: 42%			Perma Link

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

Avira: detection malicious, Label: HEUR/AGEN.1314536

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Virustotal: Detection: 56%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

Joe Sandbox ML: detected

Source: RP.sfx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.160.84:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.189:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: RP.sfx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: RP.exe, 00000001.00000002.1694023310.00000192D371F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: RP.exe, 00000001.00000002.1694023310.00000192D3811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: RP.sfx.exe
Source:	Binary string: System.Windows.Forms.pdbWBmD4 source: RP.exe, 00000001.00000002.1701951052.00000192EBE1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: RP.exe, 00000001.00000002.1694023310.00000192D3811000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005D3230 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_005D3230
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005E3AC0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_005E3AC0

Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\font	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: RP.exe, type: SAMPLE
Source: Yara match	File source: 1.0.RP.exe.192d19b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, type: DROPPED

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: ipbase.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 172.67.160.84 172.67.160.84

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: cert9.db.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: RP.exe, 00000001.00000002.1701951052.00000192EBE1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m0
Source: cert9.db.1.dr	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: cert9.db.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.1.dr	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: RP.exe, 00000001.00000002.1694023310.00000192D377D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://freegeoip.app
Source: RP.exe, 00000001.00000002.1694023310.00000192D37B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipbase.com
Source: cert9.db.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.1.dr	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: RP.exe, 00000001.00000002.1694023310.00000192D3763000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RP.sfx.exe, 00000000.00000003.1652957890.0000000003243000.00000004.00000020.00020000.00000000.sdmp, RP.sfx.exe, 00000000.00000002.1654513305.0000000003243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.heaventools.comDVarFile
Source: RP.exe	String found in binary or memory: http://www.heaventools.comDVarFileInfo$
Source: cert9.db.1.dr	String found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.1.dr	String found in binary or memory: http://x1.i.lencr.org/0
Source: tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RP.exe, 00000001.00000002.1694023310.00000192D3811000.00000004.00000800.00020000.00000000.sdmp, RP.exe, 00000001.00000002.1694023310.00000192D3799000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125
Source: RP.exe, 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.vimeworld.ru/user/name/
Source: RP.exe	String found in binary or memory: https://api.vimeworld.ru/user/name/5https://freegeoip.app/xml/
Source: tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RP.exe	String found in binary or memory: https://discord.com/api/webhooks/1162710207558852689/c241__Tv-C5fSE0jsivUVIhYUTy9AQG_2q-Wedc4i61WcTi
Source: tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RP.exe, 00000001.00000002.1694023310.00000192D3811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: RP.exe, 00000001.00000002.1694023310.00000192D3763000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://freegeoip.app
Source: RP.exe, 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://freegeoip.app/xml/Z
Source: RP.exe, 00000001.00000002.1694023310.00000192D37A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipbase.com
Source: RP.exe, 00000001.00000002.1694023310.00000192D379D000.00000004.00000800.00020000.00000000.sdmp, RP.exe, 00000001.00000002.1694023310.00000192D377D000.00000004.00000800.00020000.00000000.sdmp, RP.exe, 00000001.00000002.1694023310.00000192D37A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipbase.com/xml/
Source: RP.exe	String found in binary or memory: https://steamcommunity.com/profiles/ASOFTWARE
Source: tmp16B1.tmp.tmpdb.1.dr	String found in binary or memory: https://support.mozilla.org
Source: tmp16B1.tmp.tmpdb.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmp16B1.tmp.tmpdb.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmp16B1.tmp.tmpdb.1.dr	String found in binary or memory: https://www.mozilla.org
Source: tmp16B1.tmp.tmpdb.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: tmp16B1.tmp.tmpdb.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: tmp16B1.tmp.tmpdb.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmp16B1.tmp.tmpdb.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: tmp16B1.tmp.tmpdb.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown

DNS traffic detected: queries for: freegeoip.app

Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: ipbase.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 172.67.160.84:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.189:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: RP.exe.0.dr, -.cs

.Net Code: @

System Summary

Malicious sample detected (through community Yara rule)

Source: RP.exe, type: SAMPLE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: RP.exe, type: SAMPLE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 1.0.RP.exe.192d19b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 1.0.RP.exe.192d19b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: RP.sfx.exe PID: 6496, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: RP.exe PID: 6660, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, type: DROPPED	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, type: DROPPED	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen

Source: RP.sfx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RP.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: RP.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 1.0.RP.exe.192d19b0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 1.0.RP.exe.192d19b0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: RP.sfx.exe PID: 6496, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: RP.exe PID: 6660, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers

Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005DC084	0_2_005DC084
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005DAA76	0_2_005DAA76
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005E3F67	0_2_005E3F67
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005D4783	0_2_005D4783
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005F4880	0_2_005F4880
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005D61C8	0_2_005D61C8
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005F4D2E	0_2_005F4D2E
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005EC52D	0_2_005EC52D
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005DCD21	0_2_005DCD21
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005D5D20	0_2_005D5D20
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005F8E34	0_2_005F8E34
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005EC75C	0_2_005EC75C
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005D5769	0_2_005D5769
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B895BDD	1_2_00007FFD9B895BDD
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B8A5432	1_2_00007FFD9B8A5432
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B8A4686	1_2_00007FFD9B8A4686
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B8913F0	1_2_00007FFD9B8913F0
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B8913F3	1_2_00007FFD9B8913F3
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B891410	1_2_00007FFD9B891410
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B891428	1_2_00007FFD9B891428
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B891458	1_2_00007FFD9B891458
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B891440	1_2_00007FFD9B891440
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B891478	1_2_00007FFD9B891478
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B891498	1_2_00007FFD9B891498

Source: C:\Users\user\Desktop\RP.sfx.exe

Code function: String function: 005E6600 appears 47 times

Source: C:\Users\user\Desktop\RP.sfx.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\RP.sfx.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RP.sfx.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\RP.sfx.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RP.sfx.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RP.sfx.exe	Section loaded: dxgidebug.dll	Jump to behavior

Source: RP.sfx.exe	ReversingLabs: Detection: 65%
Source: RP.sfx.exe	Virustotal: Detection: 42%

Source: C:\Users\user\Desktop\RP.sfx.exe

File read: C:\Users\user\Desktop\RP.sfx.exe

Jump to behavior

Source: RP.sfx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RP.sfx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RP.exe.0.dr, -.cs

Suspicious URL: 'https://api.vimeworld.ru/user/name/'

Source: unknown	Process created: C:\Users\user\Desktop\RP.sfx.exe C:\Users\user\Desktop\RP.sfx.exe
Source: C:\Users\user\Desktop\RP.sfx.exe	Process created: C:\Users\user\Desktop\RESOURCEPACK\RP.exe "C:\Users\user\Desktop\RESOURCEPACK\RP.EXE"
Source: C:\Users\user\Desktop\RP.sfx.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\RESOURCEPACK\RP.7Z
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu" "C:\Users\user\Desktop\RESOURCEPACK\RP.7Z
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RP.sfx.exe	Process created: C:\Users\user\Desktop\RESOURCEPACK\RP.exe "C:\Users\user\Desktop\RESOURCEPACK\RP.EXE"	Jump to behavior
Source: C:\Users\user\Desktop\RP.sfx.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\RESOURCEPACK\RP.7Z	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu" "C:\Users\user\Desktop\RESOURCEPACK\RP.7Z	Jump to behavior

Source: C:\Users\user\Desktop\RP.sfx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RP.sfx.exe

File created: C:\Users\user\Desktop\RESOURCEPACK

Jump to behavior

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

File created: C:\Users\user\AppData\Local\Temp\tmp16B1.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/1042@2/2

Source: C:\Users\user\Desktop\RP.sfx.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: tmp1701.tmp.dat.1.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\RP.sfx.exe

Code function: 0_2_005D193A GetLastError,FormatMessageW,

0_2_005D193A

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6824:120:WilError_03

Source: C:\Users\user\Desktop\RP.sfx.exe

Code function: 0_2_005E1D72 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_005E1D72

Source: C:\Users\user\Desktop\RP.sfx.exe	Command line argument: zyb	0_2_005E5833
Source: C:\Users\user\Desktop\RP.sfx.exe	Command line argument: sfxname	0_2_005E5833
Source: C:\Users\user\Desktop\RP.sfx.exe	Command line argument: sfxstime	0_2_005E5833
Source: C:\Users\user\Desktop\RP.sfx.exe	Command line argument: STARTDLG	0_2_005E5833

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: RP.sfx.exe

Static file information: File size 10504001 > 1048576

Source: RP.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: RP.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: RP.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: RP.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: RP.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: RP.sfx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: RP.sfx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: RP.sfx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mscorlib.pdb source: RP.exe, 00000001.00000002.1694023310.00000192D371F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: RP.exe, 00000001.00000002.1694023310.00000192D3811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: RP.sfx.exe
Source:	Binary string: System.Windows.Forms.pdbWBmD4 source: RP.exe, 00000001.00000002.1701951052.00000192EBE1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: RP.exe, 00000001.00000002.1694023310.00000192D3811000.00000004.00000800.00020000.00000000.sdmp

Source: RP.sfx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: RP.sfx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: RP.sfx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: RP.sfx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: RP.sfx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_3_031FFA44 pushad ; iretd	0_3_031FFA45
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_3_031FFA44 pushad ; iretd	0_3_031FFA45
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_3_031F68C8 pushfd ; ret	0_3_031F69BD
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_3_031F68C8 pushfd ; ret	0_3_031F69BD
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_3_031FFA44 pushad ; iretd	0_3_031FFA45
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_3_031FFA44 pushad ; iretd	0_3_031FFA45
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_3_031F68C8 pushfd ; ret	0_3_031F69BD
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_3_031F68C8 pushfd ; ret	0_3_031F69BD
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005E73C0 push ecx; ret	0_2_005E73D3
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005E6575 push ecx; ret	0_2_005E6588
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B897320 pushad ; retf	1_2_00007FFD9B89739D
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B8A05A2 push esp; retf 5F51h	1_2_00007FFD9B8A05D9
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B89021D push E95E5198h; ret	1_2_00007FFD9B890259
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B8A812B push ebx; ret	1_2_00007FFD9B8A816A
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Code function: 1_2_00007FFD9B891CFD push ebx; iretd	1_2_00007FFD9B891D0A

Source: RP.sfx.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\RP.sfx.exe

File created: C:\Users\user\Desktop\RESOURCEPACK\__tmp_rar_sfx_access_check_6951187

Jump to behavior

Source: RP.exe.0.dr

Static PE information: 0xA4B9AEFD [Sun Jul 29 11:39:41 2057 UTC]

Source: C:\Users\user\Desktop\RP.sfx.exe

File created: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

Jump to dropped file

Source: C:\Users\user\Desktop\RP.sfx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -599780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -599019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -598905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -598686s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -598247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 736	Thread sleep time: -598030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 7036	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe TID: 6800	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6780	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\RP.sfx.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-20097

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599019	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598686	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598247	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Window / User API: threadDelayed 2341			Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Window / User API: threadDelayed 985			Jump to behavior

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RP.sfx.exe

Code function: 0_2_005E5FC2 VirtualQuery,GetSystemInfo,

0_2_005E5FC2

Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005D3230 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_005D3230
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005E3AC0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_005E3AC0

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 599019	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598686	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598247	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\RP.sfx.exe

API call chain: ExitProcess graph end node

graph_0-20337

Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\font	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm	Jump to behavior

Source: RP.exe, 00000001.00000002.1703352263.00000192ECC74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RP.exe, 00000001.00000002.1703352263.00000192ECC74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareZB276RA4Win32_VideoController3SCD5359VideoController120060621000000.000000-0008187173.display.infMSBDAL61GRT_2PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemuser-PC1280 x 1024 x 4294967296 colorsGWPFFXGGly 6 Model 143 Stepping&
Source: RP.exe, 00000001.00000002.1701951052.00000192EBDCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ

Source: C:\Users\user\Desktop\RP.sfx.exe

Code function: 0_2_005E7150 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_005E7150

Source: C:\Users\user\Desktop\RP.sfx.exe

Code function: 0_2_005F3470 GetProcessHeap,

0_2_005F3470

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\RP.sfx.exe

Code function: 0_2_005EF3F2 mov eax, dword ptr fs:[00000030h]

0_2_005EF3F2

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005E7150 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005E7150
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005EB27F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005EB27F
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005E72F5 SetUnhandledExceptionFilter,	0_2_005E72F5
Source: C:\Users\user\Desktop\RP.sfx.exe	Code function: 0_2_005E6683 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_005E6683

Source: C:\Users\user\Desktop\RP.sfx.exe	Process created: C:\Users\user\Desktop\RESOURCEPACK\RP.exe "C:\Users\user\Desktop\RESOURCEPACK\RP.EXE"	Jump to behavior
Source: C:\Users\user\Desktop\RP.sfx.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\RESOURCEPACK\RP.7Z	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu" "C:\Users\user\Desktop\RESOURCEPACK\RP.7Z	Jump to behavior

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

Queries volume information: C:\Users\user\Desktop\RESOURCEPACK\RP.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\RP.sfx.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_005E2758

Source: C:\Users\user\Desktop\RP.sfx.exe

Code function: 0_2_005D7228 cpuid

0_2_005D7228

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\RP.sfx.exe

Code function: 0_2_005E5833 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_005E5833

Source: C:\Users\user\Desktop\RP.sfx.exe

Code function: 0_2_005D33B7 GetVersionExW,

0_2_005D33B7

Stealing of Sensitive Information

Yara detected 44Caliber Stealer

Source: Yara match	File source: RP.exe, type: SAMPLE
Source: Yara match	File source: 1.0.RP.exe.192d19b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RP.sfx.exe PID: 6496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RP.exe PID: 6660, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, type: DROPPED

Yara detected Rags Stealer

Source: Yara match	File source: RP.exe, type: SAMPLE
Source: Yara match	File source: 1.0.RP.exe.192d19b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RP.sfx.exe PID: 6496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RP.exe PID: 6660, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, type: DROPPED

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe

File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\

Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RP.sfx.exe, 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Dash-Qt%\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: RP.sfx.exe, 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Dash-Qt%\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: RP.sfx.exe, 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Dash-Qt%\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: RP.sfx.exe, 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Dash-Qt%\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: RP.sfx.exe, 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Dash-Qt%\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: RP.sfx.exe, 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Dash-Qt%\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: RP.sfx.exe, 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Dash-Qt%\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: RP.sfx.exe, 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Dash-Qt%\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match	File source: RP.exe, type: SAMPLE
Source: Yara match	File source: 1.0.RP.exe.192d19b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RP.sfx.exe PID: 6496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RP.exe PID: 6660, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, type: DROPPED

Remote Access Functionality

Yara detected 44Caliber Stealer

Source: Yara match	File source: RP.exe, type: SAMPLE
Source: Yara match	File source: 1.0.RP.exe.192d19b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RP.sfx.exe PID: 6496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RP.exe PID: 6660, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, type: DROPPED

Yara detected Rags Stealer

Source: Yara match	File source: RP.exe, type: SAMPLE
Source: Yara match	File source: 1.0.RP.exe.192d19b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RP.sfx.exe PID: 6496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RP.exe PID: 6660, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	56 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	241 Security Software Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RP.sfx.exe	65%	ReversingLabs	ByteCode-MSIL.Infostealer.Stealgen
RP.sfx.exe	43%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Desktop\RESOURCEPACK\RP.exe	100%	Avira	HEUR/AGEN.1314536
C:\Users\user\Desktop\RESOURCEPACK\RP.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\RESOURCEPACK\RP.exe	78%	ReversingLabs	ByteCode-MSIL.Trojan.DataStealer
C:\Users\user\Desktop\RESOURCEPACK\RP.exe	57%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ipbase.com	1%	Virustotal		Browse
freegeoip.app	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/Z	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/1162710207558852689/c241__Tv-C5fSE0jsivUVIhYUTy9AQG_2q-Wedc4i61WcTi	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/	0%	Avira URL Cloud	safe
https://freegeoip.app	0%	Avira URL Cloud	safe
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/	1%	Virustotal		Browse
http://ipbase.com	0%	Avira URL Cloud	safe
http://www.heaventools.comDVarFile	0%	Avira URL Cloud	safe
https://freegeoip.app	1%	Virustotal		Browse
https://discord.com/api/webhooks/1162710207558852689/c241__Tv-C5fSE0jsivUVIhYUTy9AQG_2q-Wedc4i61WcTi	0%	Virustotal		Browse
http://crl.m0	0%	Avira URL Cloud	safe
https://ipbase.com/xml/	0%	Avira URL Cloud	safe
http://www.heaventools.comDVarFileInfo$	0%	Avira URL Cloud	safe
https://ipbase.com	0%	Avira URL Cloud	safe
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Virustotal		Browse
http://freegeoip.app	0%	Avira URL Cloud	safe
http://ipbase.com	1%	Virustotal		Browse
https://ipbase.com/xml/	0%	Virustotal		Browse
https://ipbase.com	1%	Virustotal		Browse
http://freegeoip.app	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipbase.com	104.21.85.189	true	false	1%, Virustotal, Browse	unknown
freegeoip.app	172.67.160.84	true	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://freegeoip.app/xml/	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipbase.com/xml/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	tmp16B1.tmp.tmpdb.1.dr	false		high
https://duckduckgo.com/ac/?q=	tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	false		high
https://freegeoip.app/xml/Z	RP.exe, 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	false		high
https://steamcommunity.com/profiles/ASOFTWARE	RP.exe	false		high
https://discord.com/api/webhooks/1162710207558852689/c241__Tv-C5fSE0jsivUVIhYUTy9AQG_2q-Wedc4i61WcTi	RP.exe	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://freegeoip.app	RP.exe, 00000001.00000002.1694023310.00000192D3763000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	cert9.db.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	cert9.db.1.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmp16B1.tmp.tmpdb.1.dr	false		high
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	RP.exe, 00000001.00000002.1694023310.00000192D3811000.00000004.00000800.00020000.00000000.sdmp, RP.exe, 00000001.00000002.1694023310.00000192D3799000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	false		high
http://www.heaventools.comDVarFile	RP.sfx.exe, 00000000.00000003.1652957890.0000000003243000.00000004.00000020.00020000.00000000.sdmp, RP.sfx.exe, 00000000.00000002.1654513305.0000000003243000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ipbase.com	RP.exe, 00000001.00000002.1694023310.00000192D37B6000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.m0	RP.exe, 00000001.00000002.1701951052.00000192EBE1C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	cert9.db.1.dr	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	cert9.db.1.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	cert9.db.1.dr	false	URL Reputation: safe	unknown
http://www.heaventools.comDVarFileInfo$	RP.exe	false	Avira URL Cloud: safe	low
https://api.vimeworld.ru/user/name/	RP.exe, 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.vimeworld.ru/user/name/5https://freegeoip.app/xml/	RP.exe	false		high
https://support.mozilla.org	tmp16B1.tmp.tmpdb.1.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RP.exe, 00000001.00000002.1694023310.00000192D3763000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp16C1.tmp.dat.1.dr, tmp1721.tmp.dat.1.dr	false		high
https://ipbase.com	RP.exe, 00000001.00000002.1694023310.00000192D37A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://freegeoip.app	RP.exe, 00000001.00000002.1694023310.00000192D377D000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.85.189	ipbase.com	United States		13335	CLOUDFLARENETUS	false
172.67.160.84	freegeoip.app	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1347830
Start date and time:	2023-11-26 01:32:07 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	RP.sfx.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/1042@2/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 158 Number of non-executed functions: 73
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target unarchiver.exe, PID 6704 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:32:58	API Interceptor	19x Sleep call for process: RP.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.85.189	i6R4NsEd8t.exe	Get hash	malicious	Snake Keylogger	Browse
	rvYr7FRwkG.dll	Get hash	malicious	Unknown	Browse
	case (426).xls	Get hash	malicious	Unknown	Browse
	case (61).xls	Get hash	malicious	Unknown	Browse
172.67.160.84	3vj5tYFb6a.exe	Get hash	malicious	Snake Keylogger, zgRAT	Browse
	7nYkVlcnfx.exe	Get hash	malicious	Snake Keylogger	Browse
	Yandex.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse
	A6KiC17VqI.exe	Get hash	malicious	Snake Keylogger	Browse
	ljlZS3NiAP.exe	Get hash	malicious	Snake Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
freegeoip.app	i6R4NsEd8t.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.73.97
	3vj5tYFb6a.exe	Get hash	malicious	Snake Keylogger, zgRAT	Browse	172.67.160.84
	7nYkVlcnfx.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.160.84
	bcAE21roAv.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.73.97
	VegaStealer_v1.bin.exe	Get hash	malicious	Ades Stealer, NitroStealer	Browse	104.21.73.97
	Yandex.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	172.67.160.84
	SPYGAME.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	104.21.73.97
	A6KiC17VqI.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	TwB13kUEGN.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	w5gL8sZU6z.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	k2Bg5AlSk1.exe	Get hash	malicious	MassLogger RAT, Matiex, Snake Keylogger	Browse	188.114.97.7
	vYT3XBi8du.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	CJCxcYxjhF.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	g95CmPy67V.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	nesbiPpHpN.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	M6VkStAYfV.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	2yecaxS2wK.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	058J3H4iEy.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	jINnuKt8Yz.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.13
	XuwCD7R8y8.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	188.114.96.7
ipbase.com	i6R4NsEd8t.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.85.189
	3vj5tYFb6a.exe	Get hash	malicious	Snake Keylogger, zgRAT	Browse	104.21.28.190
	7nYkVlcnfx.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.147.81
	bcAE21roAv.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.147.81
	VegaStealer_v1.bin.exe	Get hash	malicious	Ades Stealer, NitroStealer	Browse	75.2.60.5
	Yandex.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	75.2.60.5
	SPYGAME.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	75.2.60.5
	A6KiC17VqI.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	TwB13kUEGN.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	w5gL8sZU6z.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	k2Bg5AlSk1.exe	Get hash	malicious	MassLogger RAT, Matiex, Snake Keylogger	Browse	75.2.60.5
	vYT3XBi8du.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	CJCxcYxjhF.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	g95CmPy67V.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	nesbiPpHpN.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	M6VkStAYfV.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	2yecaxS2wK.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	058J3H4iEy.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	jINnuKt8Yz.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	XuwCD7R8y8.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	99.83.231.61

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, Glupteba, RedLine, SmokeLoader	Browse	172.67.139.220
	https://pub-f2a7a6151b8e45fa9c87891a1b3af4cb.r2.dev/new.html?email=a21pbgxlckbtam1pbgxlcmnvlmnvbq==	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.kmb.net.cn/login	Get hash	malicious	Unknown	Browse	104.18.36.155
	https://www.ydjlseub.asia/login	Get hash	malicious	Unknown	Browse	104.18.36.155
	https://go2cup.com/gonow-auth	Get hash	malicious	Unknown	Browse	104.21.54.104
	https://netflix.cnetms.info/	Get hash	malicious	Unknown	Browse	104.16.125.175
	file.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, Glupteba, RedLine, SmokeLoader	Browse	104.21.65.24
	file.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, Glupteba, RedLine, SmokeLoader	Browse	104.21.43.130
	https://sei.d955503313d5.space/p/redi.4ae61c3f5ad7.space/ZnVqjDpDtiijW6qabYSd87uArvjxCMGe9Heqpp1hBFGWRxqtJb4UT/123/f.eeee48295dd7.space/chunklist_hd.m3u8	Get hash	malicious	Unknown	Browse	172.64.206.3
	12.exe	Get hash	malicious	Njrat	Browse	104.17.2.184
	12345.exe	Get hash	malicious	Njrat	Browse	104.17.25.14
	1.jar	Get hash	malicious	Unknown	Browse	172.67.72.205
	https://facebooksignpn.com/FBADSS/VJQJRME.html	Get hash	malicious	HTMLPhisher	Browse	172.67.17.71
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.70.83
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse	104.21.65.24
	Aaum2J8m1s.exe	Get hash	malicious	DCRat, zgRAT	Browse	104.21.3.45
	AUS_9141124-2023.exe	Get hash	malicious	FormBook	Browse	172.67.190.116
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader	Browse	172.67.139.220
	Metamask_Main_FERMA.xlsm	Get hash	malicious	Unknown	Browse	104.21.84.67
	https://selligenttier.naylorcampaigns.com/track?type=click&enid=ZWFzPTEmbXNpZD0mYXVpZD0mbWFpbGluZ2lkPTYyNDExMiZtZXNzYWdlaWQ9NjI0MTEyJmRhdGFiYXNlaWQ9NjI0MTEyJnNlcmlhbD0xNjgyODQwNyZlbWFpbGlkPVRpbUBFbGV2YXRlZGNnLmNvbSZ1c2VyaWQ9MjExMTg2JnRhcmdldGlkPSZtbj0mZmw9Jm12aWQ9JmV4dHJhPSYmJg==&&&9999&&&https://vegannightmarket.com/hsvds/UCIfO/amFjb3BvX21vc2NhQHRyZWtmci5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.18.2.35
CLOUDFLARENETUS	file.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, Glupteba, RedLine, SmokeLoader	Browse	172.67.139.220
	https://pub-f2a7a6151b8e45fa9c87891a1b3af4cb.r2.dev/new.html?email=a21pbgxlckbtam1pbgxlcmnvlmnvbq==	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.kmb.net.cn/login	Get hash	malicious	Unknown	Browse	104.18.36.155
	https://www.ydjlseub.asia/login	Get hash	malicious	Unknown	Browse	104.18.36.155
	https://go2cup.com/gonow-auth	Get hash	malicious	Unknown	Browse	104.21.54.104
	https://netflix.cnetms.info/	Get hash	malicious	Unknown	Browse	104.16.125.175
	file.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, Glupteba, RedLine, SmokeLoader	Browse	104.21.65.24
	file.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, Glupteba, RedLine, SmokeLoader	Browse	104.21.43.130
	https://sei.d955503313d5.space/p/redi.4ae61c3f5ad7.space/ZnVqjDpDtiijW6qabYSd87uArvjxCMGe9Heqpp1hBFGWRxqtJb4UT/123/f.eeee48295dd7.space/chunklist_hd.m3u8	Get hash	malicious	Unknown	Browse	172.64.206.3
	12.exe	Get hash	malicious	Njrat	Browse	104.17.2.184
	12345.exe	Get hash	malicious	Njrat	Browse	104.17.25.14
	1.jar	Get hash	malicious	Unknown	Browse	172.67.72.205
	https://facebooksignpn.com/FBADSS/VJQJRME.html	Get hash	malicious	HTMLPhisher	Browse	172.67.17.71
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.70.83
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse	104.21.65.24
	Aaum2J8m1s.exe	Get hash	malicious	DCRat, zgRAT	Browse	104.21.3.45
	AUS_9141124-2023.exe	Get hash	malicious	FormBook	Browse	172.67.190.116
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader	Browse	172.67.139.220
	Metamask_Main_FERMA.xlsm	Get hash	malicious	Unknown	Browse	104.21.84.67
	https://selligenttier.naylorcampaigns.com/track?type=click&enid=ZWFzPTEmbXNpZD0mYXVpZD0mbWFpbGluZ2lkPTYyNDExMiZtZXNzYWdlaWQ9NjI0MTEyJmRhdGFiYXNlaWQ9NjI0MTEyJnNlcmlhbD0xNjgyODQwNyZlbWFpbGlkPVRpbUBFbGV2YXRlZGNnLmNvbSZ1c2VyaWQ9MjExMTg2JnRhcmdldGlkPSZtbj0mZmw9Jm12aWQ9JmV4dHJhPSYmJg==&&&9999&&&https://vegannightmarket.com/hsvds/UCIfO/amFjb3BvX21vc2NhQHRyZWtmci5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.18.2.35

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	RH23148_PO-1483.scr.exe	Get hash	malicious	Unknown	Browse	104.21.85.189 172.67.160.84
	Aluminum_plate_&_bar_requirement.scr.exe	Get hash	malicious	Unknown	Browse	104.21.85.189 172.67.160.84
	PEL_-_V2_-_22112023_-_TEMIKA_LTD.scr.exe	Get hash	malicious	zgRAT	Browse	104.21.85.189 172.67.160.84
	RH23148_PO-1483.scr.exe	Get hash	malicious	Unknown	Browse	104.21.85.189 172.67.160.84
	Aluminum_plate_&_bar_requirement.scr.exe	Get hash	malicious	Unknown	Browse	104.21.85.189 172.67.160.84
	Contract_-_8001569.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.85.189 172.67.160.84
	Comprovante_Pix.vbs	Get hash	malicious	Netcat	Browse	104.21.85.189 172.67.160.84
	Clylm.exe	Get hash	malicious	Clipboard Hijacker	Browse	104.21.85.189 172.67.160.84
	C4PROloader.exe	Get hash	malicious	Clipboard Hijacker	Browse	104.21.85.189 172.67.160.84
	SecuriteInfo.com.Win32.PWSX-gen.13139.11757.exe	Get hash	malicious	AgentTesla	Browse	104.21.85.189 172.67.160.84
	Comprovante_Pix_023103.vbs	Get hash	malicious	Netcat	Browse	104.21.85.189 172.67.160.84
	bRQD.exe	Get hash	malicious	Njrat	Browse	104.21.85.189 172.67.160.84
	LAM_CHUAN_#710036288.exe	Get hash	malicious	AgentTesla	Browse	104.21.85.189 172.67.160.84
	SHIPPING_ADVICE.exe	Get hash	malicious	AgentTesla	Browse	104.21.85.189 172.67.160.84
	chima.exe	Get hash	malicious	AgentTesla	Browse	104.21.85.189 172.67.160.84
	REVISE_FDA.exe	Get hash	malicious	AgentTesla	Browse	104.21.85.189 172.67.160.84
	QUOTATIO.EXE.exe	Get hash	malicious	AgentTesla, NSISDropper	Browse	104.21.85.189 172.67.160.84
	https://events.bizzabo.com/auth/emailAssociatedLogin/verify=%20TokenAndRedirect?token=3DS9NcmjZghhHTu-K8Bn2uA9CkNhbMdZVLD_YG9HzIwMWMvvRTd-=%20dklFn2bExx7385&eventGroupId=3D26969&redirectUrl=3Dhttps://elladobue=%20nodecadadia.com/...hummm/606prime/dave.cox11/24/2023/dave.cox@midlandcomput=%20ers.com/	Get hash	malicious	Unknown	Browse	104.21.85.189 172.67.160.84
	60.exe	Get hash	malicious	AgentTesla	Browse	104.21.85.189 172.67.160.84
	cf.exe	Get hash	malicious	Babuk, Conti, Python Ransomware, StormKitty, TrojanRansom	Browse	104.21.85.189 172.67.160.84

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	626
Entropy (8bit):	4.138724150072064
Encrypted:	false
SSDEEP:	6:pYcCFWl4BjJCYZVIKwvjE513wSTekc5vu0GhPz7Vg3KFUA67X:pYzd/rg7EDASTekc5vV2Pz7V0KiA6r
MD5:	3CC7F4249870D0D7FC090CB9778EF0B8
SHA1:	B5EE0B1151E5F0864E94F501A75CFBEBD8C6EECB
SHA-256:	63591BC19314E738EE317D81D2ACA0413EDB8522B94017B819860297F0EE7333
SHA-512:	D3BBF7E9AC4C2E3D923D046F549007E39C89430A29A6355C641DDAAA81FA6742DDE29B56FDA40987491D6B1F24E785D6CFA4807897110C2BFA6824937867477A
Malicious:	false
Reputation:	low
Preview:	==================================================. Operating system: Windows 10 Pro (64 Bit). PC user: 128757/user. ClipBoard: . Launch: C:\Users\user\Desktop\RESOURCEPACK\RP.EXE. ==================================================. Screen resolution: 1280x1024. Current time: 26/11/2023 04:02:46. HWID: 09E00F116B. ==================================================. CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz. RAM: 4094MB. GPU: L61GRT_2. ==================================================. IP Geolocation: Fail Fail. Log Date: 11/26/2023 1:32. BSSID: 00:50:56:a7:21:15. ==================================================

C:\ProgramData\44\Process.txt

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4337
Entropy (8bit):	4.90645874760116
Encrypted:	false
SSDEEP:	24:XhPYMhPhPx85wQUqHIhPuhPVEhPhPhPqqIqpqQUqqhP+qqhPqhPXsqqQUphPxhPb:0dsChStFAKEltsfNL
MD5:	4A7BF1821E31CB22EA73AD10DCBEF795
SHA1:	9774829192AC150A6D896F12C40048A8F62B0C04
SHA-256:	F600825EAEB48D3BD0E5609812A145FC93690E8ABDF1C18F439153A54A7CE77C
SHA-512:	3E2F927BB03AC73FB443CB7369D7D755AFC459EEAA806922CE1D9213A71031EA85723F87A6E6C9B6C8DF778AFF1388DD84CC76D526045E41D298B4AA7D6F9E32
Malicious:	false
Reputation:	low
Preview:	NAME: svchost..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: explorer..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: fontdrvhost..NAME: smartscreen..NAME: RuntimeBroker..NAME: svchost..NAME: csrss..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: sihost..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: OfficeClickToRun..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: svchost..NAME: svchost..NAME: dasHost..NAME: svchost..NAME: ctfmon..NAME: svchost..NAME: RuntimeBroker..NAME: svchost..NAME: svchost..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: smss..NAME: svchost..NAME: svchost..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: svchost..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: dllhost..NAME: svchost..NAME: svchost..NAME: RuntimeBroker..NAME: StartMenuExperienceHost..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: fontdrvhost..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: vjwrIptgCNlomxKPnmgiCVMxOSg..NAME: TextInputHost..NAME: svchost..NAME:

C:\ProgramData\44\Screen.png

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	715319
Entropy (8bit):	7.924006323287595
Encrypted:	false
SSDEEP:	12288:1TGypOR+KLzP7UKMkebkWWS/IvGQWcnhPbXCL5bbc8PL6DsDBw0kQUuGU:kcD27UNbWGQ/nhDU5bY8ukBw07Ug
MD5:	2B1951D536EC50846A4A6C5874ACA9B3
SHA1:	83B14E493CC8FE92EDF0401E8912CDA313B89DE3
SHA-256:	DE03E5BB2EA9EDE0422BD7D0A0444D7BE9A4B2742353D1897267A937931982FF
SHA-512:	CA5B64681748088346AD7243182270E06A79238F9A8D6A2A9D0CC9B19807CCBCA83BBD9E3BBE7080352EBAE35CF82FCF570475F404FC1903BFE89854F237C4C7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.w.e..{ofyz....D.x..y....M.i3....e....K%@..@B..... ..F ..A ..V ..{+..H..o..;...u]....%._..^{..'...b.sZ.S^K.......;.Z...^'...I3C.D..9.L...:.~.p.K.(>.....F.L...;n.../..^..Wl.h.ai.3=ZG??-..i..U..RZ+....#.s=i.n..`..>.....R.>...c..u.S.1........c.}...b.k..,.=6R._}t(..._yd...p....Ic_zx../>../.[?..}m.)0.....>....s..h....1.....}=./.........x..'-o..?qo...{3..v_.}..=..+fl.{2.{T.}........2Gc..1.w...k,.x.1...\|..]......Z..-...i..;&1...3c..-..\|_9...W0...c.h.rkj}.....[\|..Z3f..;W........^5.5...o.h<..-Ml..H.v.=v.)..xc..X`.....\|s.-...4.G....{..]w.....S{..Rk..s......,.. .v....E......,.v.y.omum.c<n......>6f.-!..!.....a<...mu]...Ml...............[.[\.._...-.~..&3.....U..a..v-k[._...os]f..v]..%..B.Y...?..kr..b..7.=7.*....`s.of..c.\....J..c{va\|.3e...Ml...K.Lc.]...6..5..7....s.a.&....b-..Ml..6...[..,o.....v]..S. .<0.hS{.....[.\..._..Z.].c.....s....oc....b...5..

C:\Users\Public\fqs92o4p.default-release\cert9.db

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 7, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	0.64343788909108
Encrypted:	false
SSDEEP:	384:A1zkVmvQhyn+Zoz67dNlIMMz333JGN8j/LKXYj5kuv:AUUMXCyIr
MD5:	B6787B79D64948AAC1D6359AC18AB268
SHA1:	0831EB15AB2B330BE95975A24F8945ED284D0BA4
SHA-256:	9D6FD3B8AB8AA7934C75EDE36CEB9CF4DDAD06C5031E89872B4E814D7DB674E2
SHA-512:	9296866380EF966F1CB6E69B7B84D1A86CD5AE8D9A7332C57543875FAA4FC7F1387A4CF83B7D662E4BAB0381E4AFC9CB9999075EBB497C6756DF770454F3530E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\fqs92o4p.default-release\key4.db

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436842005578409
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vIn:51zkVmvQhyn+Zoz67n
MD5:	2CD2840E30F477F23438B7C9D031FC08
SHA1:	03D5410A814B298B068D62ACDF493B2A49370518
SHA-256:	49F56AAA16086F2A9DB340CC9A6E8139E076765C1BFED18B1725CC3B395DC28D
SHA-512:	DCDD722C3A8AD79265616ADDDCA208E068E4ECEBE8820E4ED16B1D1E07FD52EB3A59A22988450071CFDA50BBFF7CB005ADF05A843DA38421F28572F3433C0F19
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RP.EXE.log

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	5.364175471524945
Encrypted:	false
SSDEEP:	24:ML9E4KQEAE4KKUNt1qE4GIsCKDE4KGKZI6KhPKIE4TKBGKoPE4K6sXE4Npv:MxHKQEAHKKkt1qHGIsCYHKGSI6oPtHTy
MD5:	D70164A2669BAC5564AE9329650DB5AE
SHA1:	D918ED8E2C94480B29A5FD1403F32C9555CADB60
SHA-256:	1795A022ED26274E44D1C5FE93C7CEDD53D18378FA2DF5B6EF91408F234B8A95
SHA-512:	82E357E433C1AFB7026A4E6D146743A0720C6E67062349CAC2795EC70A6B76B210F84A64CFEAB94D406AAA55D98A5BEAF5054FED9D0A322B66ED10BE15DAB9B5
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906

C:\Users\user\AppData\Local\Temp\tmp16B1.tmp.tmpdb

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp16C1.tmp.dat

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1701.tmp.dat

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1721.tmp.dat

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1751.tmp.dat

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1752.tmp.tmpdb

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1772.tmp.dat

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp17B2.tmp.dat

Download File

Process:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\font\glyph_sizes.bin

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.774601752656371
Encrypted:	false
SSDEEP:	192:CNTR6hAS+8fG3JK/kwnkQiqnfO8+yjDCnJDw6xUaD+6g3Zomt:5hASACfhfCnjSTZt
MD5:	B3974D56789D3C2DF2CDB064088B5F88
SHA1:	A61CD6E8D64BE7BBA1619A91A2AB271696356923
SHA-256:	BB6F26F87BFE31A4E107986ECB30D5AC82C656FBBE09DF3C8AABBC1C948D0665
SHA-512:	6D92B0DF7DF53E3C8236DB2B61BC32B69F3F6EA6AC87609206A476521E56D27D8968C5869603C55C258806254A0E0731A11582935BFD701110B2F39741A56642
Malicious:	false
Preview:	...............................................................................................................................................................................................................................................................................................................................................................................................%.......................&..&.....................................3$.D...........&&..................................................................................&................%...................................................&5&..6..............................................&.............'.....&&%&.....$.444%%..%%..%%D%%%D%%%$$%%.....4%F.....$...............55%$...4$$$$.......................................................................................................................%%....4...4.....3..5..................................&....5..........................%..................&.......&..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\brown\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.506281902871664
Encrypted:	false
SSDEEP:	6:6v/lhPUeoz4ZA3teAkojFopEwiv1Qr0Az3q0/q36HR8myJqM5sTp:6v/78xPKoSqwd0og3i8lAM5e
MD5:	0C0B36BED017EA21E46D9EE7AB1E8383
SHA1:	090649D980C900BAED2BC9D4A96FB9AB49AE3893
SHA-256:	1CBD6262A2009283A65D1A841331A56BD29E071F78970114E0C42588B9322665
SHA-512:	B359935D4D1881E5FE800718CAB68EC23AAEE33175031306E3DA146918045F8A236A2CB2ECE310FADC5AE44FF725C424057E35B3AC2990E2BC9FD7AC7EB8F1CB
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...m...m.a..3....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....6...6...b,P..qY..<&Ap..1..QV......1..{).......[..NX.7.^S.a<...6...(.I.m~...a.!.&.........-".....iA..Xa....,j...p....q.h...h...p.lvOAP.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\brown\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.578078943454634
Encrypted:	false
SSDEEP:	6:6v/lhPUeoz4ZA3teAuoikWFx+TrutqR8myjV9Aq/p:6v/78xPox+TrutQ8lp9AK
MD5:	2DE73C669E703C9AFF2C3F47CCE42A42
SHA1:	2B027988BF634A4E67F23553743848FF0C0B4606
SHA-256:	5AAB4E8769475ADB923BFF47B81F7D3805EBDA11C868E466BC496A429649426E
SHA-512:	F81D8E4F110D26B29B4EFB926C44F9B115EBF08C13DEC97891C8CC1768276BB0FEF9BC2DEE71C911FE55C60958C9DF1B421830A9BEA66DDC06E603B70A2E6349
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...m...m.a..3....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...6...6...b,P.8..../Ap........B+..........g...<.VX.7.^U.a<...6.....Ip.m~...a.".&.........-".....iA..Xa....,....p....q.hp..h.....~.OA.4.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\brown\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.691347960583354
Encrypted:	false
SSDEEP:	6:6v/lhPUeoz4ZA3teLTn2Q13e3nOE4JXdwjsVy93WHXhwaVp:6v/78xPvQ13Cnr4S5lAXWA
MD5:	D60A2F7CA52A384C17EC5B4DFE19941B
SHA1:	D49DFC83DF480284B6C2739460E96A789C91169F
SHA-256:	B91CDF042E30AA4EC9BDC2093761910D3B2FD2D0E9F62E8B5A26A36822FDA74C
SHA-512:	8A61727488A26F9C29C3A067BD01D0C4965D4AC0C1926BBD979813FCB8FB9E1B1EBD55A26DF7D8F04FEC3DAEBF1B031F7C799F7CA8BD1F22301379FDA9CAAC84
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...m...m.a..3....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D....6...6...b(P.:...sx.,.c.D7.>../H....{...Z.....g.+.....f.U...3a......9.n...p.eX......g..g.......m*,....3b..2.@`Q=,...<Lm.kF.'..6"..;.....P+.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\brown\48.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.533791415580225
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lQkx8DVlZDUldp:6v/lhPAkRTp
MD5:	E7D31AC53D124242B574C8090362FFC6
SHA1:	39BB8F5AD0330977037D5C25C53B2E66B1CEC898
SHA-256:	A901AFAE7BDB66678F08A39B32F8A46DA9864C8A64FABC0E77A7F12B93DF12BA
SHA-512:	96D66670CC0D53E5B937B6136A69BACE772DB75D76A7DEC8102F47E3DCA2E739AF5E82A01696BA6288CAD3B001CCCEE82CD2D285320D190B870175EC3D4956AA
Malicious:	false
Preview:	.PNG........IHDR................a....IDATx.c`...`...........E.,....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\brown\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.720745160145844
Encrypted:	false
SSDEEP:	6:6v/lhPUeoz4ZA3tefXrKla7A6SoCe7iyqdTXNCup:6v/78xPgXWla86SKiJdzNj
MD5:	90EC2C31FF831D879CC88179ED4097AB
SHA1:	C4F3A856330AF4B712B660E8AD8D57DF07D72B7F
SHA-256:	EC32700508951C6D7FE3140B37AB64BE6DDAE3E7590DFDC8DD25E8BAB921F94F
SHA-512:	96E8DE8365A7CFB6BBDA967426FCC67F67C4693FE849500F340C6028B6A099299A85A3C2CBDBCD506B409C7FF1AECE94E079E35F77FCD7E6DE940F3905D13F3A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...m...m.a..3....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E.I..5d.?\.o.wp.'`2.......I*..R.B...X..>.!@.>0...Z[...7.x.o. X(~.lk..w..s..w....#..1.dg.W.....d.......3..k....6.........Wl...J.(_.D..:Lk......}NAD.......X-kth.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\brown\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.773143087213459
Encrypted:	false
SSDEEP:	6:6v/lhPUeoz4ZA3tefR59W0P2sR6IbZPiWdWILJhem610Hdp:6v/78xPg00V6IbZ6D2Jiuz
MD5:	CA2D24B9A14169B1188A333A699A11EA
SHA1:	76FB02B054CF067D7419114C77BBECBE1E13A771
SHA-256:	5D19E040E393E8CD4E1A61559CB0E962689F8C757D4735E8663587C519D3BDD9
SHA-512:	B45431B85544DD20F30497499C1F9E15A40060BB32911A121DBB719FA2CCDE87B26B5809613438D80376BE651D9015DBF1A617BD44F5A982435B7F66E3873F73
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...m...m.a..3....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D.I.6........z..*.2.......?^.eg.,...R..>..@.i.R]..]Y..G....F.F..Kk.d..u.T.{.C.].X....;{x3.$04.'...&a.....O_S ec.....g...xb;....h$....u`..k..f.....S>M...r..HX-.SbW....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\brown\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.654485640222994
Encrypted:	false
SSDEEP:	6:6v/lhPUeoz4ZA3teTkcJkPLu3hmudiuE1lViWxFkiV5OTmAxVp:6v/78xPYWi35i5lXxFk7d7
MD5:	15D5D8098D093B56456D2DB685575211
SHA1:	6C263F76CAB4672625A2DB58BFA4F7E4C22D167A
SHA-256:	766B886CF40A14434FEDBFB919006413EA79E6905B74F858DC24F08F3D6729C1
SHA-512:	69C4E3FF70C99F1EE7C51DDD471B2FF9E88462A8543353A2471BDC14632464F6E90634ED1E8E65A149C745953F794846E5A498AB3B2FE3E3733C5D813AC43A74
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...m...m.a..3....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...6...6....l...L6.g..c...e..h.\|.../..E..Dx.....$y......^y.,p].k.`...a...um.0l..Ip.m.3.W...2,T.............v....h..\|.\|....@p.YT..$.0.S..5...>F.C..wvq.Q.T4.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\brown\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.677832280332761
Encrypted:	false
SSDEEP:	6:6v/lhPUeoz4ZA3teM/5kojFGqPamBKQ1/QknoctqGVUgkB42I/2up:6v/78xPx6oN1BKOQkbtP2gk5I2c
MD5:	DBCA60670BBD885C9856ED7373AAD283
SHA1:	424A1DE27BD13D042E398CC43ACEA623FC41F1B6
SHA-256:	CAC7394384EFDE6AEE6E404A6E74F11BE648CA80EA98CF36321B81C6DF2135D9
SHA-512:	ECB79487C7BF14C261CD549CE3499C7E32C0256C221E9C0BF9D387BAFC828C341739027F777901E44280004877B089D78637E72836BEF8C6A2A82C06E56129F1
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...m...m.a..3....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....6...6....l...L....Q.. ...h.o.D......5.s!-.0%.l/ek..Y.#\|+......W.p...Z...[..$..6.f..a. .&.........-&..5.........z.5.XT..$.0.Sk......F..w......T4.o......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\brown\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.690380032786376
Encrypted:	false
SSDEEP:	6:6v/lhPUeoz4ZA3tepmoWHrUbQWabFTlFZ2+Sq2Zkp:6v/78xP5frFIBZm
MD5:	3B09AF591AEA95C1C96A057E5AC6DCFF
SHA1:	FAB50240E803E01BCD5DD07DC4CC6F17D3377184
SHA-256:	9C45D320DB8A2723EB7723E3DBBB49A319B4D8DEF0C06EE98961335DF528A10C
SHA-512:	1A7A1F1D5A3BCF5731CFCA980E55A5A59D6FA54335CDE9C9E84F4AE812E6EA0D8EAD192F5D0807907834C71836692997F1827E998655C68EA44368E0CF8E3E53
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...m...m.a..3....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...6...6...b,P.:....K...d...~..._q."4OH+}.w#..%<..r!.`]~Y.....0.kC.a..........z..*.n.......p..".....X...\|...Q..E..@...0.6...v..mD..w....O.b......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\brown\glass_brown.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.9361804341297555
Encrypted:	false
SSDEEP:	3:a5I7kRo42O:aWARv2O
MD5:	0439CE6AB85DD2CBC686B8A734C9F658
SHA1:	A71DF6019FB6808328878B237DA344D408F7021F
SHA-256:	29FF9E7DCA6AA326F861A32A3728FFDD4397A3BBC7C86180F59E397AB2820C2C
SHA-512:	DDE10CC8839FD75AA42158B387D1CADFD6C600A6A82CA349E9E0F6209920CCE6FE73E814DD37CBE8CAAB7C4FA8352355A33500333F2F64FC72E48E2262A9210F
Malicious:	false
Preview:	tiles=1-48..metadata:12

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.695479796179129
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tefWD1FXc5yS6Clo0EArntJlj5GRE1up:6v/78mgWBFMUp0E+JZ1c
MD5:	E8FE7F2ED052FDFD9A29106527172C51
SHA1:	437D865753DE8273B10B11C50ABC1E8B4A985695
SHA-256:	2787A541DC36069AF7814E9FC9FDA48D63310853F6017B97E9E0A6D109B92CC7
SHA-512:	566246547B468FE40F5789AEE6A080F9CB41D06069849198D75518E7858C402889B741DE62108D84E4B98E84CF5F2F959C9B46C9664040A43F6897B2FFE4E839
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.. .E=........&..\..p2.$M>.../b..........8..@.........43.b..z7...........8.b...Q.X....=..t...'...v.b.}...]...`.&Pc;.j.{...xb..Hj4...@.:0k.c..b.yT.......\|./...B.p.T....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.665671527728666
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teLP1BxMfcBXi95+TavUT7cHljp:6v/78mgP1BDhQgTa8TWN
MD5:	5BD112E73EB9F9082EDD5CFD7AC44FF0
SHA1:	9315B81EE84178C905784079929432E2F0F5EF96
SHA-256:	3CBE12275AD06E3D050D6E8D2D762B6F75E54AB93C05B7D4D2D1CABAAB9E4C97
SHA-512:	66B87B0C58286B0DEBA86E2CC73C674B40951E188843F23A5125E1CEE61EC3E9FD39989EBAEDFA13FF9F49C68527D2406D56F248F076BC6BA35A10486CAA631E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..;.. .D.....X.RP.X.=<...f...x...,..CZ]H......3..d.....GxV..3./_.{M...L....`.:g.in.j.\...Z.n.......p.."....a.^-....+.......a....ajm.....MT..wv!...H....A....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	286
Entropy (8bit):	6.660574626915938
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teQ/5WeikSDx5ZUsfQskHUEl27Am69mHjTi1/qp:6v/78m9gXxHUse02YQwjTiZA
MD5:	01BAA67856B280C1E3FFD001BE1F7D61
SHA1:	9CCA3698C348A4ABDEC8F6CDB81C67805EECD96F
SHA-256:	D3526D47C6E9985C79E1749A6E02752B3DA96C0FE52953767455216F6BBE133F
SHA-512:	F9612A4FCC706446DC293D0D63F65FA4CA856E45ECA26FEADCF5B5F2FD0407432B34AE546E1F63FFA60A600BE0ED18D91A9E80B31AD8D6E09C52F1E3E14116AC
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.. .......X.RP.X.?x..E........6.0.<..b.*.q.B:.qO.o..Y..\|+o.....=W.a<..{m.0l.....~..?.'.&.n.,.....-....,.E..3b..2n ....,.0.Sk.......z.1..6.....K....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	286
Entropy (8bit):	6.6313744188451125
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teQ/4php7xVuaEaIomN/KdmNVZu9p0uZWrVp:6v/78m9Shp7aE7mNidOuLW
MD5:	D58849C337314CA5B576EE966C4786B3
SHA1:	FFFEBBF1ADE1C3BB7BD4C56E306DE7F29FB10751
SHA-256:	F8F03D8DB28102CFF61692B38ABC72D01440991893F8B9B9B6A111A3D9570FA6
SHA-512:	380BA157CAE29B27984F4D29B26C059D1557E2259931C0A3029B78482F32931EC453E35CDB7F0639DECC8A8AC6CD45B65C281BCE5544826CEE7EE62AAFA4BAD7
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..;.. .D.....X.RP.X.=<....0,~.. 8....>..P.......{w..Y..\|+W.....i.).0..s^[..[..,8..^..Wa.%.&...,.....-............z.7.X...,.0.Sk.. ..h....&./8......!^......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	305
Entropy (8bit):	6.762716806076248
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teJOLL4iKrUVUyTXT9nfw0kPsZp:6v/78m2yL4RoVlTDRI0kPO
MD5:	0CE5F96422D5EAD38347A397EE9B7A7C
SHA1:	E3C8B6BD057FF31787E35128284160DB0A6778E5
SHA-256:	E41A8135D3B8F95C2AA4FB6FAB3541AE746A16BA4B8BC95668D4EB9258B9F838
SHA-512:	6043CF2E8C3715FFCB6FD97441558C21D270D0EA037361990A64D5D3FD46963566929F6EE81A691923C38D5611CEA62F00C406AD0A76AC822C8F18227127C3DD
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.....`.....H.P...d2.H/9......;.I7.#&..l..@.......$..e..!....l..NF..l.o...VZ.j.b....................{..O_S eaP....~m6.=...xb;.q..%....u`..k...Z........!......&.{<.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.728730704581088
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teJ3rckYD17p1VaN739YJVcOs5Fgdvf9k/hLmjp:6v/78m6QfapSYzFW39AE
MD5:	19DC3A3DB7A09C8C35D228236DCA1C7E
SHA1:	53F6D333D2A59A4E80600B5AF1F2A8525CB478F5
SHA-256:	8D5A17EDE091A2325F4EA6ADB9449924B9E6726155F2CE9D626EB5F05E78A519
SHA-512:	D94DA40CA448C254660000D642B5BEABFB04AD89E2E18DD65FFB49FCE93A68CEA8AE9007A50B9DADA75BC96C421E150D183CF20C3F8C0712A1E453F5C56A9807
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0............(.f.&.d..F..D..$......5...V........x..Z;..&..(..;S....N..n...I-...,..\....6.(.@....W1(....~....]D..m^.8?.....;3^q>...TQ...@.u..m^.:0..]L...c..............IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.646791849224893
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tetHWfEgTbkKa2M4MBpLLLLyB7bFOFSdblrWH2aIMMp:6v/78mC216rL/GBVySdblCHXa
MD5:	4639AED924B8508FE73604A31DFEB0E3
SHA1:	A19C26F9CC5B5F9911903994D8E978EF1B0D0589
SHA-256:	BCE559092236E41E5F08F448FDB9486901528F40C66093332997656EAC69C31B
SHA-512:	F71B65DBC9E0BA92E07B175A563E4C772AF5A30524831BCD40A103FAA7CCBDA2158DA4957D5F73E0B98C40D244D5BE2B0C780B39A25932BDBCA73F96B08320CD
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.. .......X.RP.Xj..\|./.#h...$..9..o1q.{..O.].W..o....$.......;..,..n.{...x&..Z.`X.q..l.i.\......`.q..x.8}n.X..,.8?-....-./.........0sm...\.3......J0._tmT....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.850560661800515
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tem/p2amCxklYPTZB598Y2GlCNdk3+3IxBldp:6v/78mnhklYN/98alwCmIxBlz
MD5:	E1D08B1FF2AAA36B2C48B4CD76AC77CE
SHA1:	5585CD7D149341E27D69080B13EB53EA5ADB517E
SHA-256:	97FAA542264D3AEB67FA4DF66DFED7181A64EA112D196E49AEF225677AD91364
SHA-512:	BB6FC21798ED33A615AE6895DF2384D0772D734C2AA1DD542F1190C7F2526ADBC06D9D8217C9CD69A78B9F7E36EC152F47932F987959289FD04A5EE97EB5AF55
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1..0.C._9....5Cg$F...'....}..'.:<.~...'..\8.....<<.:../..O..=.n..E.A.`..;.5\|...y...........fpK.ht'..@..X.....)..2h..j.W{..=3N.......2P..,bs.......i./c....4..n`$....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	305
Entropy (8bit):	6.76445229792209
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teJR7HdDEIxEq09FxCL76sy83VbZvPob2Cup:6v/78m2RDlVOqEFIRv3VbZ3orc
MD5:	23EB851812BF3671A139AC1ACC64F232
SHA1:	81C64B263657B73F82772B762151CBBE382212D0
SHA-256:	550BAE15880FD2A7BB7E99022F02EA6C4E9786C606C881AB449D0E22FCEE4697
SHA-512:	B82C95A1939EFE3ED88A3121770E2E40350DA12F76C4EE3B02001F2E34A9C48075BC612A0EC996ECBA650904A3144A077EC902D9CD76ED22C48F9A0E0FD3301E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.@0.E.s8.B.BmFI..N....X.}....D..Y.U..X...C....-..^....A.$.....9.$.h};..;.+.....F[{..{\.8...3.O...-.J.........A.n...Wk...z......**...4...m.....b......f.......a@.b.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	303
Entropy (8bit):	6.792838745652303
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teBg6GVoqQ6mNFEWqH9vXVtNSxg1Rc4fI3TwIbp:6v/78mI/emXELdvtSxafyV1
MD5:	F7E3BAE77D33C0FB98EED204D50C3732
SHA1:	5211C69FAF3CC403305B63C7E8FC43B5CFD3BFF9
SHA-256:	521FADE0FAE535DBDD5B8F17BFFC0BD31D15FF9D309FB0104505E1D0CC7CC4AD
SHA-512:	D953E0ECD39B8EC9F0F3DB42F264AA94E22E4B84963D78E39CFB221AABF3E9BA1333A822D705C1561B21F57BC488C8CBF74B3E618B3F3C8708FCEC6FB2D52A4E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1..0..._xG.."...H)q......V...&.b...>..0..<....r......Kr..7C..u.5.R.NF._k.b...........n....m..5.NX...3..k..1...8..g...8q.vx.jt&....u`.6.O..]^)..+... .\W...a..k.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.745274238538399
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teRhQoNOnINQiUb5kFLRjmMabcJHimRKULjp:6v/78meh6ZiUYxmd2HimHR
MD5:	B77D38F8C38C8D5F9434136ACE01F8F1
SHA1:	7380BFC58BDCB3DA6ECDF05F2E3AE91C029D8816
SHA-256:	F670CF96BB4289E6497E2DC68190D2FBAF2C3FB09AC033F8792DA9090CC28FE1
SHA-512:	77D05A0FD1033E1FF7628597FB0C4B4D0127B7021CFF0A26C714E2D8DFDF25F2C9800EF4CF8512116BAA4BF4406A1DD72662E9A079590C492AEDD6D6224AE29A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..;..@..._8G.@...:.%..'.dY.....H...7ky....G;<....R.w....Y.J.?[.%.....t.z.......H..C......8.)ld.N..C/.p..}N.Q...B.?....J...8.AQ.6(`.....,.`....R.)...../...iqX.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	305
Entropy (8bit):	6.75054372431296
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teJ1BAggRbTecwHRAWKpL+fdaEW7dlVp:6v/78m21SggRXkXoKfdaEm1
MD5:	DA5AB2C8C35064CEF7964AE69C148721
SHA1:	769A9050E5B82E45C35109319737D6385F2C40F0
SHA-256:	90D2259E19BC6F56EB20022AD69EB17FE8CABF007CA7E2225C17F6727E8E31D0
SHA-512:	E6B5B756C210E7E0748225B966306941C5BDDBBB0B39358A7E61FD04CC7E10E31F28B008984E4C388477B053D872C94E1A68231BC3C11082E1EF41420D2FE7A4
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.....`..Z..H.P...d2.(...(N.1....a9..E...>.!.b.Ax.x._..%.....:..l..<9........Xm..8....+Tg.....O......_.?3..k.A.n.....5...=g.......*....4..Lm.....b.........o4..Y>.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.772678162738459
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teRhQHGx/amC9dHRSW0U4KJv+EQzraF6JzaLM6dMjDWp:6v/78meh7xedxch6+E69Jzh/0
MD5:	3FA855EEB2344F8FFC1BB53BB41CF5DA
SHA1:	D7FC3FB40C05DEDB2285D2E3B898C750D62A1DC6
SHA-256:	BED33D13206AE6286AFE72BD380195FCC77CB366E4F24C327F8E212A854ECBD7
SHA-512:	A487D8BD001D8BBFAB30351BCEB1638E497FC5511EF8B384387D151D891697853C6B44CF12B9EC47EF31697AF9F1CF9A855FAE75653E553AA668C5E11E1C0367
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1..0.C._9....5Cg..0..9.'.K..c..`x"....'t}..#M...4/.op...Sj.e..!~.<..\|h.NF._k.b^.#..j.b......p=.%.4...k.IX.k.=..k..,.j1.........'..v.@.ZbP..X....V}....J..;...*..6Cg&.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.6773502241007785
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teYTiB9nCSqF2rl1ZIquzbeONR6dp:6v/78mR69nCSq0rlnIquHzez
MD5:	F63A7A5AEA7FF6653A78F8188747CC20
SHA1:	8530382E9658CBD701F0B20CE41FDD5D09544459
SHA-256:	6B949BEBD3CD05AB9EBDDDD28DAC9677AE6851CFCAAC516C33EC1D401525E37C
SHA-512:	5EDE7A4FFC2D789A7BD921E92D3A8A107C7635E82A2157DE4382F6810E6BF0443579A1D359047D8C88FDCDB608933FE8DCC0EFEE522D571538BCC7D3BBF414DE
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.. .......X.RP.X.?x.....D-&Ap......./.....7....$;......Y...X7_.{]...L....`.:g.c..i.\...=.7.puf.x.8}n.X`..X...\|...q..E.....0.6.Y..\|.&*._R..p>..I.....K.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.669902517303497
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tep5WPqiqmZJbvdT+DrgEWLiXmYiO9p0XNWAp:6v/78mxPmmr9JidjLA
MD5:	8506CC8FD7B3A2B12ACFCB72EBD093F7
SHA1:	FD47B3CDFA0C9120FADC0D58A891477863172C49
SHA-256:	728786157B6F3BCDD2FC801CDBCDD418E3F44EC5065CDF476E0979C3A8A7C6CE
SHA-512:	24F996369071583AD7494D8A086A8B3997610D10C37C88C700DFE2F8D9D8C66CD3782CD5AE5C85312686D76414BCBEB99D5B9E7FDE6E4AD257AEFFB14B77FFD8
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.. .......X.RP.X.?x...f].... ...p>.<.4. Yw../...$.&..%<..&Xa....5...3a.kK.a..9..s._3....p....,.....-"...........z.7.X...,.0.Sk....hr.z.!..v...8.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.729294810488092
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teVhQoWNFE2SSDmlhfNPtBjLxizNvEVp:6v/78mKhoc1fj9i0
MD5:	A53004E08C6B576B3CCB32A82803034B
SHA1:	A8617FE2896A973B52DBC50FFA118705432D5AA6
SHA-256:	83B16D5355ABDC55FD808985E30DD56A00C9BD2437DC9C37C8CA9683E0D5938E
SHA-512:	5E2CD8EF22A8EF72B3464C86BD33AF1A3E2CD48F56BAAC4459F5BD2B4AB8EBCCF20AC24659C933067CEB73B223B36B5332A36B0702B541E1FADCFF481DEFE2C0
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.. .......X.RP.X.?\|...Y..(.$..9...9.`G..y.....{.}....^.;.&.a........&..Fu.b..k.\...=.7.pu..x.8}n.Y..L.8>-....-./.....a....a...5..3...8.^vr.T.v.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.617497173742899
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tepYcsjahiFzUw0IzBA1fzC6cp:6v/78mvTac9UZEIf0
MD5:	D730F03B4FF3A2B1E47E525F73D8B2F1
SHA1:	AF57C48725DCF0308A1EE46A0122651ADCCD2E18
SHA-256:	30B522C65DFC2239AA943C25BE40BE0E066003E2CE83B4F8CA79EC54CECE4A37
SHA-512:	F639A3A2F85C7C7FC8E09544B9EF88F114A77840F4A05EE5D15D396D04088923AED997F249561AAD2D8CD7BD43F23E72D5F1F6358B14FE1F333994B503470B5A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D......p...K....6`..]<..y4%:..............c.N..Kx.w.J0..tr.5...=a.kK.a..>.vs.W3..Oa.%.N0\|..<..>w.X`.Y`.^-....+..q....a....aj.X.:..5.......\..].$r....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.736828326214255
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teFVYoKu+AidrJ/dHhNb0TYLw+uZojfkMYbNz/p:6v/78m6/0t/x0Tm7fkZpzR
MD5:	803C4A33477F90A4C83EC058D8FDA611
SHA1:	DA6429F0DD179AD5BB58B560E467E6AB28F011DF
SHA-256:	8030F3812D40FD23B2E8B09A78497D1E71947B9419A258A48321C8634B7326AA
SHA-512:	F479860F8B7294083C9F71358C448A09DDD1BF00E4F6FBFF5FC35F16842706903C2B55F2D24B1575593B0F0193406311226A203CED56F5626B4D29032BEB0B7E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D.O.p..[.k.K.]...L.....@.......n.v../@..3.I.90H.,..f.G..Y.........gb....B.C.X...;{x=x%04.'...&a..U{....H...b.5....x.z.'..^.I.Jb...X.f...}..5.h..w...".=~#y.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.709774291199595
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tebeKYCIijpdYTl7E+RwU1xp6U8GMbp:6v/78mfKYCdLYB+U1oz1
MD5:	3E9D80AD219CAD4A77A99AF4BB972743
SHA1:	17641E418C48994A7CD71F2E844D56A776ADB6A9
SHA-256:	8E26A4F81DF53483BE44CDA516635D953410E9787F77FAB29B73A6C83F60DB05
SHA-512:	26600CA25B5770DEAA00AA8F8AAF1D971B0ABD1DF3C1D5AF71D30EC7BDB6D02A5B78D1F964868F52EE50D9F3BABA47AD338E82F16088C98806D1C86921B139F1
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.@0.E.s...m..f....N&......x3d........~v_...q..H.ko.\|X...'...\g;.k.`...a...^[..[..,....3.W...,,.....o...............U.\|.\|..N..@.,*...p.....5.....D.?~......l......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	279
Entropy (8bit):	6.58370193900142
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teSphrRffgFlG9oq44WBqM3V8jkdp:6v/78mrh18wiq4vXz
MD5:	4BE66102C593531691F2911FB04D41DD
SHA1:	22604E0C6FE087AB6A0862817191DD20430C81F6
SHA-256:	6E5709E28FFBFD6C405916E2674541110ED8B1157D25C3DECDA4C6B444E040A1
SHA-512:	E79B26D3739334B9FFCF42C43DBF852E48A9CAAEE43CDF3A7A52862EE4F7CBF52DA39901320DB857C549B508DEB88C71B34BE5F6C20E0D07ADBCB2247553A432
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..;.. .D.....X.RP.X.mu7@.a.[...yL.a...A....Nf.....^.[..l.nnN{]...LX...`.:gA1wx5.......`.:..<..>..,0k&X.O..~g...e.@`Q7,...<L..{V..?.I.\|'...j..x..}....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.728376538796244
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3te9QM2am8Yi4tPgNGzQSfJM5qvipm/Vp:6v/78msQBptPHHaqqpW7
MD5:	976CCDBFFF60D95B3F360525F0E22FA8
SHA1:	86808D02D6D46E0EA98455143CDEBF8A508F6698
SHA-256:	A21C5967305D36CE79628E6EBAE18D65B7A56D1F1E59AFF9C643EE7DA05DBB64
SHA-512:	D295C656EBE6D5FBBA4839235609ABC493F198E060D7F1B7D608E68FD289D79FE32DA220F34D871523AC671AE04AED3D037FFF7081BD9E5D8E1FB5767F677DFE
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1..0.C._9....5.3RG2..=.'.S}.8.E.O\|~b..I.H.p.>.e7.+..O.}..x3./....o.....k.T.k`....,v.za...7.*A...X.M.b].;....@.....q\.a...8q.V..5:...@.:....S.f.W~.w.S^V....T.g....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.777728292371577
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tes6LHI8QRkfB1HJ5hIsy147B5Swb+J+kp:6v/78mNUbQRkfB1HJ5N+uBMr+m
MD5:	0ACD176AB7BDB15419734E4BC84F4070
SHA1:	501912D8522AD8D48EC9A9E9F3E56F0CEE48E6CC
SHA-256:	1A77C6035AA69CE62912F7DF6E55676DAE711C07A324F504ED489E42BEA0C479
SHA-512:	46883F224C4CC03A1E3F2E67BF7798927D332DBC118B1F40DF27077CCABF2694DAC834A4BFC33EEBD5DDD4409E4C90FE409E9E0BFA6AEBE1D2C5127C519E0B28
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.@0.E.s8.B.BmF..+8....X.}....$Y.e%TM..:...M.+.k"M^....A.$....i.y.L4..\|.....@.\...=..=.u.....3.W...-.J....3.......m..8_.....=3^8o..+....*..fn.....F...............l....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	299
Entropy (8bit):	6.787083911546283
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teFDU49OoyPApk2Vm8ylJMhdup:6v/78mcwoy0kLHshS
MD5:	3F0E981FBEA1D0140121BE4F2477BC00
SHA1:	73255A555DFA9882F935F4CE348975D694F2F29E
SHA-256:	C3F3F885BFDD73E85812168D288E607745B31D397A16D56A0E777FB4E6B4C1C6
SHA-512:	0ED59C44F426158A341E410835A3FF7B12294DE8BE8AB86F9ABDE46AD7303433E18400EE32E0E063080D1D66173FA6F56C58D70FC783FE96C34B5380B4C5AF3F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.....`..Z..H.P...d2l+....(N2......-...W......K. ..........FM.@.......2_.'...c.......p.YX)....?.<.....]...m&XlW...g...a..bXa..y..6.y.\.5..@.~...s.....p."......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.613161014754492
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tepkB5ZY24wvi5r7IQZ5b1qL5cup:6v/78mbZl7viCQ7QLCc
MD5:	C8C5A0090B8690BAC3781DE150A4E11C
SHA1:	3017B0FD406C9DAA99594AF6A696DD4FC8DC09F4
SHA-256:	D057074A77B7A540023A3143BFCC80063BD8880E177A18C0F14D7FC3A630B1F9
SHA-512:	FBECC7A59DC0AD2C76CC50590C5C5556235ACAC97CCF7DD8416A69258F8C8F7541ABC0EB189285EF07EEBFB2F8A4689DAA41F66AC723E1B27F4A10F7E74A2A31
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D.O.p..[.j.K.]...L>.r..../A....`..".8;..B.F.Oq....qO.=..,....=.....y.).0..kYk..k..YP..>..?.BK.M0\|;..<..>.p,PkfX.......N.q..E.....0Sm......U../....J....B......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.661085855948755
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teM/7xbyOdluKYqcuVewv6zOmnLPVp:6v/78mx7xWOdtBlCzOQLP7
MD5:	8268D12D6D516035EF31B26C83A8F1FB
SHA1:	6ADEC53F341A443F53594D200DA81521A60A1CC5
SHA-256:	1C88E2F8B53CA4C6D7C9C3E36F14743A12C9D2746EF9566C280C3D6718E8E862
SHA-512:	74066D3E51FC82FF6956636DB498CD1FE7A7CD42999FABD61EDA1B85D4F64065F136E2D2F87541892BE7EB712FFCBE52735A2500151D111B8A410FFF27BB50D6
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E.O.p..[.k.K.]...L.x..=.X.D9..<.s~;z.... ^....#.}..a.Op.x..p...^......&,zm.0lQ.Y....3.W...GX...............f.7,NG.......+.6C..YT..,.0.3..kV......~...x.....`;N.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.6959119152442
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teRhQoVJsmhPcSd//UxOUdk98a/CLTl8Wkup:6v/78mehvum1BdkMUdk7/CLTl87c
MD5:	8A764CF017AEE755028FDA039823A0AF
SHA1:	8EC0DDF738CF753F2757791E2879EA50628E59CC
SHA-256:	029F2ABA51B14702688995DECAAC5203FA81E9D021ECF99CC837B0C5312B4AD9
SHA-512:	7948C96E0016FB566E574A1F0DCAFE215E8469FF710C09B00F9752EB450AFDBC008AC538C10261FAEFE727BC1253429F6C7DE95AAF4ED678A534A1AC92D6FD0C
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.D.......)..(C..L.d.V@.aG@.$.s/..tq.3..V.{..1.\.a...'../Kx..R..P?^.{...x&Lgm.0lq;g.ev.4.n...<.w...%........f............w ....,.0.S..=....F..t1mR.#..]...%......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.613161014754492
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tepkB5ZY24wvi5r7IQZ5b1qL5cup:6v/78mbZl7viCQ7QLCc
MD5:	C8C5A0090B8690BAC3781DE150A4E11C
SHA1:	3017B0FD406C9DAA99594AF6A696DD4FC8DC09F4
SHA-256:	D057074A77B7A540023A3143BFCC80063BD8880E177A18C0F14D7FC3A630B1F9
SHA-512:	FBECC7A59DC0AD2C76CC50590C5C5556235ACAC97CCF7DD8416A69258F8C8F7541ABC0EB189285EF07EEBFB2F8A4689DAA41F66AC723E1B27F4A10F7E74A2A31
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D.O.p..[.j.K.]...L>.r..../A....`..".8;..B.F.Oq....qO.=..,....=.....y.).0..kYk..k..YP..>..?.BK.M0\|;..<..>.p,PkfX.......N.q..E.....0Sm......U../....J....B......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.6498196668074145
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teVhQrphrRfJxVuavNhkomN/KdmNVZu9p08W7BPkup:6v/78mKhah1BaINhXmNidOuL3Wsc
MD5:	8B0D67385F6B1BED2DDFE1A6C858FB8F
SHA1:	71FEE6BC1DBBBE6CEC787F0FEE0467EBDD1EB250
SHA-256:	12BC3A757BF2CE56E4B0C5EC333DC881B628D5621C2643DAA2F0F20C82A8F84D
SHA-512:	6D9CB67A56DDB6D1EACB23C9BBA81F0D448FEEA0169713EB02B6E0CBBE282954A90B10A6C2BA0A23A3DCA78D027E395DB9B1B91DC20B9BE1871990033A0D5181
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..;.. .D.....X.RP.X.=<....0,~.. 8....>.?.`......{w..Y..\|+W.....i.).0..s^[..[..,8..^..Wa.%.&...,.....-............z.7.X...,.0.Sk.. ..h....M..n..@.B#.d.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.645199167067354
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teVhQogNVlxDV5iTbEHU0DlsSwXaUBywGAg8/v2bp:6v/78mKhCNVlxV8To7tJFMo
MD5:	6AE45270ADE08D47D6B4D3E3599B6BA4
SHA1:	A0B6D83081B49FF34AB6CD0A8B5EC4100BAA13AA
SHA-256:	38FEBC75A25D55D875DCF9138C7864D1ABD1EE892837D16D298B613BF6AAE444
SHA-512:	0E469A801CAC52B7579B126A6C2E55BB841A435AF51BE913B31324F8FE365092AF5AE386C5100D197F4F5C547E85B1210949BACF642EE3F7E3153CDA7345CC65
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..;.. .D.....X.RP.X.=8...2.......1Y.u!N...1..x..Xp.I.?Kx...`....6.p.....k..k4.,....f...0.p..7{..g......j...........0n .h..X.a.f..kZ.._.J....OI...p......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	289
Entropy (8bit):	6.683274993631976
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teZV7TBIah2Mo0wZQGmbe2sAp:6v/78mGFVIAo0AQGk/T
MD5:	C5C18856048CCE6A0856247DD8DFC4DD
SHA1:	89AA72B8568D70D2F6BB2A57EF8E0C5D9684E98D
SHA-256:	45142DB0910EC072C4D57037F47E3482BBD8270B106A61674AE2E38392D185F9
SHA-512:	0596DACFC001B36E560BE817474DF86E3250A271F8A60EE922EB597D00367E952727A2276CBCA722CA9F709E0B2323DC1E1BDDADEED0E2FF703D2B98D583409B
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.. .......X.RP.X.?\|.....D-&Ap....9$.......7...$;....^.Y..vX7_.{]...L....`.:g.c..i.\...=.7.puf.x.8}n.Y`..X...\|...q..E.....0.6.Y..\|.&*._R..H..I...(......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	305
Entropy (8bit):	6.78398546510056
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teJOL0vcw5GIIPwJFNijMzL48lFoVp:6v/78m2y0vcrIIcF4CL4oo7
MD5:	66F46999484CA2F05D5094A920870BEF
SHA1:	B342E4EF2125EF44FFD444770709FF3BE8482F0B
SHA-256:	03681581B685A476A2DA55ECB1F2D6A7FDA7EC21CE5A1C4914097F7F57B4917B
SHA-512:	9790587DC95D8DFB4E7C9328066E795BBF83B00AF735D54A541F850F7F204A748D495431A559BD92A94123B610C9B0036B687572B7F410E0F3A5EC33EDEABE33
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.....`..Z.j$JRg.&.d../9......;.'.../...hapf..b.LR;...g.g..M......[..1T.=..:...=._....7.G.C.{b..h..k.s.<}M...A+&Pc..b.w...xb;....M.....,6.O.?k..$,.`...C..=..YI......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.634057915699591
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tem/hL7Hd2o+rfsHikI/mup:6v/78mnhDX+momc
MD5:	AC624B94C52179D0632DE06481CBB21F
SHA1:	7EF9B907CDCEBAA8D1D96287FCCD3052CDA6168C
SHA-256:	483BDB9861C1525613C10A7201136B3F4043001C386B51CBCB98A01E5180A4B1
SHA-512:	A9C3DF59CED08D8930C65F9F7F5BCCAADD94CE7DE8BEB131564AD4B0FB53D0A854EF4DFA2FD631D9B4B00BCF08B39BC686ECA479F003462E681B34ACFF668046
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.@0.E.s....BmFI..N....X.}....D..Y.U./.......D...hy.M./#..s.I0..v.w.V*..s.........Up...g.....[.....././3..k....6.T........./..c..UT...hX....=..C....1.....H}.;o...._1@....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	292
Entropy (8bit):	6.733704988492486
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3te71O3oyPqeF4FnsiW5hx3MN8K1/Ft+52up:6v/78mk1q/DrbX3MN8K1NA57
MD5:	6BFA97AA96599A23B9C235189AE10EB1
SHA1:	9940D74570A18BBB604AC157A8DE6521E6D065A0
SHA-256:	D2F70202AF16CD29EF12AFFFDE28E642918E2F7B0D8300C84BD9190D121D6C0A
SHA-512:	C0A48D98C68BD34C9BFAE955F571C53ECA7F03ADD9C4B02AC7F600BB5580D8F4C1BCD49A3423DA535986A5467F2BA90E7315D36E524256D3B67CB0E61CD46473
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....@.E.....(.RP#QB..L.d9[.>.;$J...\|.....p.....+4Z.....~..I0..r.VK..k...s$.p.O.aN.i....62.'.......>..(....V.\|g%..e...(...0.e..Z.&..3......0................IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.70528129871559
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tem/rcg8KGAVkXJf8DRG15TfhA5LlM9SIrNGup:6v/78mnrD8KyJf8DETfhA559IJGc
MD5:	0260D314F0A6DFFA434F9007EF572BF1
SHA1:	586C9D1A553138DBDF071D04B761EDBAC8584B0A
SHA-256:	6BB598ED8C766A4B545BF75459F2D53399DB965498A3C199BD7C6B7E4B15CAC5
SHA-512:	7E6BA1643FB5CDD54B571D86CA84B89E97ACCE7739246F489A3F299FC6BA1B8E76D33071AEA0EA0A66984CCD5172ADCBD02C6002499DF117F9745CBB9691884F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C./....HK..w...+0.....'d.S.3. ..@z.6.qL.u..G..m....Kjef..!~..04.h.vF._k.b..+..5`.C.;.vv..\.....5.$,...p.5.Rv...@..hO.=g.c..=P...t.*.El...2...R.sfn..^.IY.Y.0......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.764529423751651
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tem/X67hZ6Z4w+rh2bX1jKxMK1KNmc1Tp:6v/78mnq7hoZ4w+r07AxMFb
MD5:	576F37F93477F24FB392CF9808007F9D
SHA1:	0A3D741551128B70803F86F26F8CAC73729A91CF
SHA-256:	C65D916764FDD41AA54F9D07A7B90370F3CD472F8F3949264D051B51DB0B0347
SHA-512:	DE8957B7BB238C83283ED9F120B2B4E3753547C13F16F49A7EA2C7917FF70BBFE1D84C4F257A596E272BD37DA5271953D95CD573A454825DADC2CF8B2782D2C5
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1..0..._...@.."5.%...^...th..I.b.\|.].....6..sN.cP._xW&..w.........J.;.9................n....m..5.NX...3..k..1...8..4.{f.8....5....@.:.h.s......C..... .T.o...2v......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.730131830216358
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tekkXxFMi02RlXOwKUWJYxlyXz6Zy0Tp:6v/78muU/2aU4YxoXUl
MD5:	AF962BCD29DFDAD5CC8D567F31A5569F
SHA1:	74201A56975F41573A0D759C09FAB2550F7435FB
SHA-256:	ECFB6DE4940856D440B21B92AB99DA82E5B3C27B719631571C449C5209AE589F
SHA-512:	CA84C03AB54FEB95433407EF22D30C5629B1D05803C2DA885983C1E0F122D35A0FC29A9A0CEFF5FD64AE236FA645E8B6F3D12B1D498786A64FB353ED9CC3DAFE
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..;..0.....c.@A..z.-......ml..1..+.%1ob9MW..-.._..te......'..l.A..;.C....T.........8.)x..~..[...L.N4\|.E..@...F..6w(..U..Y..~.;0(J....s...E....C\P.[eMX.........f.g....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	299
Entropy (8bit):	6.781476872976341
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teFgMLGiEa+o2ffJIMgqVxxY1tRDjcnvOTfnp:6v/78m1M6iEam3uMBAFoOTfp
MD5:	3661A9D579716037BEE8FB27B10E0A9B
SHA1:	56FF0F8CC6CE9E9D44A4DC90C959FDFE1B98B2C2
SHA-256:	EBC25C22092E21F909FF565E10E794C79866055B3568467695C3BEF1DD812014
SHA-512:	52FC06769F67F043EABE2C5F09CDEDBBC84A24407666C9E94EAE1A214332BB9694E0695D6F99467C7EAADC3260C2CD879CB382C87FF8658409C8371C40B878CB
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C.......F...[!.0.....p'.'>?.c....2<%.u;......Qz..7C....i......@..f.?j.b..W...p3.$.4...k.IX.k?g....HY..b.5.....=3N..]...Ae.b.X..^.)c..+.Ky)0yB......:T.q....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.670428221947301
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tekgkglLBjejEzUZ7W2JOcAzimRUo1Rnjpbbp:6v/78mureZOlimuo1Rjpp
MD5:	AA2BBD6B2247D47A02D3855FF76541BB
SHA1:	9BFAA096592E6A167B7D1233633D7C58A968DC25
SHA-256:	FB3279BBFBD4E1839D27FB40DA2F845B5B6BD4FA44BC5083A25A6A42BE4635A6
SHA-512:	E9EE407D3594EECB51346B07742BE52BAB35D7A895A4BCD6F3739A83653B733936527546DE5A7E1BB49F727F93180B948063A1BC6905CD9CF4D1B7C1728A1DC0
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....@.E....R....)%...L....QB...\|.....e.].....Kk......~.s%...t.VK..k...s$.p.O.....8.)ld.N..C/.p..}N.Q...A.?....J...8.AQ.6(`......M..g.qA=,.9a.....$...!B)....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.732697344620858
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teRhQMiMz5plEDWD/oRCGo7xxY1XG7fjp:6v/78mehAMzqDI/hbrB
MD5:	0146FF468A556239C60A1DD426D2D00A
SHA1:	F0EE3EF1DA1BE600283D349FA02983419E77A60E
SHA-256:	A4520793DDBAE07A0F593E4572B718286DF90E58BBEB841EA521A64ACD68DAB7
SHA-512:	B3BAC0EC129BF74C8C709AD73A2A70B039409762A5FEF08A9514F3A36630D70746C7550A8946AF5EAF433385E6598D5680A43FFFBC9205646B044636ECD2DF05
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1..0.C._s...5Cg..a.....Q.~...V.O\|~b..I.rY...wHyZ........+....@.A..M.;.=\|...y..T.j.b..W...p38%.4...k.IX.k?g....HY..b.5.....=3N.....].Ae.b.X..^.)c..+..]R.......&#......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.711265558026339
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teVhQoWzkofog/KRVjeWcTTpuNYcp:6v/78mKhoNlSRleWcTTpuj
MD5:	B3B8A0FA98754227F8127403F11B7879
SHA1:	078BF794FD4B510D258381A44663CC5F2CACD1B2
SHA-256:	BD3DDD421AF307B1BC1D976F199B692CE3976EDD83FB747609504E2D2DFD4CAB
SHA-512:	A43D9B51EA8E4760C784E22612960C2EED19CC67422822AA13934114C191276A6E2B838B5E4B2153ABB53C6EAC35CBFFFD1CA58012F79BF4B02BEF78A2481DC4
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.. .......X.RX.X.?\|..E........6.0.4..b:U....f.=.......VZ......+.0.......(.Y....f.........3K.3..s...f..........z.7.X...p....q.j...h......6..B."(\....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.6416729590695445
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teAg5fJxNiKgQwxllr+tB56sqp:6v/78mK5B8QCl+Gn
MD5:	DDB184431E5FCA34A3FA39BBF7CDC157
SHA1:	BCE2B7FAEE8665D252D9185AFD6AACC8BF472EBE
SHA-256:	2DDB9BBF2A38F1DB9A66E78FDAE812B09FD830B9EA35CACE557AEDB97FBB27AE
SHA-512:	116B1DBD551C20653F328DCC42ABA1B64855013E3EB23FD7D937A1C30A60A4B9E56CF5738D31AB62E5A95D9D684AEAAE7013B12F26F32735BF5AA13B22EF1309
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..;.. .D.....X.RP.X.=<...2....g...d1.......cv....ko..Y.+\|G..;.7'.....'l.].`X..gA1w.5.......`....<..>..,Pk&X....\|....q..E.....0cm\..d..U.`.`/I0.B........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	289
Entropy (8bit):	6.699382336303443
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teZVSPB1fxh6kEkZhn2xKUoz+Qk3ljp:6v/78mGMPDfph2i4N
MD5:	918AC686A59DF5634808CFABA2A6FACB
SHA1:	3C81445C65A26B4DAA8E3F81DE90FD600104504E
SHA-256:	BEB168DE70AE97DC83E9350697197771F9DB795A895F2567A4EA474DB74B61FB
SHA-512:	CA6B5D81F6614F899057D88686C632D2A61676A8D876B6DD4D3E22D5870C96E3659E1E75594E3F61CDFE06898EE9BABEEF5CAA42C8E4B08FBC76E023A9EE8EE4
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..;.. .D.....X.RP.X.=<...f...x...,..>n....$.....p0.d.....'xV...../.....x&.ym.0lQ...27x5..^.....`.8..<..>..,0k&X.W...g.......fX`..y.Z......F........../[......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\48.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.533791415580225
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lQkx8DVlZDUldp:6v/lhPAkRTp
MD5:	E7D31AC53D124242B574C8090362FFC6
SHA1:	39BB8F5AD0330977037D5C25C53B2E66B1CEC898
SHA-256:	A901AFAE7BDB66678F08A39B32F8A46DA9864C8A64FABC0E77A7F12B93DF12BA
SHA-512:	96D66670CC0D53E5B937B6136A69BACE772DB75D76A7DEC8102F47E3DCA2E739AF5E82A01696BA6288CAD3B001CCCEE82CD2D285320D190B870175EC3D4956AA
Malicious:	false
Preview:	.PNG........IHDR................a....IDATx.c`...`...........E.,....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.753575801300848
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tefHg0nYD1/VneWYJVcOs5Fgdvf9k/hCDp:6v/78mgA0nYaYzFW395
MD5:	E31204F5E07C5B294A5AA69CD33F04F8
SHA1:	9DADE4C132CE8993BF8B12DED7ACDFC21F6CCE6F
SHA-256:	1B8FEB3228B259C403E76EFA46EB4E33D9540E034282D2248A9EE29C01929C97
SHA-512:	46A1D8656289D15162CA2683E673DB38F56C67BEF6D5916C65DE829FD08C0BFA91613468E78D6803CBA922099A9256E35BB28110386E56A2E191E8BF33BF8525
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.....`......(.f.&.d..F..D..$......Nvb...@..A..x2.Z...&..(..;S....N..n...I-...,..\....6.(.@....W1(....~....]D..m^.8?.....;3^q>...TQ...@.u..m^.:0..]L......~..9....."....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.783283282787546
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tefm1Fg1l6zoyXbT24/MemwGWGIpmt58AzH3rXkqkldp:6v/78mgm1FgPKoyLpMemwGWGIpFu6lz
MD5:	F60A460A0320B7B50F03AA9E57997999
SHA1:	2D3E42999CEDFF482DF79584080E84F623E73766
SHA-256:	A64B6D015277FDE626163C59881BB8F84B2F22BF60052923BA1975F336F15DA4
SHA-512:	10F60B7E6577D8BE79030B0A6679C2C624ACDC4E3A070FE1525B6FF0F7D8606D71FC0BFDA7E306F9A22091189AEE11E63DB4704E58E276B54F6A2B5E5A6B6373
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.. .Cs...=@....+uL.\..p...W.1.....`c}...T2q..}.Ls..u.....<2...o4...o...Q..............;;\.........h....m.....)..^L..q._..g...;P...4..El.u.26.....g..........cR......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.766564139845037
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tefbWFGiCydANpi8LDkNM1q3BiSxVJsTmellVp:6v/78mgqFzOioDREclT51
MD5:	A52628DCC1E0384F5D78CA34B4604C24
SHA1:	FCB90B265762F8DE78C5CC97BE77E374A4FC4497
SHA-256:	ED9B0193A78520BC5B6A01C1DB67C98CFF18C5884F4F48FE1477277D48C7E58D
SHA-512:	299B4095B841FEFB4BEFC267D672C9AF3382504BB580433D4BAE354001CE0E9967C6E81805F1925406609BD7D76265E19CD5ABB62D63BEFA4F3E2B6E04A07F25
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.. .E._<..H...:3....8.'..q..g1..o.X.c....Y.!NW.CL..L..e.<y..#.?....#.B.f.mm.\|..4.5.'.GUW.n..=.}...7a..h'..jg.O_..U...r.&.w...x......n..@.z..m^.:0..]Lp.w....?.6........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.773026280231606
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3teM/5VYypyL3Yl4LunOGsU4fk1HFVxE//Vp:6v/78mx3bpyL3DunOGqyHniz
MD5:	B64C7621AE7544C9160C6E46CAE43D54
SHA1:	CF2F1796C7C2D2B50FAF21921BAB6810C4D1AAAF
SHA-256:	528A7E5C7756DE4417AC44712AAAFA55FDEE938A5284C806B681E5C0877A2965
SHA-512:	BEE72482002AC7F2D4D6A1654F25BB64BC3EB8FC21D4AA566BC8DD320C7F84B0A4F8AA9B6D7C99EE8A24DA325DB44C4ABC9E8D9BA012B587BF9CB511CD72C34E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.D......)..(C.....-@.......XN..v$".7.{...>..x..qO.-.^...k.%X..^.......%..Ev..\.....",......3K.3..s.3..6/X._...g...c...jX`..y..6.Y...7.........!.]X.6.3......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.690169207909057
Encrypted:	false
SSDEEP:	6:6v/lhPUeseqZA3tea/SoGxN8nrQvNRO8iiYzlb7F1sLbqQlVp:6v/78mTSFgOO8i7R/7sL91
MD5:	6090B54FE0F81A52338E17208F281222
SHA1:	CB7D144D8435D91E425D066D0EE10CB0C603390E
SHA-256:	B6C1C73D111607598B4318E188D6D849528EB9D7CD2E9046E4F063FC85D0A813
SHA-512:	97ACAD1E985CF077D062959FC561C313C15C8CD1D4F4153E4676C0EE6CBC528F647D464D19354829401F9867821635B7244D91B2D46B80DB6C60AF2B279C15DA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...j...j.3.CL....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.D.....(hS.F..{d@...8l..C..^,G..JmRi.......a.N..K..w.J0..t.Zs...=a......}..f.W3..Oa..p'.>.Y...N...,0.\a.^-....+..q........0.m.Y.l.5......S.3\X..}fb.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\cyan\glass_cyan.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.9362600275315267
Encrypted:	false
SSDEEP:	3:a5I7kRo42c:aWARv2c
MD5:	42F77930F39F5CF6B3F6358C9024C6EF
SHA1:	931C45570784F3AC8FAAEEDBEAF4EBC9C8DC6AA0
SHA-256:	91CA9C1C5A6CC0E05CC10D1D0794CD4CDFAA66689D04D7E6F977CCCEA91DF60D
SHA-512:	67F52FDB14BB31E2FC52603675069AF720A51969C1B117121BA8C4CFD85D0BA427B0B40B6067B96B03D0F62ED7C0DDA7981C9A61B23F6509C42FA14017B8EE8B
Malicious:	false
Preview:	tiles=1-48..metadata:9

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\glass.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.234608000245557
Encrypted:	false
SSDEEP:	3:9mRrIz4sT7nWVFiJaOvn:0RY4sTLWYsOvn
MD5:	F9DB2D58FD5CD86DD64360F18ACFB398
SHA1:	76CFC2B1E22393FB25C1678D73FF2074ACBEC3EB
SHA-256:	3A38AD65DE76BADCC591E4A5BC8567474848E232A7EE274D43941D16EDC016F3
SHA-512:	3BFC8BA06C510DE360AD9361ABEA30F91225CC61929BB3A11E8528DF6BD811EE9ECAB6CC1B60B2787266619B485C384EBA1E0805E5C8C421140174783234CBB1
Malicious:	false
Preview:	method=ctm..tiles=0-46....Glass and Glass Panes

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.66218573280343
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te80ol516pNN811vYA5umR+aj7TJtrp:6v/787dRmN2nYATh
MD5:	9C160FC102247C36129313A04C55147C
SHA1:	D3176939F32D685C73D19FCEE330E38FB88821D8
SHA-256:	0C873C20EE619F01FDAED8E6272E73161A65A9D02C787FD2D8725AE37ECC543A
SHA-512:	50A6BE84E301AA7D05986F7A9B38DBA5E3C5D76F7E08F03812A68F3DABC10B15B94EC1E02292CC9C9183BB2E762B68C512CB6D82E76F7B6A10DE332EE5FB0D4D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..s8....;...0..I..(.....Zp3.R.DZ.u......W.X^.p1.'.;S.........m.T1..M..,..\|g........m=...@;a..>g.....eg0k....m3.=.sf".o6\$5Z.Ag.b.....UF..".......H....j_B.vu:....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.61061358376418
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tep73nWgftdqe6EBsCPoLWRdjPF08k20p:6v/78743H/j9ddLFNk1
MD5:	F114DEF34456F34D76A4D7EED82B1F45
SHA1:	B4EC8B48740A0268FAB18908E8FC6D409C805CD9
SHA-256:	ED3B3E33B011F6DB54032F5715C6045CE8F97BC8647EE3FD27DC3FF7845B8764
SHA-512:	F13454A96266BE0C5E17FD527063DD1451317904B8839D16393004AB625C61973F556C7AB48B22000A938F9CDD4289362E3F4FA781A2059588958EEFF84FDDD5
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E.....\....8........^R..hJ.1.[D........pM.3...........;......=.'..G...<.............=O.3..s....6.,..E..3..0.@a.0....<Lk...*\|..&...s.....IN..os.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.5992343329739915
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te1kkoj1GswdRkHvJg2wUGHiRgsdQ36Jp:6v/787goRG9kHzwUeiRgsKKH
MD5:	9FCE28AE3722E4F321A7FAFE21CFE42E
SHA1:	0A43E3B2EFAE43C0828E46C4DB88812C0DEC3D3C
SHA-256:	B1369663B32137E273FF8BFAFAEC234959DE4ED5D6310EA0F7C93B6FB1BBC571
SHA-512:	473880522DEA0575003959772F70ED559C03205C9C9B3AAD05A9886ABA49EB3D55E5884AC194C912A095B090FA22BE321EF966A7C2F2D70AE352AAE2BDD14ADA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|.o...@...e9.....6..B.W..h....8pO.3..........uws...8.g.].....9..y...p.........'.........f....(.wF..]........8....5(.3.T.*"._.]NY.djZ....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.65658655739032
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teBQJONko3Q9AbR9rfBz1Dkixs9/qVGkup:6v/787IQJyfR9bBzJtsZqg1
MD5:	A5E3A98DBB0E225F399453D28DD2EA48
SHA1:	80894FD7283DC040C012E021CD3FD58295DB4420
SHA-256:	A04459BF6EA4C0F773F23614AAA8531E5DCDABFF3C16919DECC2E17121C9FF18
SHA-512:	117FA923DA1BA2E6C0ECD939AED54FF1EDB706A38BDCEB9AD44C81CC0D176E7DD546450A032AB36129723A4C942FBF07564CE33C03B8BC6C7E4BBA062EC7D501
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D..=..p..X.x..(m..C.xI-.)S.a...D..1.`.N.?kx.o.J.C..\zC...L.j..0....4.x.....+#.O.......p.<Ed.;f....(.wF..]..(,....p..icc.....b.\$-. "....NY.tZ.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.75014685504456
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te//u5zniltS2rBNqrpp79i5axu+VizU+dp:6v/7874GzniltR0bk5zgs
MD5:	F0BFAC5DCB336FCFFB33AD1A28B116FE
SHA1:	47F5C670603D4A868C8945F0879A9BAAD8D8FD2D
SHA-256:	BEEF87E40D359C73F0A9071785BF36B4E01209CDB7ED26262F60E4A594257146
SHA-512:	61306FE3CDF484BE1913EF981195F5EA1326D1F91E051DDF58DE5E847245D68A56E37295437AC2BD2676F3A233E7A1D1F98A343637C4866FE032B2F4C34C8DFA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D....~...&...N.dz$M.....El..LfVnN....@.......,.sd..!^.....NF..j.o...6Z.j....7.................{..O_S ec.....m5.=...Db?.q..h$....u`..k...Z...%...`f....[.5`......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	292
Entropy (8bit):	6.650168469593071
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te7/BegglWgC48NmCzY1UnoqgfgMp:6v/787k/B/glFCkCE1Uo/fP
MD5:	83EFDD330758ECCFFA626E63A5417A84
SHA1:	E8AA9420B812DF738D6E34D0E1042C103DC8C516
SHA-256:	7C73C8C4406A6DD3EF0F7A2874CC1C9F3F8B7357855FB7F9299E77AF80B0FA43
SHA-512:	9AEECE108063663B6E8A103BD194748928EA7580E7CA305C3F7F04918701E2CD4854140F71B8AC0245555B6FB7C56923D67FEE4E2C8D660987B53163CB5E90BB
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E...`......\...L>...........n1.Ry...]...O.!Y.=p..dE.9i}x..#..M....V....`..,.0.E.$...C..=9...z....H.......\.?.....#k.......`..3.o.x.....bm......T.N?!.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.561509558160755
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teakojbwdkOOUM8Uty/s35w0r/Yz5i4oSXjp:6v/787oojKvs35Vr/Yz5i4pXN
MD5:	F2C6CD5894C4EA340EE1E2B6E3C4A41C
SHA1:	FAFF07E53337F39CC92E235869B5087472CE3BDC
SHA-256:	E17B29943DC239880AFDD60999788093B168A9CF08DE49A125986BB4CD136370
SHA-512:	72381B4DC261AF2963618B543B8E54E65AD7974240DD11A811BF7F3F14522DCCA7F2A111F5B6B6CC26AC565531DF63118A036FCBE7F2822816955D47BE25ABB3
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .......6....l...L..Y....I..as..\L...........xCHl.'...........ps..8.g.Q.....9..y..p.!,......&.....E`.Z.....(.wF.p....,....p...k............Rl........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.801796384812286
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRhQtyKSivdvwkx6lH3uJYCFlKjiSp2au/Usbp:6v/787ehPCOkxk5xNp2Z/U+
MD5:	8B1BC943D5BCFC03529371F2C8BBC31E
SHA1:	094BABB5FA530E88C78859594D0543983C2AA25D
SHA-256:	22EFE3309A5A46363E38EF2DD9851576ED69D97733C7349F5970A3747118E72A
SHA-512:	F90572369E3B1107FE69202FC1A9560F9EE0716917D0603AFCDE36F5FABBF9F41FACE64257687A895F5CBFB3131455DEA353530EE9340B52A5EF2A1C8684DF38
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C..7G..G..w...2......8.V.x.9..:X".6.b..}....G[...xJ..p3./.O.......k.T.{.M.].X......n....Fwb`.4..u...x...);.QL..y....3..y.....L.:....26.O...\|........V.[@.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.699931689575959
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tevd9ZqirQiRuhUoVtIYwU1Pj+M0omDrmkp:6v/787cRRudVtIYwUZ+5omR
MD5:	60837A98594B2F5C6851EA847062D88E
SHA1:	FA75FFB6A97373B14DC3BFF9AD83E9A9D1C8EDE0
SHA-256:	374066A3FCC0B51D014540918BC3AFA04D63C8659852AB7F52724D2B151C6AC9
SHA-512:	C29FCAFC5F4E52DE59F28C2E41C1895B24744D5D39E703CCC819F73478404F59404BD6BB700FC7CF25A9BB4069FFFB87153C156CA195B1367259139F56A81EA7
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .......6....l...L.xfY.5>&A....!.B...r......%3..$O.~...O.......-..4.5....p....6w..@?.h.M.............E.n...Wk...z.........4..,m.....b......f....L.WF?.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.806677741782041
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teM/7WpegZRRCabbqLTmy/KeprmyYpHOwZXMPaWup:6v/787x7Wh/kLLTms1rSJMC
MD5:	9C8A9CA591A525722E82C5CF94A8A6D5
SHA1:	A87D5DFDA3D43B65F486F83DE3978D62BB64FC53
SHA-256:	5223236E74B957CDB55E89B6A9FFD3CF3A1CFFE418EC9442FE6CA7B0B1CF3DE2
SHA-512:	FBA86F7FD0E3D1F7B0DEAB1B523828CA3DE87C6C697A438A3B463437B7EC5A695A15B98253D7D48B7DEF335DF23E81C26116A33EC82C5E1EAD58B56DF1F0D056
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..........;...0YsR\..A.~<...a...kJi..K.;....!..2...?h.L.^.........k.....Z.....f0t.h.N...v.b.}..O_.@....M..q....g......J.:.....m.M.26..R.;7... ...[bWF........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.66370967323667
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tetHko78K8PP/y3vz+JSTq9Go/lIrio0w5cyVp:6v/787CEoH8H/y3r6IOo0wR
MD5:	1EE66C6F6C3AADA60B4348EA07FC9C3A
SHA1:	046126FD59B3C13FA2F45AACEE4658AB72C8F7C2
SHA-256:	81C82136CDA92E479771CF0B8D1FADF2B25BAC76AA2D8CED81401DDF458935FC
SHA-512:	356DCB1C2D7A259A03208BC7EDB89FD1FF3EBC5747B10DAD2B65EDD2404F1DC790D77C01D33F02D0A0F06E629C9D718BFC56582EC9243C0665EE89CEDD2C875E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.E./......8#.CW`.&kl..y.px.../.3.Z.R.....z..c.g........s%..>...R...3......8.)....v..Oa#.p...z..;..s...p.....*.;+Q./...Ei..a....h..>c..Z.6../@..?.~SA..+#....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	303
Entropy (8bit):	6.737141209713029
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRkordvhZWeQ8BUq4SeGDgEJywwbtVp:6v/7874hrdvhB3Fqwwb9
MD5:	3A6182ED98DE285E54A11B0A4D7E55F7
SHA1:	0B9F1EEA3E3781B78E7430E22ECC405E79875771
SHA-256:	AE4482490A5F57A6873D53F65F690FB2FA827CB3A647ED21BC62187AC87FCB46
SHA-512:	387C58C942CD4106ACDD874209517482A88E9F5D0EB0B425C5648193DEAE5CA290A27C93B25063D76EE15D9DDAB7586319B316BE87B7DABC49D9A3FAECE9A649
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .......6....l...L.pd]..c....<t.1..M\..>.!.b.A*l..BXg....+3.I...^....a...........y.p...@[...H..p.U.3...v.T..Pq=Z..;.sf.p}.....a..@.:..6.y..z..&...........[K6.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.6216433662083665
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tetrfFosK5k8cHOyI6N/tArLDSIj7og+DDftBCdp:6v/787CJP5I6k/D3j8g2Az
MD5:	BC56A0B753A791177FDB82A96602039F
SHA1:	14BB370408AC1E17A881940C93E2C4EC08DFE000
SHA-256:	C38CB67CB2AC50DB121B33DFD74B5BB66418C859D14AF6BBEF56FDD4A1D30643
SHA-512:	6459069BE0BA210FD693668E5466D4B654CDF5AEBE2BA4F7F9E1B5050ABABA31982D9D5729154F4C23CA36E3D20B0C2815CD8A44CA44B87B4508F0C257F7348F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D......`..M.a[..+.I.f.....E.0..C...>O..p..0.\|.V..x3.#...Bcw2j.Z.....i.S..;t.2`g..A. ..N...&a.....w_S ee...8..4.{f.8.k..].Ae.bmX..Z.)c..+......S........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	286
Entropy (8bit):	6.618605102463987
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teQ/5ko7yPfu1w3o6daMF3PJSKQ+OVp:6v/78796oWPWaLtP/QB
MD5:	E43E353D9B03494373664C3B677AD9AB
SHA1:	A708110C26500BCD86DC9AE21AC6C1519F2CC725
SHA-256:	C30EDAE340EC78C2B79670FB400353840499C54FD1CA9BF952255F8DA0AA0B08
SHA-512:	384C82B5507D3157DF4A30AF2B0F3EF3CCE8E963D33DB2E5E7E9B05DA3120B1A80BA8379D17ADFBF18E6128FA2334F8E949162D320CB72AFC2899883A7E24AD3
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E.....\....0........^R...-...""....B.....L.?k..oc&...n.....x.\.....h.Y..........'.ps..x..}.".....b{Z..;#^..........8.....MP.gt1A...+.Hz..N..$X.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.629958972396363
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teBQokojZCnGk4uMiFsZMEY5rFpcyecLVogSb8H99+Yprjp:6v/787IQ5oNCGk4uNFsGEYvp7Vf+Gnpx
MD5:	B57E600F4082D70EC5EF2B86AF33F5EA
SHA1:	782D84B5B7BCC1215A21928700B6EE2FDEE19538
SHA-256:	CBBE92A5AE1CD135DEB90C6928E75F1F3CE2424F71F79112CC64041371A08DE1
SHA-512:	DC37C257D537606231134F1312B00E40FC4ED99ED87711A0AACF0B2643E01A94247416D202C89094EDFBC7AEE75291079904DF4112007035E577912FE86F33E3
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|.o...@=.dY.....6G...c.V.l(././;.iv&..5\|.wf&.a=.\.\...L....`.;gA3;...W..'.&...,.....-N..5.,.O..~g......"7....<.\.....~F.&XED...MN...K.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.678665048862075
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te1kkoj5OIahkss/L9pcyecHRogSb8H99euGsup:6v/787goFOIskssz9pXRf+GIuI
MD5:	DC17FCC128A56B7A2DCA382CDD5853A6
SHA1:	644426A8A4EE741A7D66A20FDC9DF2152F03AC0D
SHA-256:	9F949B32E1AF5C3B2AE4E8473AF7C62696769FACBB7DC312F6B418F6329B6A6E
SHA-512:	EDECB00002E98A504F3EB2C3E2ABCE32931F943562EAFA87A39A494A54A80260EFF106423A28B380D321239473AD0D08D7738497B0C4E599E110526DF34794F5
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|.o...@=.dY.....6G.1.".V.l(././..iv&..5..wf&.`=.\.\...L9...`.;gA3;...W..'.&...,.....-...5.,.O..~g......"7....<.\.....~F.&XG....NY%K.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.701523495150934
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teVhQZYW/rWYoSGEkBkev5riyh8WBWb1TSpPkup:6v/787KhgaSGrmevUyJBWYN
MD5:	86E0C0501F5A920223D06517B33F4D99
SHA1:	6FF357D85A88962444A8E85258AF33EE59FD1862
SHA-256:	F495E5B44744A8C4911CFE3CA6EB7A389BFEBDD6C0D2A046C8CAA6B98F74D4CC
SHA-512:	8821A81FADC5D56613EDA677C6A9BBE8BD9F833816360D9003A22DBB224D28967BF59667A972E9E15C966036EDC6CA8BE3866E8DEDB5D4BBF737CD4895AFF0E9
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D._9..p..X.x..(m..C.x...hJ.B....L..'...;.~....+.....R..8.{.Z.....>.N.W3...2.p'.n.<.....]$..m.XlW...g...a..aXa..y..6..*\|..&.......UNY..2.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.7219548676515
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teM/PFsaodMLhAcqu4q3/miUPgFO7e6dfTp:6v/787xPfFAcUpiU2Uh9
MD5:	C246A831C22BD28BDCCB48A655A31B5B
SHA1:	8C298FF0A041210EFA313FAEAE62506A17582AE0
SHA-256:	30AE99C4B86DF6BA3B77021C389BB1D03A85E17F41867181F6AC2EA1CAF79CD7
SHA-512:	2324621D2E16E49E4816FDF08B8B7CF754A67C70BB3565050EF96268846ECC59ECC1C750BD6377D68F4B7E53FBDA545374BDC33A9D3A956D42C7475A6A0FC3D9
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C.....p..M......KJ=0...9p0.#.4~.Z......\LR.{.....N.`.qt2j...\|O....Xi.....^..sD.G.G.Gb..h....k.....)+.VL..~....@..~..!.QO.*..k.<6.O....Q.~..v...W!..l.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.631649930003402
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tepGmLB2VSRpOkUZYe14Ad3Fpop:6v/787bmN2sRkDCe19FpC
MD5:	179A3787736E5C6CE536842E0581D1ED
SHA1:	B240AF349DA4F6B103DDA658B55F5F0EED3F0991
SHA-256:	7EA6395264E17BDCE702A84676FF20DF573FB48424B37415C0A04C20BF6C4DA6
SHA-512:	D81A5C7759AFDD1E3F32C3A11714403579ADBF4939A4BA792CEDEBA13B9A1D5F11DE4C43EC373050E443B2156A40E736A9EF3F4295CFFCE24CC092828D666530
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E...`.......\...LJ(.\|..=.D..Q.N...9..".3..X#3....a./p.x..p.......a...^[..[Tu..s......n...=.w..62..>w...l3..t.*......i3.h.E.....0S.fu..1..........Rl.HgH....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	276
Entropy (8bit):	6.619440458180534
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teO/eOWDn/wq4k8sqKq0xWsvu0pytVp:6v/787veWqpt3xWsvlI9
MD5:	92105C1084497606FD09D53F5DBCD084
SHA1:	4B93603BCADC01C3B8FA696F495B068993746E99
SHA-256:	E9851F4E1635B38D4F63E65E1245610D3A039E84ACC53DB7CEC9D93F43FD059C
SHA-512:	221DD87B919F6FB7878C775F0C4615E3151E38603ABE5F2F0E114175510272C261BF1CD9B29536B2392795B52432089ACCD53B7F99B34776DF159E154F8853CA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D._9..p..X.xdm.d.Z... 8.I.D$...).'...........6.......^(.0.).......Y....f.........3O.3..s....f....(.wF..].....a....aZm.....3.4.w$.!M....D....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	292
Entropy (8bit):	6.727197678458617
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te7Ri1pLX4SjFPng88QNVf441G7DsfSp:6v/787kAl4SZ/78Tr
MD5:	5569A125A8E1C2C66D76C32C6C184EB7
SHA1:	9E3504F512788E816542F19E573D9FF9066CD217
SHA-256:	B49B4DCA5782CF00F84F9615903575957A1A03A80C14DC0AFB6EC4907CF8B295
SHA-512:	38B03DEE18B14BC8C4162A2EB14F25F8B10CEB7BCE299DD8CA33455BDFB77EDC488798425502D71C08CD5058C75C720D0B4D04F7E8F806CCF0470BB008ECE1AE
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C._n.......;...d.b.C....'.K.X.<J).]"...{....Yz..o..I...`......@...T.j.b..7...p3..$...5.$,..3..k..l.F1.....z...a.;P.+1h.T......>elv}.kp....zORl........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	299
Entropy (8bit):	6.682523384953832
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teF7RkyuzY0V5pIT7KXPalivdTp:6v/7870R9uzYEXiQF9
MD5:	61FF5940A24FC7FC3792B78C0F8DAB45
SHA1:	B9A62347E038A38F72F6C214E558FDB51C259CC9
SHA-256:	F4893E1B43BDB56334783FA5FBFC31E942349BC4A924525A3F0CCF6D5D467630
SHA-512:	3376A21D142A353217810017D564DB00A582E62DD85A3B10A9234E94772DCD549A0284028A7DAC000DEF88E17D7D82C16807E7F0346547DF56E5DF9BC53BE287
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ......\|.o.{..+.2Y.u=....8w8A...nf..rv.`.`...x..'.?..H..`..m.v.V*..s..>......Up..4.@_.h.0h...._j_.O_..T..YQq.Z..;.{f.p..^TQ3.T.a=..6.E.8z.!...;.Y...R.[7.x....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.680055603759965
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teezK2bOhdpuepuFuo5pq1DqE1nRdgqGYp:6v/787vVOhHuepVwSDqcwqr
MD5:	1071F98ED2FE72DAD8644E6FFE5C794A
SHA1:	5D8364D25A4A48552318D4419342C9A83385BAF3
SHA-256:	200F20D1138EBBC1DD9C2B253EA7AAD259BC13526094E761E6161BD0E3A315DE
SHA-512:	B50EBD717A6A90D604FAAB7C74D01FC2FE70F94B671A3E5CC01AE967CCE768610B5C041D1528D778ED0FBA0849A073BD3DAF8AEF0ECF012810FE28586B598DA6
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E...p.......\...L..\|...%......BH..8'..Br..%._....$;......[........P.a...Z[..[4.,x..~.[...H..`...<..>w.Y`.Y`.^-....+..q....a....aj.fuP.k4QA..9#/.9...~WT.;.'....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	291
Entropy (8bit):	6.599343518312404
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tefkojSf0m60lUW2Do64PdeINp0o9ujp:6v/787boIe0lUxi3H0guN
MD5:	F09EC1AA777BA9730A689145FBCAFF7E
SHA1:	AC91D037B60D8F957B1BEA9911184E6B20C1BB4D
SHA-256:	1475E979B39623B03B9388FDE63F36B8E28419C0CB9F12A16AF4E1B85CEB6D6B
SHA-512:	40DD7E1B40CE5AC5E6DE3FC8F36799F381A4FC5D325B25761B916683E03CE59CC8E8661EBFA38C7A91B947BCD54D739F73605746AC8899352D6AE71C5F6A8A81
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|..o.{..+.2...e9......6G..3s....O9C.q.7..{....g./.m.......^W.a<S.{..0.Q...1w.4.......`.:..<..>.H,pk.XlO..~g...e.@aQ7....<L..{^..~F.G...9..MR.sa.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.697105796643032
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te9QqZQmAIWdEjCv/lMk+viWq/2+dFD8Tp:6v/787sQqtLWdEutMkudyI9
MD5:	7BD94B558D195564B9B21EE25C3BF72B
SHA1:	4461E9AC7E0C29AD985389A40C0BA4C5CFF8968F
SHA-256:	D18B18F9BC28F18A7B9C3B5EBDE891AD1EA089BA28105713E17FFF32D26DD7E5
SHA-512:	94852E69D8B3F3CB480AAF9315842DF79405165F3EDC0D8E276C930468110500E98A727E7D055845EBBCFA3C72DA8DE75315D30D8714B5FED41C6F5466DC5A3F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E.....\...;...8..P...%.^....E'..B..(*..s...k..\|X.+.'...\W;."8..p.k.n.....:...As.....^....;...3..>w...m3..t.&......i3.X.E.....0S..u`.1..`.w..x..!R.o......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.667855343075311
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tepk+olboxzdtD8UOTAwKkFL1g42RmBtVp:6v/787lOj84kFn28t7
MD5:	382E2646001ECC21D4CDEF0E552E2FCB
SHA1:	9914ACD6E03D6A8F356B93CBE5A16380B1903B6D
SHA-256:	41810DD913B94007DBA90E864DEBF6A8123F20D312B280D76F62AE05829C030A
SHA-512:	B3E4FD1496DF8A071DBC820D2561F1FE2B6D4CFD8B33201998F6A0AB5B0F04727E0C97628D70EEC6F0752003FCCD82D4937BB6E9A6744B0C96F7B6FDB9985310
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E....~...&...N.d....R..q......9.}..S. "S..23.iv$...^`m......e.+.0.).]{..{T.,x..>.[o.JO..`.:..<..>w.X.Y`.}-..../l.q....a....aZ..up...b.\.Z.C.. IR..".e....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	279
Entropy (8bit):	6.525755340329569
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teLWGMy9q49NvsSc0jh78y8zp:6v/787I24PESc69B8d
MD5:	38F4090F2B64FA4B16E2A05AA42B9895
SHA1:	D8623736037E6F400F27BA546FFE8D0FCBD5E2BD
SHA-256:	C523134D5E7F2CD1F50176C07B4F857784B1F367A1C03BBE0D2445062BF4606C
SHA-512:	77B704936D5450A584FD5D8864318A569C1ECA792F1218E4A5A12D21DD167D7DB92398AA0465FB67065BA8A0660D2E187E2D4AA9FABCFDF6AFF46CFB2DE3BD55
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...<..g...@..a..{x...,CJi...D...`.;.......+.....s/.p....=..=.s.Ts...p...D.n.......p.."...y.b{Z..;#^...........0.6.y.....U....v.xN.6.:.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.603649625519509
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te19OS/PjsRt47o/UiaKjgyxVek9ulvscxzp:6v/787UT/PgqnKjbx00ulUcv
MD5:	A481356BDBCC3849DD5C19D204003FE0
SHA1:	64D99C33329D7C76F696DE0CC6C7B433643A5F74
SHA-256:	00A9F5B555CC7BF7AB4837028295CBED2606DE571BD4FB2CC6A16CED4C8B3CB9
SHA-512:	CF1EF44FA86D4DD10B42EA156AC548EF47A1A43909607B56523BB4D0334E5585635A50A6D53356CD8B8BC708818F7497BE960042DC7D9FFB140227D176256654
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D.........M<...6`....xI-.)S.!.A.1.'...;..,....+...ps.......`.;g.ivx...}....'.pwf.x..}.".....b}Z..;#VX/.....a....e...&h.3...........tN.8..w....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.5999425987194495
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te1kuoo7UCXKCXGkH27l9bMRmxVp:6v/787a/X3XGk+l9bQU
MD5:	1001DD742A9E78B38462E18602E87D56
SHA1:	A9E158C1FEB0B78D060308B0B375631B8D742DB2
SHA-256:	3EC14181892D42101DEA27F5B59EB86B52D4790A0A8B18AE1ED44EBF6F578916
SHA-512:	BB7C66457C3E840E2C213D4B5BC9106D8C942CD4DBD696E9DF00DAD8BF130629150BA0BA98F1EA50DE753C145629541DC00A7B1C88D1224AE39B274B6ED469C4
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...<..g...@Y.d..?..Qp...H..o.8}$..Bb.7......3O......T.a.S..n.0l...'...W...L.M0..Y...N.[...5.,.W...g......iXa..y..6.Y.*\|.&M......YNY...X....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.670510370444724
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teVhQoko8GOLrE3o6dAWs9/qV2X9Vp:6v/787KhSo8PMLAWsZqQd
MD5:	F303CE833CDC8A54400A66D750367B5D
SHA1:	C6DCC6B599B9380AB1ACCCC8E2E53CD8CCFC6A4F
SHA-256:	E89377489C2FBFBA9792CF3602A41551FF7FAF6CA482276010EB5E21EA0B8EF6
SHA-512:	DE20333657F87B12A3019A786827E09DFCA0DB59D0B2056E341113B45008BB3A7D28951EB58792AE2961DA23F6857DE5D32E720C8B04FB230097A087CE987E18
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E.....\....0........^R...MD.!.d.\\|......L.?k..oc&...n.....x.\.....h.Y..........'.ps..x..}..d.;f....(.wF..]..(,....p..icc.....b.\$-....YNYwv.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.655147000952195
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te/xYwp2y7j0Kj17ZeLslVbl2gKkbD+Fkceup:6v/787+lp2y7jR7Z1l6BIyz
MD5:	A5A665C196C5AB1FEE18F99949757816
SHA1:	A0FB792DD86AF35D83A5E5C6E52F6C079517860D
SHA-256:	F2E1A84F373DBAE90068359529A69E6FA2B6576203E5C27729DAA51FED496669
SHA-512:	4315C73D9DF37007B9B7C092B01A58C02DE36579BD805B96FA73A255E12B2B4CABCF5E3AE1BAF6B3CAC1791CE3FCE67847EB47802D0B9B35886EC14493F4E2C8
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C...p.?\.o.w`.&`2-.R.L.x..li...c.!......../..Mjyf.?C.....\..NF..j...b..I.X....=..t....k.IX......5.R6...@..j....3...!..L......,6.O.?k...,.`...c....[K.\......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.700735084203222
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teM/Qdt97qiCHqVAatpMwdEb+s5BIE2bp:6v/787xu9cKyajdU+sfIx1
MD5:	338CCABEA1259AE4EC4A25D81E82F0DF
SHA1:	B560C77BF3F42C3BDE14506D345E5731022F55A8
SHA-256:	2AEC895639C0C91F8E59E5B3B13706CB9AF1F9750C96B328A4F5350F3B17DDEB
SHA-512:	70EDE534717582B01172E1F72F071DB70FEBEA2051BCF27C92B6E8B6BA22251FF58AD7D4A5206E33C8E3A606E31566993B56DF213DEF714FFD713FB134CC993D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .......6....l...L.xfY.5>&A....!.C../...0..._Fx...`....s..lT....Xl..8...Up.;tg.....[.............Y.n.'.Wk...z.........4..m.....b.\....f......V.K.*.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.701868545217634
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teqmnvuULQWFbgHHvvUWJfvTSK10iSYzp:6v/787UvuUcugXU8fvf10od
MD5:	F7F3BA3C0496CF64A2ED73FB51EB310A
SHA1:	8B9808711FBD59B32580903F15A86D1042941494
SHA-256:	0D3C46A2A022C4BF51317F022DFFDAFF703BEE496E36234D576F27C4A2D8A03B
SHA-512:	120239ABE87435DA855CDB2AE55FB676431A424ACDB22C9365F55A442622149077BC24FA5AC35094CD1F19A9E3531DF81C47DD884DCE72425253E8CFF3A0DFF0
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.../...8l.....Z..*.....`.G.F.6ob9C)e...j..07&.}....~..I....^K..k.X.s$.p.O.....8.%ld.N..S/.p..}N1S....V.\|g%..e...(...0.e..Z.&8.3............&.R.+4......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.7548784438555955
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRhQ6k0j5U+KnWP/eemUD/oh+pHAZQq49q/3ouwKVp:6v/787ehz91UjnWP/e2/ZAq7xY7
MD5:	98917457E956E7085C0B7377D2399866
SHA1:	7220EA01E1DD06BBBD16D526B38ABA38BAA74B4C
SHA-256:	AA68EE38A6B23251C50617CA293F08C60E0EEB93D614A991616BE2399C8F7825
SHA-512:	B0DA14FDC195AF85D49DF6D2FAB89B4B87E4E5FA2464C9E3C3E573F2CD9FEAF193B255F5FA4FA01CB70D7FBB2B8AB268DBC1D9BBDC2D314039F20CF0373F5A78
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C........v..l...LrX'.........sm....@]RJk.\|...Vf.......C...ng....9...T..;t.3`g...#A...X.M.b.{..w_S eg0...8..6.sf.86{..5..Ag.bmX....c..+.=g..9.z.).[K.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.74197306011636
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRhQty1pegZbttBx3bAZ98zJTKQkmx8io9vijNvFDTTp:6v/787ehHhnHxsZ9iTKcx3o4jF
MD5:	5EFBDC3A45C364183E7F8B7C4ECFF930
SHA1:	15F7BB70F871DED63B42E7E21031BAB73E01568D
SHA-256:	7316211660FBC08B93AA4C219CBEC826947836382B9988CE0412169726849B52
SHA-512:	48C87957F452B48AF54897944D748C221517D63D6F25E9C1F9EC93F0DFF95AC7C17F102E600123BE702BA08ADA0FEDB29D124822BFFCB39182B77DAC2685F0DD
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..........;...0Y.H...H.~....a...../9.v......Cr..7C..u.4xQ.NF..k.b.....,vh}0`g....A..;1.......u.<}..]...6....~....'..w.Fwb0..X..msn......OC...R.....V...G....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	292
Entropy (8bit):	6.741238313630228
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te7kko78K8q8HfjoREcGCLjmuM+TI24z6+4imp:6v/787ktoH8qEMREcGsjmDmInzc
MD5:	8F2B8D70C144BFD71A50B060A452ED9E
SHA1:	01A5CDD1F2BB8CDD80556673176FDEC007709AE4
SHA-256:	880CE5C398564FF1C067C5CF89736AFD52F460879E9E4FD8C2F366B8FC050C4D
SHA-512:	C7C17059BB45470497CF143D536D7D66C201C5C4912A9DCDB6B8A2E9B1BD952B94D5C828B4575232AF7AE8AAC0A3518ED8C06A3DE96D12CDF5562C2A208A5D0A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.E./...z`..H.....-.>.....Jb...t.....Kg.&y..x..@... {..-....Y*`Xk.t.#..#Nu.>.f../a#.....j..3.........iU.wV.._.....A......gQ..\|......X.f.z]7n.R.o.zv....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.681963281700913
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tepRyKSikyX1hGuBjd6a8PQUFtdDMqVQ1GViD6Vp:6v/7875C/51d6ajSdQAsk
MD5:	3D0DC7FD154FB7D2129DCC871047420C
SHA1:	E95E5BAC30F73D8D6E357549B70FA5E95390C896
SHA-256:	DA71270CABE3BDBDE7DCCF1BFEB43AEF77B34E1B4FBBB94F7D506DED7015FA71
SHA-512:	EA58DF6E225164D0B4FA455E9EDA1E25FB61EE021C14B60BC24DB69F9BF851CEB26A4A1C937FE14AAE0B25334FB4C61156131F8CF65552F09D6392D919449892
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C..7G..G..w.... .5.t.1.V.x...X.K)e.KD...9....Cjuf..!~.<...i.NF..k.b^...w5`.C...vv..t.......h......p.5.R6...@..j..z...a.;P...4.*.el...26..R.\|`r..8>..R...0.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.715059098347992
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tetHko78K80YUvA95kRNdKTi/kFoxzK1ii3ap:6v/787CEoH8+A95ksTiMFoc1l3w
MD5:	C26D751720CAB9BADA70109525672988
SHA1:	258C6569F6A6B63CFF3B618B72AC806E1EF302F7
SHA-256:	4D384B775233B61E9D1615AF77EF4E12FAFBB38D465D74B8F83357CBB2E84E1A
SHA-512:	563292D320E183B061155C804BBB9F9B557F80175A373D4AE58DBF471F642445B895E8FA265D502E50F163A10EC1A858C368CAABB54EFE112CFD7A2600601402
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.E./.......+u....L.....F..L.......K.uuA+.ai<..g....\|;g......Y*`X{..#..#.>.?s..p.!ld.N.......>.X(....V.\|g%..e...(...0.e..z.Mp.g.qA+........[.R./.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.718109154115961
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tepRi1+0kXUmcQ4fYUBPCRFxwm3oW7lXR9dp:6v/7871+0eUdfLCR7T357lXz
MD5:	7009AFF476A48BA4DA8290C4B562F221
SHA1:	A11824D1F932F916D7E9F3615730EB781783B481
SHA-256:	CF6110276B296E4C5D0A9378BEBA99BD77600AE05DB4E50BAC3271AE2D6B69C8
SHA-512:	92F3B38010F3657A3AA6EFF26563C218A5BE2EEE8009294037FD9BB604B718935F68AA55EFD8118E3133B0392586A751F5848254179DFAD622D8478DFB882AC9
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C./7........;...d.b.C.q..'.K.X.L...R.;..:}..x.<....x3.O.O.....d...*.5.zU..;t.1`g...%A...X.M.b].9....@.....q^.i...8q.vy.j4...@.:....S.f.W...DD...0R.tb......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.628554012288819
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tehHkoj2FUczp9zG/2wUGnWgsdwihp:6v/787uEoqFZ3wUngsqiP
MD5:	70EFADED98B0CD8493399448EF7D383E
SHA1:	B0942E906EE17983BC6F67968CD59565996FBB62
SHA-256:	F6B90A8A6D95BD93AFC68C33D850B9C8D49C62370F0E2D720138AB4B9252DF21
SHA-512:	83B08EDEA9F5B01011E8AB5B150E3B05C8CF905FC7E295E4ABDBC2CCB301E5E75E2ADCF52B9D7197C26CDFD231F09FC4FF49361976F4FECE3FA823C258681822
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|.o...@...e9.....6.&"q...c.....qO.3..........uws...8.g.U.....9..y...p.........'.........f....(.wF..]........8....5(.3.T.:._..N.d2......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.537508428924141
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tehHuoFlI77eDJLmL6TA/qVM6NZq5a+osejp:6v/787u/weDJyWA/qVt05aMeN
MD5:	3B34E1E3F76F02116528877930C86ADF
SHA1:	79079856110FF7405006AEB0802673216CDA7015
SHA-256:	D1529507905838E04FB7D537630570A9148766D7D295E7375A9BF3A61A27D830
SHA-512:	C6314D76E5E48FDFAFCE3D09AD9884E2B7F9B816E923B8D02CDD635EB07757C1CA161F501D04666F974AE090B757A305632FC0E82519869A365F16E6742F37EA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D.....6...b,Pv.d..?..Qp......}\..#K..2.....g...<.Nx.N.kS..qO8.%..E..f..k.\}..3.7.p.g.x.8}n.X`.,.X...\|.......iX`..y.Z.....F.&X.....N.{.a.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.73153569622792
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tepYcM4yl/EeZHvR2x0TS3fpb63oXLTOkbvTp:6v/787vf4yHZHvMyuP0oXLTTv9
MD5:	3D36F4018F29CC556FDD0F2CD4935D8F
SHA1:	E61A45F6A3EBCA9782C15AACABF6011162D32154
SHA-256:	E42C5F0DAFB709CBF9231A2997EA66B9E55A8B4FAA1ED4DB55EA2E82489D1C1F
SHA-512:	03DD8C29181ECC3E30C10E87FF066DD9DC34975326E91FEE0811F7BC2376500E805CA5DB76ED39CA67B2B7C32EEDC42C049A15DE47DBB1BF01B2064F0B62A33A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D.........M<...6`..%~./..<..BJ).../H6...{a.5......7.Vf.......8.{..jK.a.n.........!,x.....%........f..........z.w ....,.0.S..5..._...J..9.\|...N.^%8.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\48.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.533791415580225
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lQkx8DVlZDUldp:6v/lhPAkRTp
MD5:	E7D31AC53D124242B574C8090362FFC6
SHA1:	39BB8F5AD0330977037D5C25C53B2E66B1CEC898
SHA-256:	A901AFAE7BDB66678F08A39B32F8A46DA9864C8A64FABC0E77A7F12B93DF12BA
SHA-512:	96D66670CC0D53E5B937B6136A69BACE772DB75D76A7DEC8102F47E3DCA2E739AF5E82A01696BA6288CAD3B001CCCEE82CD2D285320D190B870175EC3D4956AA
Malicious:	false
Preview:	.PNG........IHDR................a....IDATx.c`...`...........E.,....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.74226178808602
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teFVQB5QSi3UGfuTYamktOboFaD7mx2FFTvbp:6v/7876SUfRamkLFaXq2DTv1
MD5:	4164FF80CDDA5512C5B9BABB424DF4F7
SHA1:	9D5E5BFE06711D582EAF66377643BEE8F5ADC241
SHA-256:	638E4D77169D251DDB6ED8363095BCF217CC373635BC54E2ECEBE5E44BE8BB6F
SHA-512:	367ABD44A83BFFA6D9E81A86103151BFEB1E9C7582CC68587730E4F95944EBB0E44F97C2B0BCC87AF3BC42225C6174A2221EA5E45EDF2C7742BE02C87C092E76
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E.....\...;...0.~B..[...J...3....w.} C.`..r1.ZJi..x3.g.........-..8.......#.y............-.v........E.a.....u...}g&.....*j...h.....kQ..>c..2.?..q..^W...A.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.8358020037256155
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tem/7uxN/fxCmYph28KSYbiAFVPcGQkIGUp:6v/787n7QFfi28K3iAnDQk/W
MD5:	218BB8593827A4D0D7A34DB5396F14AB
SHA1:	EBC7CDEE2664F1BC0C7362CD4D41F57493C3A2C5
SHA-256:	BEE592D569DD8E8F18559E3F1FFA8EC740804FEB19C550EDC4711FD99A0A9560
SHA-512:	96A8BB3477D137D6516DD36E2D601FA29370055B3AE97B2028680F2F58A5F24C040657A483DC09A96C98AB58C79D9A974FC3EA6E81EDEB4DE9830E0D0BED2E61
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C......C..Rw..L.d...........C..h.J..x.h[)e._xv....o..A.dj.;.5\|...y..h\|.....>....... ..N...&a..}..w_S .`0...8..2.{f.8....5Z..`.bmX....)c..+..s..?DD...#W........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.682854114346125
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teM/tZqP5kBpM0DYesKP433R3xVhYRtp:6v/787xtmKS0EeRUR2D
MD5:	55C5CE34850489E7750532E73847AF3A
SHA1:	B3A891124B3BD5F029444D8819F1C03F7E86AB5F
SHA-256:	155A5C553ECF1344F066FC8DA07EDF8D16F84299667A4C437A03F58B65262376
SHA-512:	051B5BEF7DAD57E42D87C7CF484B99CBB7CDC7FB43A5B81C6DCF23455939FDE28F83505BAF4AD69D165318585FFD58C33EA2E5CEFF9E8F29E7EB399FEC2CC40A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .......6....l...L.pf].5...8w8A....B.......)3..$w.~...;.B...u...T.....m..8.q...07h....../a..h'.>.....v1..m...r.&.w...x......f..@.z..m^.:0..]L..w.i...S.?.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.75058959835176
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te9Qosolx0bgr23lFt/dz095UMcltvso572/jnxiFbp:6v/787sQxolJiSUMc/saY0F1
MD5:	8790091D6B920158C53D84BB54DF3FD1
SHA1:	2DBF5CDA719468626B44D4DC18A2223DB34B042B
SHA-256:	1CE12125E7406559E398DD062476468007B497D06FC06C5834EFB6AE61CBF4B4
SHA-512:	9F7D9E706A520427B76781D1AD535425D5361B633AF304F61DD00A8B542C85AF7862C3FFD1E5BF1FF0C43928043D6B33781C6E969EBC99FE77975AECD9FBA891
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.../...x..o$z..T@e.V.....H....D.(d`...cH)..x.R.pO.=.^...k.'.~.\.B...LY[..0.q;g.e..4.n..V".w...'........n............w..(.+,.0....=.......J....... .S....H....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	286
Entropy (8bit):	6.699654686140798
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teQ/7kcu/oANudiULmeshth38WpnpIMS//Vp:6v/78797kA6HUqeoJQb/7
MD5:	D8160890CD189BB400E796949D31A811
SHA1:	EF8B778D332C352FDFE46406689BF2EB1008E061
SHA-256:	66F00DFA8A1286FDE38CB68107F5ADD555DB81FDBB88166E8E89F4D4F4FB8128
SHA-512:	45E9A17033A68303BFFA02DA7AA414DF67D465528F27684CAA973E472B087826336A9E674EEA5310B3D385AEF320CA63632A5A81890A7217EF707F949285771C
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D..=..p..\.x..(m..C....,.)1.H.1...}d.....7.~....'.....R..8.{.Q.....>.n._3...2.p'.n.<.....].,p.,....\|......E.....0.m.y.T..]L........N...P@....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\gray\glass_gray.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.9362600275315267
Encrypted:	false
SSDEEP:	3:a5I7kRo42S:aWARv2S
MD5:	9CE85D4FF2E6D0BBE60E5E97F84B53B0
SHA1:	EB6A98ED0D73E666E45DB0EAA7086B1FC71D0588
SHA-256:	D04FFE6629CEB05A3F71BB7927D0563F8BCF8017DA0E5211C0BD23F570EDB21F
SHA-512:	232275BCC1417DA7A692B21577C5931E240F9D9BA3AC9394EB2A6E089A6C48BC7A18C59CBC91D8A35B82C25D7A23A1FAB837D75B1343BFB55840C1960522CB42
Malicious:	false
Preview:	tiles=1-48..metadata:7

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\green\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	303
Entropy (8bit):	6.759956884346171
Encrypted:	false
SSDEEP:	6:6v/lhPUe8KQZA3teRkowyHCBfHNeC6fF52q3vQl5K19rpmZjp:6v/78A74hCBfHNeC0D2q3a5K199u
MD5:	298A1E412E846BE9DE2D0E978F35213B
SHA1:	4094E35C889B269EFF954CFE724BC52DDE8B52D3
SHA-256:	392D7A82613EC8D264C31E07532032AB6A10F5B1FE9BF49937F527A3A721DFA4
SHA-512:	F20F0C9AFA5AEAB2565A0CE298900EDF4B55A37BEDB9BC5D61BBBE846B54132B03ACA04FF4685EADF7F4F79924323E6BB5D8869923A9668A5D805AE76CFD54BB
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...o...o..A&.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E.....W..M......4.\|.zx...O-..3.J&......X..\.]bye.....nL..Z{;#.g3..qR..7.....C..;{x3.:0.uO.\......O_.@....M..v....@....p..h%....u`.6.W....h..;3.0#.P^...B........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\pink\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.630083445839129
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te9Q6Tv2X37oLuhm6ILi/yI2uPVT776k8p:6v/787sQ6TvwMihDUYBPu
MD5:	3FF42DA5D0AE27884573C8125D4752F7
SHA1:	52B1743E03C89BA6D420B55DABBA933632C86192
SHA-256:	D10727EDEF2AB43135B33F3749F3F9A528E1AFFF1FFF51589BEF9E006878943B
SHA-512:	13691CBBB52601074922A630C4E9B82F661422C61368E4914704BC3549179D39DCA9E1313C238DA44368F45C6BD9D617B97A7466CB0B6304D934FC41459450A9
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.....(h)......2............;.'t.t..Il.x.H0..2g...-.^..H.A.`.w.3jxZ..s.,......./....f.J.ht'..@..X{.3..k..,.j1....>.z...f.{.F-1(.T....\.^e,vu..;~K....n.!.u........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\pink\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.700262272192738
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teM/PU2lxVt8lG79CnkWXYLmKTRdp:6v/787xPUov8cJ/LPTRz
MD5:	49773D6C96806FB27D598309457798DF
SHA1:	7FF52596CC308D8C940A9F14D00F6B6437CA918B
SHA-256:	FAD34FA7C2B234E787CA11B3E1004224270B3A705910A03014CC1096C1689F34
SHA-512:	8AAF2B42FD5DBE73FDFA0EAB620BA552EA7E9CA597596CC199A2A178D1690BCCDFA54EE89CEDE1278801D5ABCD225A4FE3CC8E48ECEB2DB36EDC61BDE9D851A1
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C...<x...........@J...Q......./6..n.........1..^{g..C.S.....N.^\.`I....&....E........+..n..e.IX\.\|..O_S.lP..P..ia.{P.0....Aj......u`96...q@o.......\...........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\pink\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.674462196916754
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tepeLLiGTDSE0Ewbv5iy68tJPzCbE58Vp:6v/787NniGbS5rBPWbz
MD5:	090E792DC797C9C5CFFDAC62CAD54652
SHA1:	91081E0656B7B5552DB37CD61B526DE03A650242
SHA-256:	DA8FE438071E24A5604D3ACFF8179D03D4F2C901A1536136CE401512D4281047
SHA-512:	003C3BFB0C1CF17C6CEC0D6F4E9367971ED14D3CFB540F8ECCC9DEC80EA1D7F64359C64DC1C4F8CE898B86CE8785C7B09975BE3A1BD20887D8515103AEA331A1
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...<x............]..8,.......t.W..pv.sJT...&..z.<.....-..c.f]KcK....8g..[T.(x..~.....%.$X\......)RJ.4c.,..6../....e..,..+(.bnX..p.Lj..D...47....k.....L.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\pink\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	286
Entropy (8bit):	6.6624254136746135
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teQ/D8KhrG+nnEg7kEocCf1EcQkJ0uHETp:6v/7879DnrrJ7k8CdEhkNm
MD5:	8511CECFFAB8055E90E705748797DBC0
SHA1:	BE01E7026AE1322ECD0197BAA4D3F80557F0C4FF
SHA-256:	5892A5D3CA7D42B24D536F4B1C6C2C6EF8C6C8860FA1FE70EFFCCB5739806E5E
SHA-512:	3A6DB10279CE56D4E262A5AB8572C2EC307FA1E237BEA6FB25A27789829AFBA6D452E95B3C71EBF10833DBB1319E5E85108208022F75FF000D8A0A27DF1E55FA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...<x...."..*..Y..8..;.D.y......p...(...%2...o....`.c..]K.J.a\3V<g....:..f...pu.6...`.jy7..>.H-Q..aqy.YP}a......X...(.0...F.A&...Q..w......a.\2.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\pink\glass_pink.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.9362600275315267
Encrypted:	false
SSDEEP:	3:a5I7kRo42T:aWARv2T
MD5:	E00F0F86A3A1C6D2EED2E7C4F27E71E6
SHA1:	3A0EF2BB96823B1718073A26DC759B9E8B399330
SHA-256:	8380620233D5A15BDDE8710EDED69C833DC49E90E9DF62A2EB5DC4E38298B255
SHA-512:	0BE2EFCCDD579EE1BF3E5A9C783899FFDE3EDA7080267F188CE7B23B845CA95A4CE69DD69BBFE6F853CBA41C1DEB2DC8B1BE6624C2EAFF0568E6EB2F4FC28BFD
Malicious:	false
Preview:	tiles=1-48..metadata:6

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.693089164731318
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tefWkonCKesHlYS6Clo3ArntJlj5GRgup:6v/787gWhnJ5yp3+Je
MD5:	A24771CFCDAEAA017B522A0AD0B9DB09
SHA1:	4A78E7989A3D428CB56C009A13CEF79A58ED1F5A
SHA-256:	01AFBD3C4FDF0A67600EB4DC173F1E16FD39F782F4E452F4FC72FFC39CF04920
SHA-512:	53E572A3FD024ADC5C27678E147CF80D9DF7DF3EF39B66009C184D3E95CB736A12636AA2E8A20A4765C658493CE94155A4C03E76F225AC6D3D51FDC66AB725DA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E..m...W..M....0.\|.&.OA./b.....s....0..@.........43.b..z7...........8.b...A.X....=..t...'...v.b.}...]...`.&Pc;.j.{...xb..Hj4...@.:0k.c..b.yT.......\|./...Bf.@.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.604927855382843
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teTMkqeBBycu5q03si36HOjL3l7/jp:6v/787NkqeBhMqod3NZN
MD5:	DA7B5D48CAC527106E89E591A2317D67
SHA1:	303419FEEA320E750009B3187654386F9E186D13
SHA-256:	DA8ABE551110A7BCCE32A627029DAF4DA57132D82005804A966DA2059CD88191
SHA-512:	30F374663F9E8AA7FBD2C05752D5FBFD6845898E7061D5164FB4B5E31F157998F31DF8953F41896C2FB0BC09455EEF8FAC2839D51C884C191A036B657D8FA641
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D......^9x6.....f...B..^..<'K....0}#.,.1>a...^.......xV:.....u.).0...6...(.Ip.m^...a.!.&.........-V..5..........1j ....H.a....=..._......a:.....l.M.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.641203137809524
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te1kkojHrn5siCHR/gWMayXSzfB78jg3Tp:6v/787go/sR/tMRXSzf98jgN
MD5:	BC4304EF87D86C1BB32C91E97A1D2519
SHA1:	7E732F8D4A35F31A6D8C22A66B342FDBE09377CA
SHA-256:	F23771B0FEA75CDCB8357EC04821D5C0BC4B3B4A58CC9364CF8D6D315345AFE0
SHA-512:	C8B70FFF83D6D8EE08AE3A8EFF928EA1DAB87A548BE76A0D71B7695CD6FCCF37DE814B3C67E7BB4693ABF4BFDBDC8DE424BE121E0A1E065B9F86B40E961A438D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ...L....~}.6........B..$..9..?.vBt....^L.....g....T.;..}.(.0......+.s..f..p.<l.........p..be..........e..`Q9l...<L..{...?...4.......o\|A....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.575132448285589
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te1/4Tp8DK8qaeZN4rgVpumrOE2rMz1tVp:6v/787hTp84aEuQka2YL7
MD5:	2176C67B6189F4E9E76380F080A1F9BF
SHA1:	28947BC73AB6EFCFE63065CFFB78E7777773CB65
SHA-256:	50471D8341D1F78760D23FC7DD21D9325267B9CB15E5ABD355233F9F1D45685E
SHA-512:	1C7CC9D470A699319D5833FF69E5F9F78DC15C21FE1840D689EF3AAA0FF9A7ED1D41D345D270B07E2CA469CD14F106CA7FBC30C078B70BB76C279954D669110D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C...a..Z..H.B.pX.c.\|.'...X..+....T..a.I.n....[.........h..~_;..{.."8.>.f...a##.&.N......-....@.xZ..;3^..I.CE..!...0Q.......>..i.\|"N3.2..^XY....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.731345362221699
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tefhRLkc40RI9LeHWjWoR9Jm9HxCZrap:6v/787g7V40RKLBjWoshxCZrw
MD5:	84C0006BFBBFD5924572EE3558198604
SHA1:	B56957918B87D3BCBDE01FE70C9659B75A8F824D
SHA-256:	781B05483C0C07B905D04E1873E2340DFC85B701F45E2AB52A6C9D9351C619FF
SHA-512:	3F150F39D6C52814DADD825B067A1417BDD2604A9484D6E5D180B95C4357BB4DBDDCD3377EF585BD4B9B6D10AD2F44B84A77D2D44E7F041E49B305F7392FB9A0
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.....a..\|y.Fb.N.b.N....u.x.(I..n...p.......X..X.&.]-....L.F.`..w2jx&.\|.7U.=..:...=......7."...=1p.4....:....@........d.{.....vXq..%....u`..k...Z.H.q.....o.p.&C7.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.720079585304636
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te2ZujNhXS+4X3zslu62ThYtj0bp:6v/787XQjN47XjElZ01
MD5:	655CE2D52934BBF1406A11F42DB6C404
SHA1:	7504016FA42F3852FEB33A1DC23651EA83991AC4
SHA-256:	DA775724B8D398702B24575262FA7CAC715FBB969F28ECC61F5E7C5B51E3FC6C
SHA-512:	328D421B9AA3256003E023E9F405BBB7E8D284C5EB504127EE345FF6BF9E574EF0171EEA37305A8E0257CE9ADD0DC51CCD275398E04BC959CBB80F9FC132289F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.D.........H... &.dp2...D..I&._...o.x..s..."......6Y..P..f.w.m.....m...n..b.....{.y.<f.....@[....@;..4.a.<}.bP...b{.S..@...0.\I....X.im....>..)......4{..!b......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.695817541977799
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tetHkojHh5c9fsFFay7WnWUdUGFtrvaZbYp:6v/787CEoN5y0FFaMWnWuBXAby
MD5:	F0F630088BEB3F68F8AA9DABD243432D
SHA1:	B74A8830599906DE20C415E6AF2246023DEEACA2
SHA-256:	89BC2F118D1A84FD5B7D84EAA9E51E00FB1E53F2CE7339BD05D4A48D681DC873
SHA-512:	CABB76E9D5EF60A7B6B4DBC36C888929D96074773F0962E3BB2E30A36940783EAEC696A3C70F706D6264ED2CC39D5C337042F51EAC1CBA895BB6D9D5E947DE5D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ...L....~}.6..+.X..y...,.Q.. ...h.n;..X*......d.(..dk..Y..\|......f.+.8.g.t....=.s.<f.O3..yX).....3G.3..s......b{Z..;#^.......a....aZm.s.\.3................IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	299
Entropy (8bit):	6.742172893193361
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teFQm/dEsuShrh/VmZv5/zJcQVp:6v/787m/d3Nh/VmZvsy
MD5:	2DBEF451E93158A1A78D51EB9C78FC7E
SHA1:	5695747F20F49E3E1353A6C41B6BC20A0A08749E
SHA-256:	7D1D35A47C5A4529A43B433958DD37280B1B379712C3996A0FD6CF6C8FF901E4
SHA-512:	F153CCC57F8336C0CE904211789E1D681FBFA855084F2AEC60FF97353B75D401ACF91E0E7CB6D5762438EA0338EDD7B61318BB2EC57AE7880693B697A1425F87
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C...a...r............G.q..'..c....#eNbk.} us..y....$..e.....?....v'...5P1........;;..........h........5.R....@..jo..g...;P.....*.El.U.2.]]...e8..3......j....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.683649625106458
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tefp/efK7TQGeQpHXKhQ5ZcUXhT0QBQ4pSVp:6v/787gRaGcvJQ5ZcUZpG4q
MD5:	7981D97C8C46916582605A4173629755
SHA1:	7E49928C3726046432590CBD7208274C91034631
SHA-256:	AAA54363180D574091752ADE667E55362217852BCFF0A2126C7EB7EB402E57FF
SHA-512:	28AF979C6E02E43330D77AC6F05D591CEAB717D83349D3035C4EBF375437AEA2E49D04A69356BB9FBC6270623CA4B16F4E1729AD3F2EC96D26B660FE5A810DDA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.D...a..Z.j$v`."&.d.d>..A..I!.^.C54!....#l.l...c.....M./#...".i.<....B..a...Z;..{.u..f...........@;.p^.0...v1..o.P.].!.....xa;..gQE.0...u..6.9...5........f.......a5BP.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	303
Entropy (8bit):	6.727376029600756
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teBj+gJjGR4O7zs6t8OTNsmzo+YpJ/Xlbp:6v/787IhGbzs6tbWSc/N1
MD5:	58384D13361AEE1A7E9A03437A9B61D5
SHA1:	01CB2C9B64E858E5C8D769700481703EF038FA7E
SHA-256:	04547907192EFFC442112BA4985E709E6EDE704D82AB65DCC3BCF390F64CD47E
SHA-512:	3F05618876B677F8B8D904650C2C7A45CBE3563E9B30ABBBE0A2FD8092274DB5B087823E9BD2A406E151AA177F2573F4EE8BDE8C8505E93B30FDEFCFACFDF626
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0..S...x..7Rzp.XT@ex..Z..$.c...>..c..>.....\|..+...0In.3....h.t...........k`.8....Z.....f.t.h.N...v.b.}..O_.@..A.M..q....g.......T.*.E..>elvy..._.A.$H=.'0^.al.uv....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.672638398638751
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRhQoM/Wv/g70KydMfriw9bSGLAgzVp:6v/787ehgE8zydMLVSqAgz7
MD5:	A077E09C5A9E9F4368312E1A82465E4B
SHA1:	BB9A5345B2DDE24756E25587B54762D6B86F99B0
SHA-256:	D9A4DCEA5A8691508D8250DFFF1F57D67AD8C54D8702C5829278373480B9D4AE
SHA-512:	8CFE9787063AFAA560E926C536FF161D53B0D1842ECC0839845EEBC6F1C84D4F40311E09D05BC4F2C1DD5B28C47A6C050A0481FE7CEE3D54A07C0C998C861942
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.D...a..Z.j$v`..L.d........O.6.b9.PK....I.C#o....i.I.?[..o.A0..~....c..s .pD.'.e.......6.....y/...p.<..xL.... .wF.._F..,...p...cc-....1f.4.)..BP_.....i.\|.5....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.7050813523225195
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tefWkJBTEbXt0MKz75LtgiW5EwT35Le6hjp:6v/787gWgTYXGLz7HWacpd
MD5:	A66F17AD8B0C6904277430009382F914
SHA1:	8039D11286768402707501B1F3F9D8B9F54247D6
SHA-256:	09DC3341208A217418B52779F70908D135BD6AC3FECC2C2ECB22F38769EC94D3
SHA-512:	71A42921924C3229F035BDEA435729C50D6FD271F9F528C2A0EDDD36EC7D4F7A0A1DFCBD93B6123BBF1A44E9E977351536370BEE8AEC25E1F02392FDF2E26F26
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.@0.E...8.........8AO..h.~...%..1...#..V.....,...7C...}M.7#<.Q....>......E.s.,i..8..E.}.3.W...7.....y...x.....MC.v.....3..a$.E...@...aZ..t..c.y..;3.0#.#\.z.Y].A.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.720715054839388
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teM/0jQF5EAFfl1WbiAJ/9wkhrcVp:6v/787xjqAlGiAJ/e2I7
MD5:	DEEAF48C03C40DEF87B94E8436ECFAD5
SHA1:	960ECCCF8B694F5B1354B8C1511DB3E85AE63429
SHA-256:	0F997FC39D6BFDA294C98E55965A9027FC0787705BBDCC9559EAF1F3B4F469C1
SHA-512:	27BC7BE18923EBE07FD35C2F7B692CD40EB38F61059FBE40224F3F39FBEAF391880405E8AD1051373F838E9FFE4EB76F62AE429F6170CD698E62E2CEDA585260
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C;Y..8p..3Rw`."&`2p._9.C+z.H~...'<...)..-uy?.../z....].x3.#.CM....d...5..4.xQ...t..0....J.....Y.&a..}..w_S e.h...W...=..9......P.P.6,bs......U...;......6.^k.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.585020798597003
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teVhQokojHrnx5v3ZRdc7d51GIwEPA3Tp:6v/787KhSo/n3vFMd51rP49
MD5:	A31D183FD8A5E3F9BE471543E64C25D9
SHA1:	769A8D981AB177985B25DB5227B6920ECC0BF256
SHA-256:	0747F202A58E47509E64EDE355312A9B1827AEE28A961FB1FB2BB15FF7A94F2B
SHA-512:	6548ADE9EA83440D7749984053FE7093CA1B675AC301027B45E4C5FEADC26EBE8EA2C86A35B9ED88CDCDADB8CE0006613DBC4F730F8B92E319E2AC3A50F57D07
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ...L....~}.6../.(.E]....I..astK....h.A...S...-........`.uy..U...3e......9.....p.2.T......#.....E`._.`.=-..../l.Q..E..B...0.6.9....}L ..B...r.....#....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	286
Entropy (8bit):	6.643509646072454
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teQ/5kojHUl8oYjYjGSzwSHwDo7KSLIldp:6v/78796oglT38SmQL6
MD5:	FF9BA20A7C50FF510A2192160744FC51
SHA1:	5C92C89071B706110FFE0A1D00EFE609F6FCB54A
SHA-256:	0103D6F54D94340BA95735DF5F6C5FE412C6341CE29264DDD78BB8CA25468A15
SHA-512:	78816B29A2FB89CA9E58DD4D53E52953C99D2C046E79775524482FB69E83BEEA216411543572F5F2587DD9E883204E9B938D17673716C6AB37250DB1910360BE
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ........~y.6......"..A..$..9&.b..\..S......2k...#..,.......u{..u...3a/kC.a..........z..:.n.......p..".....X...........~X ..y.Z....7..6E...b.....y....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.631795640928325
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tep5kojHEl6+SSzeFADGFYo34/Yrbvhp:6v/787Powg+SkGFrFrbvP
MD5:	91E61C6D57DA6253F6FC4E717AC71A95
SHA1:	9CF639104C9F4F18989793C5B17026A88AAFA56F
SHA-256:	CEC84A81AA0D1E88315DAD6E2936CED5346358796EF53211C91DB74A09515C50
SHA-512:	6AC9CB245CD48D7174ADFBF4DAC15A2CD1FFE632EDD4FD0EC5B8B57C502B2C14F486193448416E39EF2C40F0E4AAD14165F2435AB1C52D1F03D4E91CFC7D56C1
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ........~}.6....z.....Q.. .....P.%.....@.cyC..fO.O..Y.3\|.......m.+.0.)k];..{..$..>.f...a.#.&.n.......-.......iA..xa...(,...p..i.q.ip...S...........C....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	286
Entropy (8bit):	6.591072574558652
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teQ/8F8E8UD/K36Ha9QnqXDllbp:6v/7879cGUu3Ac
MD5:	28512D695FEF2A2CA92AB8D3CE404179
SHA1:	E6DAEC84B83839599742993FA25BDA07930ADBD3
SHA-256:	B44A4704A213D5F500B5AEAD186B76B91E7B509E2815B7B46C724BCAFEBB7A39
SHA-512:	90AD23F44B0518ACFF9D0542F9634F6E19C7A0920FDD13F8C88AE1DCE942CC0D80A43F828EB69394BC49286B6F99C6A4817F83E0AB7D66249F4E2225E03E6766
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D......^=p6.....f.........9Yb7..N...dA^...!3.{7.\|Y.#<+......u.).0...6...(.Ip.m^...a.!.&.........-......jA...Xa..5.X...$.0.Sk..`...F..~..7..........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.839249992072426
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teFVOsLsa7DT6TZoCHb9ysrjJlkAjXjp:6v/78765L7oHb9yklZ
MD5:	C5AA2C842897E0EE0B6E793CC6B5C19E
SHA1:	956DB014AFCC9E7858426755FA2BE322259F630B
SHA-256:	34BC6630C4253ACECBDCE4F32CD6B6D16B286272AE8119C275703FF14B0677EB
SHA-512:	7AB39924E2DBEA93A80C6C88CAAC63720F838EE922ACF2C48B68AB2AAF333FFC45495D9EB93AE7CECA86AF090201F25C56EF9D2E5122E3626A7C17BA1C9E62ED
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C.L.q..^=x6q.'.8..I.?)..^..-.........'...G..7.. ...7C<....4.NF..d...C....oj.b.]......A..............@......]m2.;.{f<..V<$5z...@..0...S.f.y$...s8/>..=~*C.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.5736891054965785
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te1qw81TqXFXB7OiSInwKL1R/tSid0Z/ljp:6v/787kLXFXBiGw4/tG/7
MD5:	A02AB0CA71BC92ECE653D7D4FCAA529C
SHA1:	26A40CFDF0FCDBB31CA23B79183768F0488629DE
SHA-256:	F83F29ECA6B904D4F8C70018633E1CEB522311EA5C11C278AC97CE7994DE2093
SHA-512:	1ECE27F00F4B310F59177D79DA7428C5697F6F8FC1E323ECB2DBF750C96E1343A29916C5E6CE576570A1840FE0A42D7E0D1AB9D127CC31D5C7084B1A1DB02F93
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.@0.E.......]t-q.' N.d:....",^B...S*...'...,....i....>,........u...P.8.5.?....-.:.N.Mq.....~....w...b.8}."..nSa..m..w..Xa...{.E.@...0.m\3:..c.I.....6p?..F.i....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	279
Entropy (8bit):	6.63395370804314
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teLQblon7M/nXA7dcjuy9zWXLdp:6v/787Jugfky9MLz
MD5:	227828A6CCDB234AF850E60D6EC80925
SHA1:	4DA5A2F5B48284F148C230507C59E7F33C18415C
SHA-256:	7FC8BAD236424FEBB8B3E5479305290DBF9C5FD3C635E855483FD727B652A8D0
SHA-512:	B266F21743C73FBFB401CBE4B5C0AD9D9083E41D27FC9F3E96B3D1686EF5829B59FFB0FE4349F94AA0F26A05EE7FC1354B9AAE31CA365677FF2794C7CAA6F23D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D.L....^=p6...P7.q..... 8........n}B.....l.........f..8.g..B.aE~N..y5..^.....`8?....N.[D.....iA..._F.......8....'...3j..3K......c.W....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.6948815302271525
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tephm/21wuR6heFkaPylcyv/XlWbt/1Vp:6v/7879/2G4zKlcy31ctd7
MD5:	203287890E6475ED3FD00AAC9E496734
SHA1:	DE2A37B817FF112465282F8DEFF47031ECC8AA3A
SHA-256:	7BFE6458825D6AE3775BA2F70665EF7B368AB9C320EC81BEBC78044930E55BD7
SHA-512:	7092E93F549D446F082240EC30BA72EE0F503704CC7C4D5D4792C71C5784984BD5BB2D10170DE73BAE949DFDDB19022FA9F25A7146836A3040992BCA955F4DF0
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C..l..=p..3Rw..DL.d._9.C+.......I7..p[)o. .....!.....a..?...h.NF._.P3....o...I....Nn.U..Fwf..4....s.<}M......Rp\.....r.8.z...2C.@.:....S.fWW...Jy..Y.....Z....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.681889005754757
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tem/wqyUurHJ8MiNlZTwt8NyFHHXrTDpd6Zbp:6v/787nlAy/tG8NyFHbTDz6Z1
MD5:	2A0323482C14B93382E9A0E95E77E2F8
SHA1:	9E9F5DBD0095C08D908835D53ED4097348B10797
SHA-256:	584D60492C43826A8E29531350A001A464C2328AD0D77F79A942C61D97299E5D
SHA-512:	A241D4D83D2FDEA05F131CC9AB7D11793D5941DECF3D1A133DF8C709D1FFA4ABD3767B4F35E4A2B5B5A4D8350159404774F63D92BAEA712829C03851FF925FD8
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.@0.E..........wp...8.N....6..%t..1.....[.."....S.O..&..%<..R.,p..kQ.BA.0.9^...[.u.<f......n=....w...b.8}.bb...b=.K ...3b.u3..E.....8...q............;.....ET.I....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.6468413629506236
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teM/Dce7HmwVSALnhKvoal/v/xLQuKvvzN1p:6v/787xDjGwnLhKvF/Xx0ucB
MD5:	CCDCCBE1785E84041DB8C0544C1D3570
SHA1:	51E64ABD18979BF8EE7B011D03F11BCDB8378AAE
SHA-256:	231D7E2F9216E236A1264404F725D1DF48614CB900DF65169365F47B575334C9
SHA-512:	17E225EFB16876E53997B8F873F8E5B9C89FDEB46DF8A98A091A703D6A14C5142B0120B4A524CE6959B1687AA071BB763C65FD14A2A5186C5AF73E9D613E5D0A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D.L....^=x6..+.X...Q.aA=...<6Kpc.Cd...xN.nl....0E.d-fk.<,...JE..8.Y....0.cC.a.t.....W...<,..\...=C.=..s....2.........z.U ....H.an...kF....6. ....w...c;.p.u......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.690795403895984
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tetHkojHrntRFl1onsKg36MyRc3/trvaZHvdp:6v/787CEo/tRFl1136MyRoFAPz
MD5:	5A13A17F49A0A2ADD83FE7A59B037D22
SHA1:	2253FCD42C99DFAC79108781A1E91DF0FFD84066
SHA-256:	14DFE4129D1DAAB895B584BBF025B9C9FF1F82ED2E739D47B42CB8EF0377CAAB
SHA-512:	474798CFEFB2BCF806746F9C4676321F662CBC764473E305B9636341612876EA4528C67033E14B439DBBCB83248C8B527FBCD127354F447B4E8B37D39AF9DC7A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ...L....~}.6..+.P..y...,.Q.. ...h..B.........{Y.a..dO.5........`.u~......3e......9.....p.<.......#...........b{Z..;#^.......a....aZm.s.\.3..........d..P....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.769313494570062
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRhQaRgyRS60lrDN3cjposlCtd0R4dDF/jp:6v/787eh1RhaBVcjpX+F/N
MD5:	B9DBDE7AC6605AC86080822DA5E52E89
SHA1:	66A1FE3C47DFF245F37F027A45335313166E429B
SHA-256:	097C69755EDDB48D4EDE8286FA89C8B64001156CEE95E7DEACF5FC2762F621BA
SHA-512:	A805A64D6CFC057FA27F3833054B96657408786C25D9AAC6DF3AE515352845572E96033E2515A1A9501583A42FD82EFC4B9EC2858CF3BC5AB36FCC57580FE192
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..M.@0.....8..m.]K...4=...d..>S....).k......b.}.Ot.....p...`....v.&(...0.....y....8.~..[.....;.p^{1..>w.Y`...X.v..w..Xa...{.E.@...0.m\3:..c...?~..Wp...........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.6329068529829245
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRhQqr3aRmu7BosFin5PAaJsFHjzKqdp:6v/787ehDr3WpSyinOaqFD2qz
MD5:	2F88BB1978A1D49E8CB20E1C50CA0268
SHA1:	018246ABC65DA6FEFE59EA769D621944EFE5074F
SHA-256:	FC95E88440CFF25DBB2F74A3414D9EA5CF22B693DEF6CE252C02CF149B6CF147
SHA-512:	BF413BFFED8A34AAEB3520C6EEDE20DE4C36C8478981E0CE278ED75D11CE38D0994FC89189F4F1A32B4AFEA29AF308156224BAD113AE16B5B67C063B78C6F72D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E.L.a..^=p6q.'.8...Q?.B..K...M...mI....SR3.k.....g5...xX..\|.......V+.8.{.t....=.}..f.O3..a. .N0..9...N...,..4XlO..~g...e..rX!..y..6..N..}L ..J~......r.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	279
Entropy (8bit):	6.6468106719095585
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teS4Tp8iYHNtpKqVdPxtlP8XRWJjnTp:6v/7872Tp8iknLPbCB+
MD5:	BED87BF3EA2413584A0621E68816168D
SHA1:	375903A71E25999C50166C6A932FDC732E24CEB2
SHA-256:	E1C4A660998E80FF6AA67F1C89333902EA0E63EB59810B6023417ECA26A45672
SHA-512:	8E51DC49B744EA9404BF7E00137777CA0619C31B63F28871731CD17E323CA61C9A62D6C232EE931D75BD1AFEC655996A5C567F81B06D75081329A0737D972128
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C...a..Z..H..b@8.....-....b]....?..Y..v.d.F.?[..o.B0.:.......1..`X....4k^...a. .&.N..g.........b.Z..;#*.Q..E.A...0.6......(..n.^.B.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.6577103081359565
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te1/4Tp8GHHALwK67lctg69t5GfpumrOE9AHPCOjp:6v/787hTp8GHhs1ofkaKvCg
MD5:	4793708E13D5F35D077D337D2BC828C9
SHA1:	AF4C1C9DEF3BDEC2CEB09D584E8894D0ACB31EB0
SHA-256:	56B69129130CB5D53AA5802B28E3A1C07E6BD30E8F3DEAB3A58CDCCA28200C0E
SHA-512:	C3AB9B05ADEBB2AF907AABB1CDFC6261F4718AA0CDE4AFB7D2BECD33599F319ECE2D9A96B07AB47809EC45BDBC459045E1559CFA4B4935365FE652D96CA97131
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C...a..Z.j$V.b@8,.q.\|.'...X..+C.......J.....g......#.....h...X;..{.."8.>.f.....h...g.@g........@.xZ..;3^..I.CE..!...0Q....;..>.L.&.D.....B...K....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.648355460959768
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teAuoQMZn5ifLpRAPuTYG/MMsBjp:6v/7879Zn8FRU6sBN
MD5:	9757407CF3D436E95569926C0B032DBC
SHA1:	CCE29826E6B76452370AE8329AC896D9AAC77139
SHA-256:	A27A903278A7F141FFFD48CB6FD4E344D73EBF469C73A4126CBF8EC624FCD428
SHA-512:	54C57E275F1ECF3659CBD39A0389F2F09A1BF8153DBEF21F09E58931523E0DCF05FADC61016839ADC9B7A35549F858598E38314065E4D206FC4EE12CF388BB06
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D......^=p6.....f#....K...d.V....$H.1\|.'.b.E.?Kx.o.A...Y......!..EyN..l.k.\.....7.pyf.x.8}n.Y`.TX.O..~g...e.@`Q;,...<L..{F..~F.,.&...".<L.M....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.596328044007988
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teVhQokojH7SN2qASyexxajYYG/MJtDjp:6v/787KhSoKz2N
MD5:	C2C5B8637FAAB34A03176F24E5B26C97
SHA1:	AF36F3422D4932500CE6580BF11A204E389DA5A4
SHA-256:	6FB00F738E3F7330A814C9CD43E87A2C15C8FC04EC4A07ECE08A3FE2B1F38F6B
SHA-512:	E9BAEC903E34DCCEE4FDB502DFC4E840710293DB0820ACDCBDA8BD52CC1E76D1ABF723CCDD27179B0D0A0A4D21266249534A563833BAD97F76179C824FC4798B
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ...L....~}.6.....yQ.. .c..w...:....T0.7..\..lO.?Kx.o.#.a].{M...L..!..EyN..l.i.\.....7.pyf.x.8}n.Y`.TX.O..~g...e.@`Q;,...<L..{F..~F...tJ~....".Gq......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	305
Entropy (8bit):	6.6849807210121615
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teJ6d5rnkApji1CL8VbFsN1+jDLjTwLm9lHnTp:6v/7872W/eV4N0jXZHn9
MD5:	1C61E7ED05CD21763539894766EF3BD5
SHA1:	AD0133A573FA2DC58B78423E33688982933E3DF3
SHA-256:	07A4A32F0A78CE815D829329A9CE4B4D017C12C8849754D0A910B676516FA921
SHA-512:	A1957699BB1E2AA411D70BC35528EBF19616E971562812B018548A7FF2CE51C09D576F8064872AF6C6D0E2ED4EE5B07B5C3ECECF30519CE2B47E8B633DC4ADDD
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ...L....~}.6...X..../Y.C.....]6..2.q...I..+...kb...f.?C<..h...NF..l....b..A.X....=..T....k.IX......5.R....@..j....3...!......Yl.5.2~.G6.X4.......S.Y........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.7171483857299155
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teFV5jeb1afTZRbieiyzFFTQr9WaPuHB5LQ/p:6v/7876v41KLb9RpRsPGh5s
MD5:	443A20DAC96A515135F3EDC76E7D38B5
SHA1:	C762F45F8707F7FB9ED63B669170E887412C4642
SHA-256:	CF7D59DF77446CE06998F4684F7DBCEDEADDC69639DFD61AA89C71CA7F52041C
SHA-512:	945D2AEDC3DD1A3F638ECA026C63450E38A41E070C4360861F34F2581FB649ECAAFACBB66DE5B52683B3CE90C8AD70946DF9A558DA16C7B1CFF01E787DEB5D6D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.@0.D...8.....*wp...r2...N..,^Ud..(.j.]9...`....#M.."...n..x.....l{.`...0..p....=....Ov...@[..AF..p8.}..O_..U.i..v..?.{f...F....\|..@.:Lk.......}vA.@..3R_...>..4.>....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	292
Entropy (8bit):	6.6593573653947224
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te7QS1FJnbi39aKL+DAQvYpRfLlwcp7bTLGRnbp:6v/787kJ1F1G39aZDgNBwcpfvm1
MD5:	D473184D11E6851AD8F1691616B106FD
SHA1:	C1F2A10E2BDB3519B95809CC0A3BBAFC6C3878F8
SHA-256:	3E7022871A3571B085FCDEA64A480A338B62A6190BC78366408BCB57E7315DFB
SHA-512:	3FEE40F3983465B80D96F8C898AF457228355F9B82231E637AE172C8703043F6B6C756A37B574351BC30DE6CD98F906BE3681895B7A8F91EDD61970E53D9BA92
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....@.....I..r..9Rz..V....XI..^>.0.b.f-o......h....6....g.?.......kE...3^.s .pD..o..........'.p....n.S...c:.....Da..........s.>......cVA...O......".....X_....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.736485606637028
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te8cgwo6HfTc4mt1fLIej76LSO2dp:6v/787dDwoGT4fLbjexE
MD5:	0B3D98DF05B5781C5AF17C815A8A9C73
SHA1:	ADB4C47021248CE53AA6E3AFA240F8EF76AEB97D
SHA-256:	361C8BF96211F96A3BAACF08D6F81AD984EB8B6193F580E225B7D7BA1ED550C2
SHA-512:	434BA4F3B3E525EA2DE561BCD1DD603534D92CC8A3F350B32868E50BED68A51272F4DF4D25402E7B04C37509BA67A5B9C8E3577FF9FD59C827075B51EF13551F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C.,....H."..'...0YP.}B.H.......i}..p...^.rZ.....SxI....b....t.v...Q.......F.C.X........M.@.;1.....:7..w_S ee...8..6.sf.86k....2P.6,bs.{....b.>gf.......Y%f......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.7917377338960385
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tem/7UdsBaMLyPvLbT8Ob8fdT5numIeV0Wp:6v/787n7Uds3L4vLvbouml00
MD5:	30BBCF7DD4D1163662B59791ECA58AA2
SHA1:	07C5D63C4682FB9D79513A9446441BC70E84BF57
SHA-256:	64764D9E434ED8AFBC3F35FB4EFF4D094D44F33D61CF1EADB3049AE2162FA2C4
SHA-512:	10AE44D3C2A58F9C806D60B70B7F0F0C1C1C4434C719AB78E9AC04BB50DF5626B8EEB96CB1B3CED8719094038C4CF62135EDCDF0454B6923B3830E13ECA406B7
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C...a...r....2A.N.d.B.r..V=<......u\|..3..2../l.Ej.;.......].'....i.T.=..:.........f.$.4...k.IX...3..k....z1....~....'..{.FwbP..X.........bP~I,:$A..8.....&.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.7073640936535694
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tekko78AccZ0sAm8jNA+vfO/mz7O9bBBp:6v/787eomcm95/vfOOz7O9bBv
MD5:	EC32FA6D8EEB4D2F5883D0FB46D672B3
SHA1:	F9EE77835FA24C42D2C45206C27AE313451AB8F2
SHA-256:	45DC5B0580FA465619CBD2C1A571AF001FF46BF4987319DE97283B96457ACC87
SHA-512:	937960EB6B3FD65C721FA9A707B07F08709716EB9E2FF90C489EA5CED8465EE9E69C524BB53AF38D52DDEEB10B957D49181B5837FF9AE393308609EA03AB7784
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.E.....=..!.J..4b.&#.....@..`._,...<...r."(.!.C*\..@...M....C....0.=..=...G.}.~.C;.....p...@....9E. ...V.\|g%..e.....6 `......L.......y.L....</bI.....L....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.789325010460511
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tehmDYd/BxvPe8RRSZkPy8V59cpWbCy3zUjp:6v/787PDYd/BxvPHR0KKwcpcCyz2
MD5:	925002340E09C486777AB7D3AA638BB2
SHA1:	03A0D4D0CCE482076CC2ACFD91108C8BFA4051C6
SHA-256:	D2A24D4DB49327ECC46F54E1BA9C4D12B590F8C244AD5CF8D37ACD27FCF4E919
SHA-512:	96A29B84948416FEFDAEDC53340767BE3A9F6AF1029C05EBC8DBC39B3125B7276AEF143C977003FA6C25ADEBF3DF02528EB9562D74C1B80D12A501461B320E00
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C;...8...g$v........_9.I+..........}..Jy=.)..q. .....0?.?T..v'......{.D.......d'7.K..Fwf..4....s.<}M......Rp\.....r.8.....2C.@.:....S.fWW....rG)..lX.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.686884048906558
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tepkko78Y5rNqJk+Jb9XNgDkXFsnmKEbup:6v/7870opPqFVog5vbc
MD5:	194FD3002DECD84C275CE6588C730A2F
SHA1:	A95A03B0CC1DDA87953DD499E5F18C88DD046DD7
SHA-256:	139F77B68B19EED559B18F63BE39FDD0C2D19D80DD1A5AD9E20B57594DF5F752
SHA-512:	F4AF61EB11853E29A426B01D82A2F0E10C1F33AB7A30847F85701D0586F4B48BA1A1A9F720CA97507A591EF88BC11923C3CF572F97C3CFDDB179DB3087287D3E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.E...a..\9p.........q-...Am.O.6..r..]..I.....sf(j9{'.-<.s#x..z.....g<>.@....i..i....6*.N.......>..)..t(.....Y..~.&0(......2}l......c......O..O...%&......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.8112129891292215
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRhQdmgTCIuHm6CLu0ZxUxXedmfpoLFp:6v/787eh7gGIuHR+FPU8dmeLr
MD5:	AC4F9137928BADB1156099AB89DE33B8
SHA1:	D502F252BE36354A1F1B271B52A892EB5209231C
SHA-256:	F91132A922DE0C5E92A3601197F6FB0A29CEBC472DC9263C81143702F174BC91
SHA-512:	EDF7661C4DE23BB2525BF3FD815072E3130C40D3AF06FB139719C4ADE33191EEF2306AB33F32B64A1264783D6361E8F2DA239D87B753EC263BCD391E887527A0
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C;Y..z..g.........U?r..*.O\|~b...cLy...E....[..k.)...7C<...4xS.NF._k.b^........;;.....Fwb`.4..u.r.<}M...A+&P...@.q.8.z.jt&....u`..{.........u..H..)......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.596315527790689
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te1kkojHI7Y4bGQMrbVYG/MswRup:6v/787go03bGJic
MD5:	3CA0EEF57BC0D564FF4062DC6BA3B00C
SHA1:	4FDA9AA7BF5A588551DB4C9779CE70EDBBA13ADB
SHA-256:	4DB5A5AD7039BCA48FD1A2A3C0CB683AC8AAE68E237C9C9F3726C91F4DA5EAD2
SHA-512:	97419A329DA78D57970C35DF9F0F1E69E20FF553A34F38C20926ABDEA4AF90280FB16BB46558C70E1CA54EB0DDE3B67C79FD74D1A40BD755ECBF2B8CA654E315
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ...L....~}.6......"..A..$..9.}.n.x.`._....K.......JGp..Y.....p.!..EyN..l.k.\.....7.pyf.x.8}n.Y`.TX.O..~g...e.@`Q;,...<L..{F..~F.,.&...N.B........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.580532697018084
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teAuoQqNGr3wvU7FlPx3M9ee/ibW4BwIZdp:6v/787mr3wvURcA7UQz
MD5:	5A0BDA461F410D92BA388DA1AA0D9B84
SHA1:	94E651835CC87F197425986576C9AF8607C698F5
SHA-256:	CECB48049055C18017D6ED0C534F57AD9809744E76120270A6C9BD79D279FC69
SHA-512:	D751B2877295B50017DDD43E394DD5A110846EB441D4CBA527C0D4BB2E55CB8200984D78D9341E4DD8977F38B9552760F03740438825777E328ED9E90C97577C
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D......^9p6.....f#....K...d.......%..b..3S.."..%<.. Xa}.Y.......!..E}N..l.k.\.....n.......p..".....X...........vX ..y.Z....'..6E.M.....B.q......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	289
Entropy (8bit):	6.614276182489926
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teZV8MLexez+o/bv03si36Ha9QnqfSkhdGp:6v/787GZMezV/bvod3AkbLk
MD5:	C4A4BA2D90824DEFA4F239D71D0CF398
SHA1:	63CFA32335E7E64D2D55494C090B8965BC06C251
SHA-256:	310E5DAC86EDAED26D3637E9A5D02438CCC0DACD8A90298FAB437C29D0EB7EF8
SHA-512:	945FF3C051B22EFABD844FD2F379601ABC29DCBFD5DEC095BCE97B85F0FB82255A4C3E5869C3D7E04AE9079B1D1D83D4B87DE833D884F747E0E6B5842E6AC427
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D......^9p6.....f...B..^..<'K....}.FLY..c\|B...^.......xV:.....u.).0...6...(.Ip.m^...a.!.&.........-......jA...Xa..5.X...$.0.Sk......F..~...E./.qx.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\48.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.533791415580225
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lQkx8DVlZDUldp:6v/lhPAkRTp
MD5:	E7D31AC53D124242B574C8090362FFC6
SHA1:	39BB8F5AD0330977037D5C25C53B2E66B1CEC898
SHA-256:	A901AFAE7BDB66678F08A39B32F8A46DA9864C8A64FABC0E77A7F12B93DF12BA
SHA-512:	96D66670CC0D53E5B937B6136A69BACE772DB75D76A7DEC8102F47E3DCA2E739AF5E82A01696BA6288CAD3B001CCCEE82CD2D285320D190B870175EC3D4956AA
Malicious:	false
Preview:	.PNG........IHDR................a....IDATx.c`...`...........E.,....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.67987346119644
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te7/DBi6rO/vpyd+4Xzglu62ThYtoyup:6v/787c1i6C5w7XklCyc
MD5:	B948F3AA121723D801286910094F9A96
SHA1:	C1406530072ABBC25729F07BE0999578C3007085
SHA-256:	F2B59A6861B8333AA2C01ED6B8DACB7ABED529E98F1D0A2291863A5F10B6F655
SHA-512:	1876DE57F3B80473F89320C3A163B548819E3E09BDCFDEC5FC72EAB3A7D8AA504314A027173FF3CB201CA1B78FC8783A4265B62BD73F19ABE870C5940ACE1813
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.D...a..Z.j$v`...d2r2...D..I&._..jh.............H...k[..f...m..3..m...n..b.....{.y.<f.....@[....@;..4.a.<}.bT...b{.S..@...0.\I....X.im....>..)......4.....T.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.747638141584877
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tesxzxxo4Iqu27+W+RpLp39EvSS4z3TqyU02p:6v/787NxzXlvF+3Rr90Q3Tqb/
MD5:	267C8D08A9CFA55F4381AA51DC45589F
SHA1:	8142F1670D8B8921D8FFCD8C933E2941C3DD0A69
SHA-256:	B4EF6E17EB6DFD6174A6073246E93088E36F3620E3EE14CABE16565EAFB85F1C
SHA-512:	B6A9E378935AD47D3475F464D8844FBECD3137CFB2D204131E611EC7E8D21BC52D0F569A0C2EEC9D5EEEFB39CADCB4E58CFA8AAF51B464D49D657C6CD71D93FA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C.........F..........'.8.Q<......i.S. .....n.O.<a.\|.v..x3.#......d...*.5..xU..;t.0`g...%A...X.M.b]...w_S eaP...8..o...8q.vy.j....@.....S.fWW`..K..a...F....._.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.651143788829082
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tem/So5c5NZzsusVwXbr9Z2RV4VOn6agp:6v/787nS95NjsiH2Vyaq
MD5:	8C328CC0FD5464733160075D9440AC26
SHA1:	865DB18FA717E6AFF9400A076E57AAC37DE3301C
SHA-256:	55F4432DBC04C48F61CD789EA6107965136ADD89A8A0D505FC80D2565DDC20D6
SHA-512:	85B85452F3FCE83ADCEDD3F507A8081A4834A2B7C72FC495F2A12AB13005142A2D27D621975D928B8A28E736E6EBD1A890E205422005763CFD949882D0B30BE1
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.D.......).....2....\|...!(..1.b.h\|.6...!. &...D..%........`..rg]......cM..kC.a..N..lS.......a.".N0..^....].,..TX.G{..;.sF..n....zX ..y..6.....1.....s.;...6r]4.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.6955756678700915
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRhQqrntGgu7orEgHrRV+Y1EsFHjTUtTp:6v/787ehDrntG/sEgdV+Y13FDU9
MD5:	3928FB8C7B602552DEAEFF75343DB252
SHA1:	4060679F372B46F330694287F77978E7E103F6FF
SHA-256:	29759A2281141D8D70A8EC24905A2E3A3CF672B2BDA69DECFB7344059D0B7CA0
SHA-512:	70936067CE557359769138AF54FBB5EB8D5EC8C5EA7F98C01DBF26AE67462C9659153713C79195D144572A941B483E1A8B4703A7B70B7D7034A8ABC493DC654F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E.L.q..^=x6q.'.8...Q?.B..K...M...(..V..)......faHj....G.6*.....V+.8.{.r....=.}.<f.O3...R.p'.N.......].,..4XlO..~g...e..rX!..y..6.....}L ..J~......6HN.0....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	286
Entropy (8bit):	6.668684417137536
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teQ/8MLe7yVK1fvs5CkIVCj9+FefwIup:6v/7879DOpH46ogrh
MD5:	2884EF8DE1F0EBED25D84F93151DA2DE
SHA1:	7B3AF5B237CECF411E107739F66E5219087F03B8
SHA-256:	3D4727A55BFE24CC8315B6D657062459EF8319E6F501A2C911C2BACB80A8850B
SHA-512:	C0AFF74E108F34028684D852C1EC4841B76612580E622D6ECB02C326BBE66646B7829465371BD938EA92D329D9AF3864FF1FA47EDAEAC3459B136F4AC9DF2CAA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D......^9p6.....f.........9Yb.]L..W. /..........,............p...X...[..$8.6.f.....p...g..g......vM..z. .{F..~...,j...p....q.h...h..?.sL...........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\purple\glass_purple.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.9361804341297555
Encrypted:	false
SSDEEP:	3:a5I7kRo42M:aWARv2M
MD5:	DAF5365AA98605CCCE532E21200D2F2B
SHA1:	7A26D00FCAF872499EA15382C9C9A8474CE447D2
SHA-256:	FE4769C8607BAF4419B7ACC2D63D84875FEB3A9AEDE2104D776A12DAA8B66F5E
SHA-512:	39A628362CBEE94DFB57389AAE761962CF17B2E9593FAB08550A4658D214DFCCC7A47A7FA2AFDF4F304CF6F5CD7D75BDCEE76C7493DE28CCE8C595C3141167A6
Malicious:	false
Preview:	tiles=1-48..metadata:10

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	303
Entropy (8bit):	6.72802760368377
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teRkoYhQLBAtUW918VE2VfPH2/g7+rQoaGfyJp:6v/78MJ4hME2yWv8KKfe/geQmfyH
MD5:	21CE104344EDB8EA022D0AC019B6B319
SHA1:	169E643BFEF853DCA19188C53ACFEDA6CE184CAE
SHA-256:	7625469A5C618C40F3C5B5846AA3B56599323C1475BC2F5DDDB55D748D01A15E
SHA-512:	26516937B9B807A81B9388A32F0B7844F757D053E62A4ABF27DD1C24B23AC94298FFEECE1E026994F8684750F4AB0EBC5C0576D69C89E339DA8732731FD7C04B
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0...;1......7+0A'.W..n.q.$...2.)...p..0.b....H...p1.+..]...ng..,..6N..s`....,vh.2`g..A.A..;1.....5.9...v..+.^.@..h...3..Ys..h$....u`.6.W...s........\|...#zB........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.624594024001581
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tepx5NhtG9RDLZYnh3wJShxMg3kup:6v/78MJKObenhgJSPT1
MD5:	6A91DFE33746282AFDB09E06892D82B8
SHA1:	A167D5C39A346D779C0C31E38B7CF4DE302C7A92
SHA-256:	3CB332DD10B19AACEE3B5B7A093D132D989E466F5A3E6FA356FBF42063767291
SHA-512:	DB275E0E2B1BBE99CAEA57FA99775A728220326B8ED591DC44DF1509EC31D57C50A9BA8C6BB669B6B50736D6A2282A5C4EBCD47C82681FA16FE908395CA207DB
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....A...0..?..(8........."...OX.3.Iv$..%...2..........gK.a.j......p.&,......%.........f..z.(.{F.......u...8....f5(.5.......S.i..sS.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.6081771517905015
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te1QdZzlXOlXdrJYDD4kH83R9o94Xbp:6v/78MJBadrWDD5c3bo94l
MD5:	52FFA0EF6D0D5026C1375C372DFBAB1B
SHA1:	95CF26B725D568472D81256E76752DC59A707DA6
SHA-256:	E37651B82408CDD7443EABBAE0549214180979A76ECF96845A6CDC8A671325A6
SHA-512:	A529DB0E691EDD5477E69100C6CE904C82E66031CBA25E86712F00B5C2620D6974EBE1CF69C666464937117255DE95E8B218DEEA670F5DBD43C2F61B9508A87E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....A... ..?.. 8..2...?.*8..B.YpO.#..,.....`.uss...8.g......9.....p.&,......%.....E`.Y3.b}Z..;#VX/.....a....ajm..d..M..;.^..iS[.6.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.601669339862769
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te1QRSzGT5sEs0pOIBEFM+drjkup:6v/78MJ4uUM8r5
MD5:	CACF381CB48F20AC90B7B7F4533AA56A
SHA1:	A75AAB551A311C096560729D4363BFDF7073054E
SHA-256:	57BBC6981D83FA8B6C948CFD4A20B490D7112209C19904CBE799F9B61E460567
SHA-512:	B8C38DECF0ADE0EF98D4A04E6EE885DF5F604DD2F632ECEB5FD1685946A1EBEF8C1C1165F328B61E4A96A6A3CE5FA3244613EA0173996C3DA83833D20CEF238F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..{...6....A...0.......1Y.5........`.;..,....+.......8.g.\.....9.N...p.&,x.n.......p.."....a.>-....+..q..EnX`..y.Z.....~F."H..FH;.iS..;....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.741860932593962
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tefhdz1Xx6NuArx+0oZo8L8Vh/IjZF2Xjp:6v/78MJgX1B6AArx+0oZYzgjZ09
MD5:	7EB75B35055352078C7ECA0F6A00ECDA
SHA1:	D59B12188D6EB824317FD4E9E446DC91F0C8F2C7
SHA-256:	620B6687F8AAE47668A72EB09AA60DA319F3CA0F668952CF02EF76C1B0A59044
SHA-512:	58BEB30EEF60ED192840D695E1D41A0126DDEDB3D7F59B0C785428BB37AE0A6E2744D5C3A7395FB17F8B7A8A37F7B568BE2BCFEF857ABB3E5B2BB8A4FEB2E44E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....z...6....m...L..e9....w..G..."....$.`1~`y..v..x3.3..M........m.T1..J.S.X....=..T....k.IX......5.R....@...f.....'....F=1(.T....\k^el.G6H{.......e.v..>s.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.742582656779878
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teFVQBYm5IDRWKe6Oi/gUA8Mho4bjHOnNTfTp:6v/78MJ6Tm5INTe69/xHiPWf9
MD5:	0AA96BD5AF6EF303E728AFCDC809FB15
SHA1:	A7956D57180285C4490992BF89351238B7359A8E
SHA-256:	98CD25363B8D6D8864D05DA30AAD8F6E3FA81C74F02A563BC87F073AAC033B7A
SHA-512:	5D16FB94BACE15434B823FA4CBAE627EF82891C5D0754F0D3C5FB802002151F09A68C6880B17F28B27B6766499E1E7F63588C7A89581604D889DA33329B7E26A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E..wb.......]...L>...-.xxI..Q....)s.{...........kk..%..(....,..N..n...I-...-..\....6W..@....W1.....~....]L*p.PqyZ..?.wf..r..,..j1P...0K..u`.3.. !.G.'..q.h6z.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	292
Entropy (8bit):	6.6449319236047595
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te7kkoj1hocKRlCC2cUCkC+53Cul4y5u6CQdrA5p:6v/78MJktoRh7UlCC2cUxC+xCq4HQV8
MD5:	BB6DBD07E5F98DB17F32481B26AA20BA
SHA1:	357AD9E75B1569CB19E2D30641F80EACF9A0C19C
SHA-256:	A042FBB5407AA74D306B24AEFD00F3ADCE823E24ABD3F9C9DA938F4F77C4881A
SHA-512:	751DBB1F5B7F99FB99D0387D3ACE97DD2E98F55C1BB6F55F1EFC27E63BBA43715004E4EC60730ECF3B7B27874E4262A5B479DB3845F89C6DA591361CD20F0482
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....z...6....m...L..Y.;.>&Ap.....ra........},.7..{....g...]..fX?nn{...x&L.Z.`X.v..l.i.\...,.7...L...p..".@..`q}Z..;#Z.^.....a....a...58.gT......[.ml...y....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	299
Entropy (8bit):	6.719723048739854
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teFQm/svXwdBWZnNctZBn3ydd2YENdk31tl3igz/2up:6v/78MJm/8YKnNcrx3UnyCD9igr2c
MD5:	502ADEFA0C725E0AD70375C5090BF789
SHA1:	524E31D87FA1C6DF32942C00EB63AEF457F628A2
SHA-256:	3078543E65DBCD41013F9670152200CAC48226C34A51A332CCECC0B01F20B41D
SHA-512:	1F1268A24B8FA43A0704962714ADEC1BBE6F7E7182D90701234C4D3F76286F1EA651D85F41150773192600098123BA9FE7FA3E04F2E0BA34FB7601D078CB98E3
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C.....=t...8.3+0A&k,..c..qx".\|;.O.5.\.....<\|.q*.;\|./..=.n..M.A.`..;.5\|...y...........fpI.ht'..@..X.....)..2h..j.W{..=3N..]....2P..,bs.......a.5....q..)d....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.741013836847795
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tevdzxlMbBH8PwKdq6cQvd6WYBQhwCp:6v/78MJW2Bchdq06FQ5
MD5:	7AE07B323032C48D206C61A63B72E062
SHA1:	3086D8299FE919465EF5E9B35BD92230AA15B4E9
SHA-256:	D47F031E0D6688FAADE2A621E87D5EDC9EA8A670AC4C18A4F4ABCA57803EE1D6
SHA-512:	96F1C7C8AC9F586925250148F1EF176FC8DE62D492A0A7A84F9695682EFD10005E8235F7E6BD45B8534FB5B2F83B968C1D63A4B0382EAD44C20376A47187367B
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ...Iz...6....m...L.xdY.c\|L..;....B..~......>0'F..M./#<.s.M...q.W........[{..{Tu..s...........@;.pU.2...v1..m.F..jM..@....0.XQE.0P..u..m..:0..]L...x`...C....rCg.>E....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.750646766963719
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tem/pfy5IqqHjMdq/eGWXbgxvekcCsup:6v/78MJn1y0HYAv2g17c0
MD5:	EF6EF2652473B62EAA88F1670051868E
SHA1:	574E43661B964B791A52ADC4B383E29898812DCC
SHA-256:	338D0C59135E3205DA8007DDA9C3C27423C6367B03764352CF56E3B4B6CF0A02
SHA-512:	FF7A0DB0F8F4D336A47F8690D696529EEB2A75B27CC98BD1A8361ABE405A41BFFC8C1C45136225E9B42A4ADDBFBAFBBF40712846358069E5C3F31B7A5475300A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ..U..I.(p..5.P.i....\..t`.......yX.u-..........K...x3..Z.C....d.....8(.j.b..;.vv...:..u'..@;a.....]...`.&P....3..q.....L.:.....m...26..R.....dA....rC9.5.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.676904175931719
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te9Qoko7eK5i9ort1M5X4I4DxBWT2io08TOZK6Vp:6v/78MJsQ5oa8ty5X4n2o0MPg
MD5:	7E69DB6BB012032E97CFEB192E9AF926
SHA1:	4038C6BB1A00124D8EBC022D46060D9F02203DFB
SHA-256:	556A33E97668276B712657DD3CF5AA3D68B825FA8E83A7E447848705DE25B94F
SHA-512:	AFA6920B93C8111E980B8EEDA1128D02764E68DD6A662B45BCE93D8087352EB09BB34BDB9D0C67F01B25422FF5C9EDEB1EEA661DBAEF5E864928CBED67659CF9
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.E;...z`..H..sW..L....y...`._,...........r....e.......v....O7..T....i;G..G.....v..Oa#.p...z..;..s...p....iU.wV.._.....A..\....h..>c...ai..@.,_.n;........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.768718817582057
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tefWko1ximehDRQaOUXNydidnENg2GwblBup:6v/78MJgWh1/ARfBXNyACJjblBc
MD5:	09EF92523653DC8347ACC8CA3B77E960
SHA1:	16F68BA0DD092885D9C6167C4EF5BDEA014FC2B6
SHA-256:	A68CEF539D3645405748F4B17572576A68D9A45777F938A8E7FD9445200D4160
SHA-512:	9E8B4965BDA0F20B69E8E558569366577F4C975E45E6019E592A63D081C802E56B36B2B2BA5922B6032A0CB814A8EAEDC49F5D2037A9C3EAD64550C9A7AEADFB
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ...Iz...6....m...L.xdY..c....<t8C....:.} B...51..1.SO.7#..u.'.i.y.W.x7.j.k`..'.GUWA17h.@_.h.0h....W.?3..k....6_T........./....+....*..3..{^.......wf0`F.!>e.vKhA66....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.676768644204384
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te9QHoJTap44OGDov01AlWR8zaV9E47Rojp:6v/78MJsQIJiEGDov0uloIWfoN
MD5:	A7997E3607699C27E6785367A35B3E69
SHA1:	09DCFB921BFC93E34710FA79BB157AFF50159570
SHA-256:	679B00E157945BB8CBF46F7657BD40C90D2058CA07C1729A5BE10FD74DA8DEA0
SHA-512:	DABF1BC9825BABA19CA223E7B3D71853F728EE658CF39EE8F38510D1285C3DC9483FA2331B50605032EC9B589227B2DBA7936543DF12078F6138B019F4EC545A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C........j$J.Y.....t.1..A.Dr...........SJ+.0xB..Jm.3....h.......Q......@O.Y.X...........Fwb`.4..u.o.....)3.RL..q....3..q......d.*.El...26..r.\|.....dn..'.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.530612058207283
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teVhQMdb5pnUiQ5eVq5QDGIDoWYHgjp:6v/78MJKhzDUiQ5e3jbKgN
MD5:	206D9AD85C82B4C7CE7CADF1BFF7C63D
SHA1:	F59E8C912E9821EBCD9CCA0AFFE0487B28E207E5
SHA-256:	C562AA39406E2B2B99574AE33BDB1D41F06001702DDAFC3750EDDB50345631E0
SHA-512:	9632F2F00A43B86A497E9EA2C689BCB2BE00A6A11426F860F83B832A9EEEBE8208C129EF3CD549B917AB93B9743C65195B50522C8A262E7EFAD38846CBA5FDED
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....A...0.K..^..<&..0. .......{....g..........+.0..kY[..[T.,....f.........3K.3..s...f....iQ..Xa....,r...8....g5(.3..A..7B:..<i.p......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.554383547423899
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teAkoj5FQ585sKIkalcZWBw7YX8Iunf8o3dp:6v/78MJKo1FQ585sJw8X8Iunf5j
MD5:	A27F616E1CC9FBED45B382F3BC24671D
SHA1:	3CF9018483D45CDFFF136D47242489181485D738
SHA-256:	4E2A70A9BC984A9D80586B5BBFA4BADC97389FBDE451B7A03A776ED89F6C38A2
SHA-512:	11AF4ECF66014A096C38C46A093B5D859BF3A32D41802494488BE06BBAC74990D651CD01464FCB75889CBD059CA84DB2D1F180C026B1957A10C0A7228DDC73D6
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....z...6....A.r...DyL....c.....H..{.....'..........uws...8.g.Y.....9..y...p..,......&......g.Z3....(.wF.p....,....p...j....R....A]i..n.(....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.573784163636317
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teAkoj5FQ585sKIkalcZWBw7YX8IuATp:6v/78MJKo1FQ585sJw8X8IuC
MD5:	5177498BA09CBEED15DC975671B0584C
SHA1:	69396512077C20696B4FC2E16C316C6C9B94BEB1
SHA-256:	88067487C5BC79A536A42AACFA1CE456B129BFB6BF334483A95C6F7EB324210B
SHA-512:	307815ED525807B9CEE9F4C43ADB96F6E78493AD3CA23129401AE7C383B3C3A84C8A4B0BEAAE7E60EB3D8836C90ECBFD2B6301DB45C513C781D4CFC4DD2EC66B
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....z...6....A.r...DyL....c.....H..{.....'..........uws...8.g.Y.....9..y...p..,......&......g.Z3....(.wF.p....,....p...j....R.....A.iS*.>.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.618104416165609
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teVhQIg0OhpK6YDVLbWsW8MXcA4pup:6v/78MJKhZ7C+8ypc
MD5:	F697FEF88C18F4DC5A2AEA618DFB7CEC
SHA1:	3152643CB65183ADF8B98B6FADFD2429339F07CB
SHA-256:	04071B4B1E4D51527739C89CFC23D38059B01F4A900418F4EE76FAA70555B5C4
SHA-512:	579C96EB7FFE9BF656F575032CBE3DDC242532FE753DB4F006C21DEA22032CFFD45BDAB16E98D19D8560360FDD4FE0DEE47F75BD1E4249233E3A61C70DA371AA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....a...0..=.D.yL.8.........'..kw..X...+W......ZW.a....l.0lQ..4wx5.......`...<..>..,0kfX.W...g...a.@`Q7,...<L..kV.._.I....]8.*6iSm1......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.7177689719448885
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tem/sBI3t/8T6v15q4LTxlq4IhC7OVp:6v/78MJnsBZmE6Tm4iCa7
MD5:	60ECC327121532B6ED2C2039714839EE
SHA1:	6E47C904831AFDD04FB18E122B66E684BC48F54C
SHA-256:	DDBE7DBE51FACA536D5F40D48635F26CF0E5E7672AD7D1A8FEB2B60411C9E99D
SHA-512:	591BFE70718DAB834ED2CAC34380E11416E9FAA918CCB7662EE957E5621821F8CC8EB52D5BCADA0FC8C738CEA523C1436D90FDE661A90449617CDE0BD97B9B32
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C..vr.......Y...LJ.I..M.."\|hi>.m1.k.........)3Hm.2....47......Q...kb....L..,.....=..........@..X.^{....HY..b.5..-.x.z.'..n.I...2P.6.bs....Yk.........r!..@'....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.648556156080204
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te9Qiy2nO2Bu/9z/3MpfQzMp:6v/78MJsQH2JU/lkQz+
MD5:	BDE5E32B6C625119EECD95303FAA5DF2
SHA1:	0E50E92B2A921AF8935543572C301EB1719297BE
SHA-256:	C95A25D01C35BBA5BD275A84CEDA151C2B26E24FDFE9D0FFC8D4F8B4A8669642
SHA-512:	632C1886E15C119CE19DB42A3EFBFAD10FEAF57192DBB2F83BFB5CA68DA9E76E2FC6CB84A23ECBB4CCC1837748D72B762F1F33691B9DD716AD52CA56E227F7C6
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.@0.E.....X....K...NF:M..K0,.....)....B.........'.>,....w.../;."X. p.k.....U......_A../a..p'..jof.......mfX..V....9#V8m..-....,.0.3..kV......~..!..mlZ~G.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	278
Entropy (8bit):	6.626615408876029
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teuN5TwTF8ppz+0ZM+L/FTNkup:6v/78MJFZGFwz+09zFTN1
MD5:	F9D3C5F0D5029AF9EB7470630F85BB25
SHA1:	86905DA2C6EA7DCFF99743AB456356CAC50CCBE9
SHA-256:	D71BE58BC4D8C6C1E35031F9205228E46691E16FA7B51D84DA8D9DC80F4161EA
SHA-512:	6681B2246F5B06CE92F0474F34FDC9CF2B9572C6CACE2C121BE525CF92AF7E4F8EB65463CDAD48C01D48B437DE7509E6D762B1D9ADD2B4AC48CC955CD16180F5
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6...v...2..~./Ap..e.BH.P............'.V..+....+.0..KY[..[4.,.f.W3..]X......%.........f....(.wF..^.....a....ajm.....M..;!...h...J`....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.726800162830053
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tephm/svykaQJUp5jDXjan/zLF9/woZXOCnLL5Tp:6v/78MJ9/8LJUzDj8N9/jOyn
MD5:	C4E693958D6B7CA2EA82327F42A32134
SHA1:	D839A4FE33DF8F6B3214F5EC4212C697BC531ACB
SHA-256:	F43EC9C23C0D5069CF996353307E05F4E410D78F0721F17BF5D1C5980FEBD4DF
SHA-512:	EF7B3A7959282AA44F1FCE13052CC99C1506ACEC8D5289EDC22F0A7B4AF3FD3011DDE34A06759D6BF5FFDB5E6D3B8795369A81B9FEF749B7275413A796B7A7F0
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.C.....=t..H=.3+0A&kL...8.....'v....q.....R..\xHo.2...?.?....v'...5P1....M.X......n.M.@.;1......s.<}M...A/&P...@.q.8.y.jt%....u`..{....\|...?..ml.,\.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.714693028253813
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teRhQfrn9KkEj6LEPLSk1UlEW/j//jp:6v/78MJehqrnW+YPeaUlEoN
MD5:	2B392B2F777C155A3255E6CE71C3F756
SHA1:	10A888AB9A67065B327B43626896889539151CC9
SHA-256:	ED0452C7EB9DF43F8733DFBDF7C58EC305F86A18C5AEF0EA70BB0D5FE98FE7A3
SHA-512:	CABD13C40010D2C116EB6A66C2C6602F6D0490A64C31FBE0912FFC9B2F3D9192D023B3B5E425BB26B505682FFB2BEFBCAC8F5768969834D78E1319E5D13ED1A6
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.@0.E.....X.....+8....#..S../..)....B....v._0.t.....F....`..b.k...T........p.#...6W..@_.h.E.............A.n..NGk.\|.z..N........4..Lm.....b...s....m..fUl....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.7044405020512485
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teM/DzmJDBawMT5ubs5xiAiq68gMAnm7EY7Okup:6v/78MJxDSJFB5s5kE3EITc
MD5:	5E5EA4B0C5B79BD72524C952DF4FBAE2
SHA1:	9B08A2D31C62ED2F1BAF5B0F90D95675577E1402
SHA-256:	49BDEF1A3180B587F849D12FA81D8F471EA090908CABC7BE8E134FCF51A976C4
SHA-512:	C47E3C5C30E2E04AB870958DD5851F657A0D590E5E63781BE1B6F8E1BE1F3C122FA287491EE3D8ED1B8E6B5AE99A9209613547DA85B9BD73BFFF14F6F180DB00
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E.Ivr.......]....A.....K*..M.a.1.;.5........B..\.lK.?kx.o.%..~.\....2..'...m......p.R.p'...y...N..H,p.,....\|......E.....0.m\.:8.kt1...........7rT........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	292
Entropy (8bit):	6.62921243570824
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te7kkojljNoeWjfK2seBTC+53Cs9TunaDiHjp:6v/78MJktoBjNHWj0eBTC+xCsRdDg
MD5:	D79AA4161808C85C42359B859E7E5A73
SHA1:	546E3C50D60483052C46FF0FCE47ABF1830B5F0F
SHA-256:	6A373D4FDF12DEF19114EFC275097B751C88119B5D2E9096AA21D43D20A688D1
SHA-512:	C9C5D9FB9CC92C7525CE2DE3379753E967477167FBE734179BC9F3222CD8C80C5E9703D64ED90866F53E3B77D2030FFCE3487E75348592BF0F04F2875ACA6EA5
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....z...6....m...L..Y.;.>&Ap....R............o....$.........,.~.\.L...L..Z.`X.v..l.i.\...,.7...L...p..".@.YaqyZ..;#Z.\.....a....a...5h.3.\.....[.m.j.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.680642224044466
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te7VjuuBQ9MVpcIgwUwtpOm5ueejp:6v/78MJuVjuu6kcIqwtpOwuhN
MD5:	F660E13B9CD2FB7C3B39655844A54A47
SHA1:	FA59FD378A98413BBECBC9B390A3D81FF32000BE
SHA-256:	D21C058A88695B51DBC93D45CF48D4FB977717BFE7D6559F1F541593AAFC26BA
SHA-512:	0F4C26D0AB311D30F89CD35ABA8336E794E1C932DE7F8423B76C3FB97CE731B493AD8E7EFF970D7B46AB632918F90156F833F634525B800DFC820FF6C5640C35
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E..vb.......]...LJ(.\|..=.D..Q.v....\....Hx...q.I..Kx...`....y..6(...0.%..EUgA17h._A../a.%.N0\......].,0..8....;.sF.p...ZdQ3,...<..6.Y.(\|.&*..;.....m...eY....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.7092993225996915
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tepkuoh1nSNPfqdmzbawCRzYoSV9Sy5qt2up:6v/78MJx1SdfqIXatkV9B8t7
MD5:	C434D0DF1F98BD2C3E9AC3BC86A7ACB2
SHA1:	D72A99EB8431821565BFC4B4803E259D36C80EDE
SHA-256:	579BCE1D4682A220EA403426EB58DD35BDCD402CEB03E5CAA412273D3465C839
SHA-512:	C357BB5C5FE789D7736F5B14482F57FA3907493662E1ED707AB0CFCE9CD9A0E7EA98CB7EF451D9CC23436C14E890678C0784FF38BBCE0E099C7E80AE2DCA336E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....m...L........,.yl.s8...8..=!...).o....$;..e./.......e.+.0..k.5..5..,...>.[o.BO..`.q..x.8}..@m.....(..F.p~.;.X...,.0.3..{Z...F.*.R..N.nEm..%.R....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.629114247260116
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te3QRSzmLT5ps0RXbveiS6mdup:6v/78MJYAvz
MD5:	73A7DBDB3280D4A90FA47F79F53BD6FC
SHA1:	E980AC1E31875E0091A2F24C1E77A2CB08634647
SHA-256:	341549F4A1414921F64C4714C52092B85633E975FD14DEDD675013FA2A3D3F0D
SHA-512:	335F615ACC1837BDF84127080C4880D747E51D7255F45CB9ADE321B28FBCD0A7731FBDA049ED641116C61988C9ABE4BA4EE931A5454CC53139954A68F49243DB
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..{...6....a... .......1Y.5...*.....d.;..,....+.......8.g......9.......z..<.7.puf.x.8}n.Y`.L.X.........."7,...<L..{V..?.I.\|'...(i.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.615499604153158
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te1Qflrz1BxEwgziS6mTjp:6v/78MJDl7xEjp
MD5:	AA76D16835E61FF3DDC6BCE7EEEF11F2
SHA1:	D6C5C1692D0B6F8B62E9632F7D8D972BA6B1ACC8
SHA-256:	D03F1C555C486EBD253F6EBC858ED786CF2CE4D23B7677E2E32EA2F799437BDD
SHA-512:	18DA064CC9DE3378C7D303B2EEB531AD114258D789FB9D0AED3707D3A8B9075CDF74BDDB9EA7377B165AE1811DB61579F85B541587D76FC3383CBF4A8351174C
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..{...6....a...0.......1Y.%.....}..t0.........`.uss.s...3a*kK.a.........z..<.7.puf.x.8}n.X`..X.........."7,...<L..{V..?.I.l..F.;.pi.o..a....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.535174291958843
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te1kuoNesz+smdzw0xAgxGE9fJvsbeup:6v/78MJJnKVwEAEGE7vs/
MD5:	589FF122929B6D55A9476CDCB7B575AF
SHA1:	CFC3C97381560C27CC3897E07A898F61A68548CD
SHA-256:	4A07CCE22D5257133448B9D1D3E465C00801DC6D0BDAA11EA00C864CE2F7678E
SHA-512:	78BD91EE554DE92524BF235A5C041EFDE69690DC098101CEA7EC1C5BA8C73C569AB823362089481FD5E1EDD8F77F154196F4301D3424DBD14916EA9BF3F30681
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....A....0,~8...yL..4&D.,"p.._........7.N<..Xw7...x&.e..0.........W...H.M0.i...N.[x..53,NO..~gD......aX`..y..6.i....*U0..7..iS.x.8....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.635405263657077
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te0N17hX754mEMhHQtR9oXu3jp:6v/78MJrFR54zMhwtbo+
MD5:	F0515B6042C3ABCF63079914C7AE9FA8
SHA1:	DDB404D10364004BC651F220E0822B6C7A9BE2EA
SHA-256:	1DA88DE5910F38A7EABC5A1C7CCC69B255597F4D31DDE748C786FB5D014A2DA5
SHA-512:	C91BE2CA19A98D6474E4771EEF052B26CF45100CE55DBA9EA26E646329D30DE1BBE1DF850B4021A12E5ECC2FEE46361A39B3633569A315E1B3FCE9AFDAC56F3A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....A...0..?.. 8..2...$...?!^.'........H....9.u...3a-kK.a.......p.&,......%.....Ed.Y3.b}Z..;#VX/.....a....ajm.....M. .......iS..=%....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.708006348966819
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tem/pLjDYJxvpbps5R7DbFT8xh8voFEgp:6v/78MJnpnDY/vp+5Fvp8H8voFJ
MD5:	7918CEEB1E9D4C3CBDBE18A72FA97702
SHA1:	76DB36338DB113A9E05B6E70CBBC9CA6034B8E00
SHA-256:	01B73190B44F1AAC1C93E2C0B754110C11E832219D5737EEA79D82E669BBDDE2
SHA-512:	5B9724503D313B9162306F9D1381ED97ADA98D9347F185CADB36A0788D0C3BD4BCD60B440A6141D9F96BE1BCE4ACC0C3CBFD78374C4953AB55916CC5C202E503
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.@0.E.I.....`-.d..N..o:.}S..%.._.T......~.C.'.........2..=g..3.o'..S.Q.h.k`..'.....\.:.......&.N8\|.}..O_..U.YPq.Z..?.{f.p>..VTQ5.T.a.fn......F....$..0#.....v.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.672425287445778
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tem/pLjDYJxv9J8iCZRt9rReLjd6WdktBQhqNBtjp:6v/78MJnpnDY/v9JNE38Lh6w+QMNLN
MD5:	4FB22B8BF2E47A45A40FEAF86013C79C
SHA1:	5BEF0425A9FC02465288884DCF24B24D1682063D
SHA-256:	D1388E358E9A930C4D3FD4543709F5E61FF5CE9AEC1FBF6E3FBCDF12174C4A16
SHA-512:	982D5795C1CE4416A944DB1B6DE1E7BFB4F00CE126023979B4CE8F2DA3A4F60F81BF5B4821D98253D807D2B91B93D01477AF65A736F921C4D2C1160762EC2BD1
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.@0.E.I.....`-.d..N..o:.}S..%.._.T...........>0&z.{.......y....\.N.F..a..........Ns.......~...@;...e.<}.bT..fA..jM..@....0.XQE.0P..u..m..:0..]L...x`...C<.fqq.Y;o%....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	291
Entropy (8bit):	6.7230655645805095
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3textM2QQeJbzcPSIrL3qCE9clUHXI7WNp:6v/78MJk62/eN+SIrLriISj
MD5:	8967435199C9041156439A8B9B9ED631
SHA1:	5A73158DE7FC1A3ECC4ED9FA3F6AC67681F874E8
SHA-256:	159A2D92F62F3E080C28B77EFABE317E67C8EADC2368511C8A5BFC876290B9AB
SHA-512:	60CB71EE131CB69AF74A1676039278659FB0982C1B1BAD95343736A091A4C9AEF476D59C3CCBD02D66EBE932AAEA7C4BFB29D7DC008FF33D1B7434BDE1E16545
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....@..S.....A..#...@.T...h....c..f.,.ch.....K9C_yj.@..p'../.[...Z`X{.k=G..G...l.K;....8..w.H....9EOA8......;+Q./...Ei..a....Z4...1...0W...@.._uqm..j......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	299
Entropy (8bit):	6.801334305841879
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teFrk0hGXGxVpgIMGpJkpevutqIAmww3uNN9kup:6v/78MJk9KGX2ITJkA9Tt1
MD5:	80DB9E8E4B35F7BDBC447A8FCF6FCC05
SHA1:	50178E1A2A7E8B1408A3CC5E225A13E016F20514
SHA-256:	1A451DA25F2E11210EE60AA7CAD29ECAD8B77DCA6C4958810F19F356A72AA62D
SHA-512:	A4FCF3B6818213FE70419CA69321346B43FDB4AA45B867D26AFBE8F459F9B8C264BD4B876FEF8618D32AA1D6CFF43B100EF4B09292392D01DD940320C002D74B
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C.Iz..=l.....m...Lr.N....F......K.T2q..u.L.</u..k.#.<2.....?...4v;...5P1........;;\.........h....k.....)..^L..q....3.......H....k."6.W..]]..93/.9..w.vKv._F....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	299
Entropy (8bit):	6.789261929673196
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teFQm6+RZwkrdgRuXbgxuDTVm4f49tS0Ccdp:6v/78MJm7/vJgkDlfMfCcz
MD5:	7A3E793365F25AC4856FAA176EC27173
SHA1:	75CBA8C7DE1BD716B73A181BDB80FAE1CF10451C
SHA-256:	107CE9029E7BC0FD62DE93BAF23CD5E0BFB6F99D2D5808755000A5FE949888F6
SHA-512:	4952C7F767ADA26BE6AF8270691BE765DA16DF6B100C78C9A202F787D1B477199AD6A621159E2FFA619C501C2ED95B07D18703EE9D60D7E61EB8A94DEDB74F44
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0..3S.S..........2.'..@...n..%.d..i...\|R.A.~a.<%...x3./Z.].7..d.....X).j.b....vv...:..u'..@;a.....]....&P...@.q.8....h$....u`.6.O..]^..).:dA..b:q.~cD.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.727807690476011
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tetHkoSUMTFuQvKDf3q0IVljDqY8OKF/bp:6v/78MJCEokFujbglKY8H
MD5:	AA545693AB192E19016096B9C9EFCC93
SHA1:	12ABA99B765D093C8F2D70070D7AE0D454F7C820
SHA-256:	E25F04EE25CE388A23F7916C7840824B34C9A70D8B84AC33F34AF09E9CE55E69
SHA-512:	3975A5E2C41945F8A9C0CCDAFF6DDBD8D5D57B22749BA72C10358ECA03D50CB2264445860710FB90E034453E2E7A4AD23F1F9FA003CD06933D161C92614191EC
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....@..S.....A..#.I.@.T...h.lHx.t...{.M3U.......}.+..l.N..3.[...Z*`X{.k=G..G...l.v...a#.p...z..;..s...p....iU.wV.._.....A..\....h..>c...a.L.#@.._.(m.k.<.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.631972818536397
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tepb9A7OIs8/mNpff5YAYBa93wp:6v/78MJvsQmzG/BaQ
MD5:	6EE41CD424B3B196ED4D512F44ABAEB4
SHA1:	528C39B5EE24C281D79CF758405C81BF38AF2BBE
SHA-256:	95172E1DCE603C0F8F2AA29917E304E009391895062E14772FB331CC742C8D2D
SHA-512:	71F458FBEAFFB997906BE02819C2C1F46B54CF7DFF66E7E4C4D86DF0368D974119906BF604EFAF9005C3AD30BDFAD013FC3D2F914DA3993A164075851D9AF6D4
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0........,@.D.5+0.....9..Da.\|..I5.u.WsJ..8./....[......CE.H.;.=\|-@...T/.`...g.&;.....4.3C..I.k.3..k.........j/..3...;P....j.El...26...........m..B-....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.713726813277806
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tetZiOeRrPsZ8nvKYB4l6xFBcHYgplOBy52up:6v/78MJCZaRrPsZ8vKYB0YgplH2c
MD5:	F353AC2583CEE4E40D0EC5B9BCB41C38
SHA1:	4ED1583E00D28F2023C7D0586687D757B7A8283E
SHA-256:	E62606D13734A5A9C57A83F6706377AADB6BB88CB50C6CC7EDCD0DBD70D9AF5A
SHA-512:	580AFA3BF6009CB12F3DB768A03BBBAE36D8993497845D406D27E9CF81167229FA2EC3E7EFDDFC45A86BFA2BC5A60B2D8C19D597B2C98DEC1B17CA9820379FFD
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.E;...z....8.+0..5...<l..'...b9....?X]....C.5....g.....Lr...j..a...~....8.)8..?._.F&.$.>.".w..........iU.wV.._.....A..\....h..>c...a...o.~.>..m.eI.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.598581279193931
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tetO9UDSfSwnQg7c894QZYp/thGkx0Vp:6v/78MJCEXQP04yolh67
MD5:	1E652138B2E79268310C604AEB244007
SHA1:	6CE7EF6CFDD6900DBAA581F2B9E6B390DA424322
SHA-256:	54E080218C40AA9F6FAB07C6D0CC5A8CE359FFA23F80DE61D5486E622870BB1A
SHA-512:	525E5FEEB8017E6B63B7D5B9077C7E130ED922A7AE59975A08EF7E3F7AC243406468DE270BB0B30DB73ED833D682E4BEB4955CDABFED21D613FFDDA78577A53C
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0........,@.D.5+0.....9..Dq....I5..z..aNi.../.....'...qG.A.`......@.....5`.C.3.vv........5.$,.....5.Rf...@..j/..g...;P.'1..T.....+>elv}.4......m..:.c....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.5904591999381985
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te1QNfX8LakkHQB9o96jp:6v/78MJRIa9wLo9w
MD5:	245C8D7263D4B15916F82D9C06956894
SHA1:	6FE40D9E35C5D7347866BA895CB1BCA6395CB191
SHA-256:	217B9466120A3743CA862A4AA235A3107190407DEFD775994033C12E43E933F3
SHA-512:	3CBA6B4B45AF20CB34FFEC076ABBE26888073E82D652DFB0C279AF9EE6787E1D5509F63FD472CCC86D55296EF5F15C544E527502E06EDB06515F4FFBECE943D9
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....a... ..?.. 8..2....*8..B..qO.#..,.....`.uss...8.g......9.....p.&,......%.....Ed.Y3.b}Z..;#VX/.....a....ajm..d..M..;.\.Xi.Ui.o....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.60529641079153
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3te1kuoNRfvTwXUVnc/Ol1PegTp:6v/78MJJRfvPVcAeg9
MD5:	9615E889B0B1F9B48BAFBCB4243D77B1
SHA1:	7C3658D3CDEA505B9DA673BB30375CB621588ED2
SHA-256:	31D6F34BFE470B987BAC4E86C8F035CB9EA199AB00A8C0657F9B9409738F8BDE
SHA-512:	FCFDD132A82255205F85B15CC3B703CC478F8F369123BE8801851D1541BF393A07384048EACF5DC2D81C442E3DFCEC0EC52748BFB46262154305BB312DE1699B
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....a... ..;...yL.iw.L... ..!&f.{....^.[..l..n.{C...LX...`.9gA5..4.......`.9..<..>..,0kfX.O..~g...e.@`.0,...<L..{V..?.I......i........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.626302125031799
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tepx5NhtG9RDLZYnh3wJShxMgR/lVp:6v/78MJKObenhgJSPN1
MD5:	3E46BCCE5E2822520B4C3DF995988EF4
SHA1:	DA1DB78F38ABF3261E22D39978E431F6D24D333C
SHA-256:	327361ED384E75C915917F47EA9A981092A260E80D0A557D5508B580D0958508
SHA-512:	AC951262150DA5BD11832661FEE8D41EF99BDE45FCE3D464DAE98B6D468DF43CE9C44C065DAED74CB3A4A1AF762E29D13618CDA9AF00EC434D0FD984605C24FA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....A...0..?..(8........."...OX.3.Iv$..%...2..........gK.a.j......p.&,......%.........f..z.(.{F.......u...8....f5(.5........S.i.@~g.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\48.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.533791415580225
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lQkx8DVlZDUldp:6v/lhPAkRTp
MD5:	E7D31AC53D124242B574C8090362FFC6
SHA1:	39BB8F5AD0330977037D5C25C53B2E66B1CEC898
SHA-256:	A901AFAE7BDB66678F08A39B32F8A46DA9864C8A64FABC0E77A7F12B93DF12BA
SHA-512:	96D66670CC0D53E5B937B6136A69BACE772DB75D76A7DEC8102F47E3DCA2E739AF5E82A01696BA6288CAD3B001CCCEE82CD2D285320D190B870175EC3D4956AA
Malicious:	false
Preview:	.PNG........IHDR................a....IDATx.c`...`...........E.,....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.6745197298615535
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teFVQBykaOLl9dmlEM5BiLC36zki8/bp:6v/78MJ6lkaOLl9UlEAiLR1c1
MD5:	167AC14FA86B0C70934ACD8B057F9916
SHA1:	702BB384AF731BA3F89C13771023ADDE6C430483
SHA-256:	EE2F0DE54B3BC8D7B02B9552C8934A003BE24634B163FCF8A984C7C7CE1DF087
SHA-512:	49176139DCA74CDD04911239078A77CFF51F0486FBF959D8B826C29DBA5B2FB7CFBDF3745DE2FBDC265B7ADC2BCDEFD288C3D6FA0DBD231304CEB6AF4115140D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E..wr.......]...L?...).xxI..Q......$....D.....oF^.B.Z....-.Jqq...p7Nj1..b.'.b.,...\.:.....bP.h'\.....].*p.\|PqzZ..?.wf..t..,..j1P...0S..u`.3.. ".G8/..r.M.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.811670395624816
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teFVQmlBB71L+BobENe1jsPf2/jp:6v/78MJ6NVKOENe1jsX2/N
MD5:	E6FC1995675A27CE57658FD9043807FA
SHA1:	13CEAA0663C8D842D9B0A80218522EF02E69EECD
SHA-256:	E9DB5DD3DD6F173D80F995443C9A676BBF22E4D7615693FA081AEB65FE778CA7
SHA-512:	57901F4A810B6B59DBD29AC9C974A58F215041533961274D0CCBDF20ACED735ED4BF8969D460A3BB5610EC501254911840C0B76A615B8150D3A2C3DC36B27003
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C3S.....z..cs..L.d.~e.C...B>...0.).J&........G]...Z..p3....]....d...*.=...P..;t.1`g...%A...X.M.b...O_S ec...8..k...8q.vy.j4...@.:....SF..+.A..?.)....r.2A.Q....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.722012554823702
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teRhQf2Cu5kGBhH28Uik6fM/Obp:6v/78MJehqU7b1NEm
MD5:	1F9DFE8A75795495F4D118EAF519C5AA
SHA1:	923D113F4A2D07C18BC2CBEE22E9CE6A9C498E44
SHA-256:	C0156B298BEDC7145211FC08DF0C0D79649DF56E6A238021A0DFAB7A4AD944F7
SHA-512:	B81C39DBCB1B20834499CC4018A25ADB0E9652A321AB7F1FA7886586E9429B66F6C5C675F2ECEF34363D28F50BAE1C2E555F0E91F96ABB45F93C9C444A6BD7B6
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.@0.E.....X.....+..N.oL.}S../..)....B.H. .......A.$.....>.$.....V.+.....F.......UP...3.W...-.j.........A.n.'.Gk.\|.z..........4...m.....b...sH;.On....'....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.707071356504272
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3tepkuoh1nvxfBOALOFiSwII/EwPVBe9Vq/eCMzkup:6v/78MJx1vxfgFxpI//Pje9Vq/ePkc
MD5:	9E82BA244F8D07482BF5B34E8CE79F04
SHA1:	4844E9DCC4691116718CA04A338CFD4CAE50F447
SHA-256:	7EF7A9B01F3382D1BC70C56DA7B6B3C7CC0F53A4B440339BB243C411D72C9227
SHA-512:	FEB228F48FC18B4856403BEF45043FE9BE5150888D7AA1DC176CF463BDA9564419C722DB089261FD901BD6DF085A6A5FC86946FBDBE4E44D758A78A221EEC013
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....m...L........,.yl.s8wE.p..{.evk.X..Gf..H..%..:1.lP7/...x&.......Y.;\|.......;.pu..x.8}..@m3....(..F.pz.;.X...,.0.3..{Z...F.".R...n.n.}"......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.630475600149224
Encrypted:	false
SSDEEP:	6:6v/lhPUeT29ZA3teVhQI5NhqpKqmFTVLbWssbZ+oHIjp:6v/78MJKhZw0H+ZnO
MD5:	7EE2C4BD27244E2EE371D2C469310A46
SHA1:	C9F14DC1F564F124DD3A396D690F72E78CC0735B
SHA-256:	51494A59E737BA5CA4D42ECAFDA1486271B31B77D5A9EB8BE3583E8F682F2183
SHA-512:	A762C640BA938ED4DAB39CEF9592A83DCD28660FF3E020F62A03106AE4EECE363CF53E71503FB29B7A1215EBBCEC62C0E363F9E32ADFDFA9C296C727D75E4521
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...q...q...z.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D..z...6....A...0..=.D.yL.8l..D.........kw..X...+W......ZW.a....l.0lQ..4wx5.......`...<..>..Y`..X...\|.......nX`..y.Z.....F."..;.x.*.i.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\red\glass_red.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.202819531114783
Encrypted:	false
SSDEEP:	3:a5I7gRaK5c6QB:aWERn5cRB
MD5:	CFB00D0DD08134E48FA517BD6E46210E
SHA1:	F666FA046FC0F1C9D0A125DC13FED034102321AC
SHA-256:	F04ED9A6175032FF9F225B5C004DD85298FD25D077F7267A24538D4EC41D6F82
SHA-512:	E4E720A46E59521B891EEA9C360B6AB21415B517234BE61CE2F2ECC332E97E80777602FEABB1F9BC8E2AA9833CC07E7B4412DA49B5493C08B524827142E34E28
Malicious:	false
Preview:	tiles=1-48..matchTiles=glass_red

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.735863229684511
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teFVrk1O/UH23YA7aTLBnrk75UVMzMOeZrup:6v/787617pIeahg1ATc
MD5:	C9DC40617EA96FF91028F36E94BC9C7E
SHA1:	3BFE3876027595AAB9D1EDD4138E4901280EBEDE
SHA-256:	E6AB3D0D7363ACE39FCF14C1AFB6949A6630E990D19423904749BD2F95620994
SHA-512:	4F02436CD17069AED7677A12BE886E1339627A7563A00879A383A2E76B114351F2438DA5F33930998F7506DB2742BED3D3E32B7A00A0BA1AFF5C8F52789DF136
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.. ..}.....<.x./..^&K.dY.z..mw..73+.L..\......pU.....C\|.35xh........I.s..Nj....w.....`....#1.....k.s.<}..]v..6....6...=g&..f.ER...t.*.y...^e.k,.....`...`tFQ.P......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	286
Entropy (8bit):	6.639007910029093
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teQ/7j/Ax3OvUir7r38WlM9b1TVxHsup:6v/787977Ax3uUiTa9b
MD5:	5489440400C26A6B5A07F23E03ACD688
SHA1:	EF5781C288C0076E1FD34DFE7B87933493A8F2C8
SHA-256:	681E71B5A18275F22CCE8DB2FE76DD685766708083870274A9DB25B1E6B13B15
SHA-512:	976D5C37F6997A20C718DBB2CC4B4E415F3FA28A5C29A36F441B82F4EF0B6D4B9F24219FFC6AC59B1917F0D9669A613735D7A0BD3713C242E718E98B4049A982
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.. ..}-....8.x,g?*m.,K!.a.......n..+hv+..bf.5........6f.....6.p.........>.^._3...2.p'.n.<.....]D..m.XlW...g...a..aXa..y..6.y.T..]L....,"..Z.5..+.r....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.59422505677751
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tehHk1O/orgM8E5zXXYSd4WsO/YDkup:6v/787uE1KorgU5znYu5sAYx
MD5:	2114985887AC4917A8DDF08CB555F9F7
SHA1:	43B851E37F118696581D89D64649C48992F02551
SHA-256:	07829EE8E1ABEF36BF5541709E5A95AD18B9EAE99B78A8CB3900221F60E1FF8B
SHA-512:	F0356FA1AACB522F318D2276D6380435E80937662704288912F367CE7C4E5687013699BF453FFD1436EAE3B8B29AAC524F41639124EAD1383490100525BCCB49
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.. ..}.....8.x.g>*m.,K!.a..w.-..ED.....!s..fW..Y.'\|.+.....7.p....=..=.s.4.O3..CX......3O.3..s....f....(.wF..]....M...8....5..3.4._D$=H.5F\..l....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.708556749368714
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te19/4P/y3okR9rfBz1Dkuxs9/qV2I+p:6v/787Uq/yrR9bBzJpsZqcP
MD5:	1816DBBE4EBB216A3FF1CB713C66C085
SHA1:	A7650D0EE4087182336F47C3A022D29FE81F08BE
SHA-256:	674BE3C0AB3EF789FD0AD2F6E14A548A1DCA8D11F5B033E21A49C0DDF48ECB1E
SHA-512:	A47983D8B91B3FDF6B9A2A18C4E63AC94EBC1DE05B5861FC8ABD89732B14AC810AA955D0BDE42CEE76C03E2D453DB53F93C41EC8E24FF9DA4203352BEE8EC0D8
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D=..p..X...k.*m..C.xI-.)S.q...D..!.`.N.?kx.o.J.C..\zC...L.j..0....4.x.....+#.O.......p.<E`.;f....(.wF..]..(,....p..icc.....b.\$-. "..c.5F... ....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.729379439334571
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teFVQRLQQ2EGvjF8waLRchgpmONuQnntMSljp:6v/7876m/Zq6wCcOmjStMY
MD5:	4626001468D32A4AEDF7135185DCACEB
SHA1:	B3F102EBB938DD6B67C119241B0DFC51A86D6AC3
SHA-256:	CE720636367D378E25F6CBBBB00D5AEC38C3B97710B8EBA45ECDA4BDFF919DFA
SHA-512:	F0509CF5E46FA6DEB8ED81D20448A9C89CBCBB94F19E0654511C8C623A3E3A03ED72B858CD653E32828E289B7C0C162764905539ABBC5AED6107115DF3F48EA2
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.....x..o$.......+Er. .'JR.&t2..p.....2...?.=,R.F.......A..d..,..6n..{`....,..~e........F.. 4.$,....x...)+.^L...k....g&..a.ER...T.*.yl.u.26k-......3.7..B'C~......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	299
Entropy (8bit):	6.714056476885349
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teFQBh2kH35mwOVMFO/dlIfFaRQdP3+ySb+Qp:6v/787r2kHJmDVMGdlIfFqQl+ySaa
MD5:	487A55E60649CA4D63AA670157D02F46
SHA1:	30BBAD6183B76768EC2BFFB8CAE1CCC50DAF26A1
SHA-256:	AEC17525E4D04984E84B6994C98428AC950368BA90974C5F9DA5EDF6A6C4591F
SHA-512:	82A7B41B44EDC4E9D47EA45A555C29DFA74250AA9749673FB92DE8C5D6360CFBE7A5CDED1569938A4160F782212B874EA5EBC3C59FEAE98903F1F12FC2360EEA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E...<..g..pv.'`2......%..G)N9.rq.{.........b.R..x3..........G..qR.9.V.=..{..x...3.+.m.S.Z.._..............5...}g.+.....j...h.....k^..>.......p.[.=.:S.M....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	289
Entropy (8bit):	6.538597916096605
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teZV5kojgHKDtkXUMWnHgEZWfdfXjp:6v/787GEosqDiU9Wf9
MD5:	AE934853CA737801A21FD8842F52E7C3
SHA1:	218158C4F2F8DB182CD4D834D5ED5522DA625A34
SHA-256:	6825D8FD3F56BFE10D68E8B7F963721F29E38AD901376889EA0AB83821BB1260
SHA-512:	6667B2C1621D7918002BF300A6748C02B3F3C80CB844599290588CA1CAA08C69E81BF44CE216EB1122331582A8135B2E691E8205AEFF8788FB5891E48A3A31AA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|..o....+.29.dY..>&Ap..aB.1q....O..{o......dW..Y.;\|gV.....eo*.0..G]k..kt.,h...f...0.p..wg..g......j...........2n .h..X.a.f..{Z..?.J.......9{kA}.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.752096800971817
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teBphmkwYxcY5cwDgZji1VGV3YxUF6WNp:6v/7875JECwDcOur
MD5:	1583B07A6AF5D55C137FE6E428B35F02
SHA1:	5FFF6393E2D922F096B1BCA4BFAA057BD3C360C0
SHA-256:	FA25B5FE0F4F302E21050DB762500D9FD40046B0D7057A14EDF505B96035F3B8
SHA-512:	0160E8776FD1EF2724DBCE3A1BE40A2176AAB0E6D6A22F1F663FB5BEA41D2CA16CEA7508747192C8F4476E724C4788602D1CE4AD726A45B053C16E9048A40FDA
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0..=m.p..R.p....'.d..\|@...8X~=).%"j.$.....RJy..?......7C...dh.......@..6Z.j.b..w...p3.$H4...k.IX.{?g....H...b.5....=3N..]....3P..,csm..........Q.V.=...?....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.6975025285929215
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teFVQdWegXcpgLN8hkwLI+l0SGkyEU0aPDWiHcWBGcp:6v/7876ogXt58rLI+dU0aPxcWP
MD5:	A477EE7A85F8CE7624A8B6026B9DF377
SHA1:	63A7A85F4194A8B5AF5BBB89C31DB77C546119F7
SHA-256:	501888C9285E89E2B62F984FDC89E48BD74506C3D008336AB7064300761AFD63
SHA-512:	AC89F62B93A0962607F5BCE00A48D5C90C9F51D31E82F184E2F124D50A286985A4BED107A0AB33B00795B66F72D9501B888DEB8F8164629753097DF152290D42
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|.o....+.2Y.e=....9w8...c.!..(...^...Ka.=H...2.3=W....o'.{. Q.h.k`..'.GSW.e...~...oa..h'.nj_f.......m...^.....=3^....+....*.....{^..^...r......z....>D.oZ.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.761256243281074
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teM/7Fecl0fkdzf3Xl7GQzueS4N10qlJ1K7p:6v/787x7Fecl06f3XlSpNk6D
MD5:	D5AEBAF6B1B12EE8AE189ECD714AACF3
SHA1:	6729C1AE4256C64D922C3FA4B677A266F6F61A0B
SHA-256:	805E67CF5B73950ABFA271AB072342DB48A33595FEA932FF9E892044FBC5B81E
SHA-512:	D13ED5E7A2DF4FF53418A77039B53039BBFEA3DC95980E19669828B6A59F2A34144A54A3AA8B4DB92EB469958D105CBA0D6D57407A1006836C32FD75838C34E3
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.. ....<..~..H=./..^.X.V.1$.a.e...B..sI).O8.m..w...$Wg....7.....bw2r.Z..s.l..5`.C..;;..N.....k...Xk.3..k..3....8..o...8q.vz.j4...@.:.h.s.....T....."H=...>D_1.$....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.657934907555556
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tetHko78Cfr7dn+Jar43yQ0tpyCCca8MBMJwpPp:6v/787CEo51+jitpyCMBMJih
MD5:	1CBF123C16BFAD9D1D0FE4221C9801EA
SHA1:	2C570E5104DB9E1FFF764D00AC7839886F9CDE39
SHA-256:	D9D4476D24F585F3F0E0AE3A21279946F892967C913A7182CA16C1D452722F93
SHA-512:	B89BC9A0520079F88690404D52BC9523269F796D9B5A7E8AE71177007EBBA0666822446EE3C9A996E55D1CDB48A2BA5B1B6121662E5BE35C7E72ADD5408E34F3
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.E...p...+qL.........a...I&.X.Pk]J).'Xv..?L.Q.,{%.-..o.J0K}.......g\|.:.h8..`7'...G?..L.I4\|.E..@..)&..1;.....Da......a....L.[..6..!.h...&,.......:.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	302
Entropy (8bit):	6.72818501903016
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te8koIugCR4kbScN/Eg8L8Rqjp:6v/787dhIugSVEzQRqN
MD5:	6910BC2DA7A08A8C841B9FA20D90DAED
SHA1:	BE8AC25FF3C4C72543B2400851FBC075071CBF99
SHA-256:	B7C90ECBA36C97CF30894B2D295BF22BAF8F0A84653B03ED4A135FDCAD689029
SHA-512:	96FF3D5A6C1BB21DF22485E98D7FFCE7C9351CA88F94B61D3A4B1DA51A14952CCADFFC4DE7B2EA17E8AC2FDF4281E4C72BEEF85C03A06C394D004864AA84806F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|.o....+.2].e=..I.s...%.._n............{1.0....ot]..NZ..\.....E.s.........*h.....+.m...#.v...g.<}.bW..fE..hM..@....a,....a....0K..u`.1..@.g..f......BZ.S.;....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	291
Entropy (8bit):	6.687351944241579
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teutIe1fCNE/vHlReEo8nLF0Ccp:6v/787n1fCq/vHlReEoYp07
MD5:	0D9956F48B53A8260169B0CA43EC33BD
SHA1:	35725CF47BF7ADA958A15F91081B4BEEE4F037FB
SHA-256:	B65351295AB6FDB6BBFD81C77DBF46F6065761010C0AB01D9C33183BF1B5D801
SHA-512:	0A85F2B1EE4A35BF1074C59C43DA16D044E8983DF76A3FD597FDBD7D4C871FBDADEEC86AEDDD264B585997EACCB67382BF02C024E1043C5D285BFE3531FE1A24
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C...<..g..pv.'p2m.7..5zx.>.4.lr.sJ...].c..a...rg..!.i.T.&...Q.......H.Y.X...........Fwb`.4..u...}M...A-&P...@.q.8.....N....k."6.O..]]Y~..y..S.9..g.i....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.711686993228968
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teVhQok1O/orbh3sAbuO6R1Dkuxs9/qVW9ljp:6v/787KhS1Kor+2PsJpsZqkt
MD5:	6E951342CC597C558CB97A22636F8E3B
SHA1:	9E9EF4C9BE4CD9CE9655B23B9298CD9500A74242
SHA-256:	DCCCC077238B4009DFAFD5E276F29631CD4F9C16E07B011464824C0EB0E8FA8C
SHA-512:	3F51728A1DA62CA728F1C546CA3477E6E40FED77B4F5031952B27DDF0CD6789760A23719AE5C25D1FC95BD4559E85CC0C7857C309E448880FBE2C68B5BED9A1D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.. ..}.....8.x.g>*m.,K!.a.Z.)[.q_ED..r.9..........LpC..\zC...L.j..0....5.......+#.O.......p.<E`.;f....(.wF..]..(,....p..icc.....b.\$-V....W.5....]....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.585609818648648
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te1kk1O/oA9xeUyED4Veu9BAbTHSC/Cxup:6v/787g1KoYMEUVeu2eC/Cxc
MD5:	8B2311FD6EB4C1501CAF91F940ED55BA
SHA1:	B47B1B4E5B61BE55554AEAB7D2C73462384B41F1
SHA-256:	7DA4284AECF7324E6A4F0E17F86F14C93584A0F5B0416EE7089AF8444A3FA1EF
SHA-512:	596708F9A71055C8A7461C8C4D5CE4EABF15D8170360C1CA232071C685270FD999F8522C3030470522E9B39BF67776DF0C6ACC57F5E83AB60E37E85CC1F8266F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.. ..}.....8.x.g>.%@..%.a..w.MDR.q_A.[Y\|!...............ps.s...3.kK.a......k.\}.+...`.;..<..>..,0k.X........q..EnXa..y..6.Y.*..&M.....K.5...:.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.5780884981700165
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tehHk1O/Az9xyWVtpSvN9/+NbTHSh/Vp:6v/787uE1KARbpSvNIJeJ7
MD5:	9637397A8287F128ACE4DDD31AF0F035
SHA1:	8058CDFC15312914E4892063243D8BEABA9E124D
SHA-256:	F4240D2DFFCD986C285455D176D2BB5E315BB30C6EB5FDFC9B88979D82B15821
SHA-512:	9EE6C712AE57272352ED78AC357054FEB47C9266DE7580A46832A6F2D4B8885E632C56E8020AD23D81E05F084E623BF9ACDA051AEB7C2BDF56DE2264BD524AEC
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.. ..}-....8.x,g?.%@..%.a..w.-.t.HXA.[Y\|!.............ps.s...3.kK.a......k.\}.+...`.;..<..>..,0k.X........q..EnXa..y..6.Y.*..&M....KU5F..8....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.571874931312497
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRXBuWhvf9J9rDHJs0aL/zTS7EDuXKTp:6v/787oXvJ9rDps0aTDuXs
MD5:	FEFDC3661C35DEF74A36B0AA116C1E1C
SHA1:	118C2B5E2812A0D73CB82F103BF39214F824D7D7
SHA-256:	2D690DD88831B3C9E80EB57E81430C2FD2C0883F862C5D298DC5E1CEA0E0D9E3
SHA-512:	B73CC73393B5D4CF5B00956E011A408789B7E455CA21AEE84493E8CD2A35FE495F514868DDFA866C229DEB7CB5B6E2D4C9FF28F335AD5617C4C24175FBEA6AAB
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D9-.p..X..,k/m..C.x...hJ.9.MD.W.>....0a.N..kx.w.J..;......=e.kO.a.f...y...p.]X.....7{..g.......6.XlW...g...a..aXa..y..6..\|..&(......f.5Fsa./....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.710177099180607
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teM/AtNNGj7Wftn70sGgAjgYT23m+1+Vp:6v/787xMNUjgn70VgBYT23r1c
MD5:	5B702DDDE68393660ABEC7424A229AD4
SHA1:	6AC45B5345476F6BECE67D0CF9DBAD00534A549C
SHA-256:	F03853240B637EAD2B2C01922B6169A7232F3D273006F0F383B00D45D9A1E5C7
SHA-512:	83085BFA2D7F5B14208E023A27A0BF491BFBED9B6DACB6CC5F9861C25AB828A10B1C1DCC1CF713ECF91CD47AB1834EF5C676D652505EFC5D73C1C64F5DB5E70D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .C...<..g..pv.&`2-.'.~ ......c.!..... .`2b.Y..z.....F..w2j......5...T..{.ze...^.^....k.IX.k..p.5.RV...@..j....3...CR...T..Yl.5.26k.....c..I.>0.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.711562176967855
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tetD2M4iIIV1rtl7/rOKrMqXxnuUUVjeVp:6v/787CD2MQIV1rL/rOKrMqxuzs7
MD5:	6A0C8676C6839DAE91BDC6FF57A7765A
SHA1:	230E8DCBD6827C0E691A96618E6EFF2C1F916515
SHA-256:	7E1820A15C926EDB2948E4521DD8A448AD2E0C462EAA90B424DCB80202740E51
SHA-512:	E16A83949D84CCC6D7916B044A6DE78FB9CDAA06F302812AD36FA1DBCF21D728147D0A4523C78B0EF4C75E0E6CF9F0E9961315FEB7602906BDAAFE4913AE0AF5
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E...<..g..pv.'p2-...)J.....G-:..........7...q.M..Kx...`..f.V.;...cMX...`.....;tg.. p.MX.....W...............@..>g....P.E.u...8..Lm....h....sp.[.9{........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	276
Entropy (8bit):	6.576045847985987
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teO/eusqwrkvVbwzPj5rPB0esH7SCAL3fftjp:6v/787veu3FaPj5rPB0tH7SCALz
MD5:	9741C8C86DCF219E064B42A15AFBCE57
SHA1:	A275EE78D22018D51D2D4A446D249B2A49B70CF3
SHA-256:	43C4863AB4AA15ACB5D11C4715C7B66947CFCA2804948E8EF30AD1387B9BF15C
SHA-512:	43843601EEC16B2106166EC8410CFDB5D7EFE3873A75289441EC39A7163982E99ED11C3B1A10AE55620ED02D56B659C8DA616439D23475A0D6AD779D574E9B7E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D=-.p..X..,..6H....x...ID..LPJyB>.q.N.?kx.o.J..z.......kO.a......j.\}.+...`.;..<..>..,pkVXlO..~g...e.@aQ.VX.a....=...?.K.\|G..T+4.c.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	292
Entropy (8bit):	6.755843322214099
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te7y6Q+PreFGl/S8YXe/CiVp:6v/787ky6PPnSwV7
MD5:	23F42D779A647F30889F709E5BCF4906
SHA1:	309772A9CEBFC8E2C605E9DFA6AC65ECC4EF88AB
SHA-256:	FEC4ECF16796BB8E4485DC38CE4284BEFF61B62DC24C6757318FF54D4C9D7075
SHA-512:	6BE61F4805FA049E84AFCB6DCC03771B136E390E0D6EFB0CDCBDC7D50ED49E106DAB0EB22635488459BB250CB36D48F68E2FA16F131A7713718BC7E2206FDCFD
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A..0..ym......c.......L...8..0b....TJy.%".ip...<....2.../....^T..........J...,v.zc...7..A...X.M.b].9....@..`...q^..@.q.<.{.jt%....u`..{....\|....u.AY9{#nR?....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.656064021935389
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teM/7i6LmcI85wOsD1FL2dF93MutVp:6v/787x7di85PsDTL2dFxT7
MD5:	9BD22DF87D873A0D9355AA11C97DD17B
SHA1:	C5266211439234F10D4B3FF45B80C9F8109B8CBA
SHA-256:	79286D0CF42ADC4C96DC410F3C2FDF48475925907B31F8877FEDBFD498D23C0E
SHA-512:	8F7C86AEE3CD09F3FECBF4322E0130008B914AC4C5A2888FEA51D349525FBC2A26FD078656AF78BD7CE60153FDCFF702A24820EB12FEBC96102E7EBAF6DAA590
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|.o........d.g..P.c......RJ........-...Sf.5H...0.#..O......)X..4.50.8.p8.RW.in.<.}.....%.N8\|.}9.>}.bRA.fE..j]..@..e3.xQE.0P...0K..u..5.....lf..O.9.W.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.669572193165691
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te9QCzxvFSLQCFGvOQGOjJCtxCXS0eTp:6v/787sQCVV2QGMJCuXe9
MD5:	728798DB8B01C475A6E9ADA978BCCA94
SHA1:	ACCC94974AC2BB922F50104FF457E3EF9CE16DDA
SHA-256:	E79A22272F7DEFE9B6A96ADD774E4F08E126A13966F4D933BA540AA67BBB8033
SHA-512:	046FDA1A253DCC7AEEDACBFE62310708EA7799EB82AD5A6363B6496C6EA516E63473CE2B6D0C140158F946F37FF8C37CC7E7C52CF186D09BDF3E104AF6556481
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E...<..g..pv.'`2i...)...T.?..\.1e.........\\|.gV\..L.?Kx.oe&8..N.kC..qO.km.0l...1..5.n...#.w..f....p..g..f..z.(.{F......,....p...m..A...D....<.nm.>c[.QY....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	291
Entropy (8bit):	6.564836396183152
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tefkojcW7lzKGIfsKFl8GierSn2up:6v/787boHhKGiJ8GiZn7
MD5:	69F08C4DB6610E4B1041C3953ADB82DD
SHA1:	B3A452D6242FA3C2D275C477F18AA894DB81B064
SHA-256:	7F9EEB9C7DE6384EFFC78065E4D6157B1AD9EE7F8F5E42126A6BA8C22BEE3885
SHA-512:	1DBB1CFAC33885D21A1C58EC7B101D6545B17445E612C7497D6349F82EE61BB8639565047EC4EA7682539EB03A02D6B8D79B9C7E17CF660CF8A67E7AF35BCE44
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|..o.........h.. .c..w.......H..?.b.s^.!d....H.?kx.oc$.a..\......kO.a.......p.&.......'.....E`.[..b{Z..;#^.......a....aZm.....3.<...H...79.9..l....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.713052394190717
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tepmB275Gz4XRL1OLZygYNrv2NZKxOp:6v/787VB2i4oyZv2rq8
MD5:	76DFD31144A66E00E307F3E9D5C4A4B6
SHA1:	933AF553BCD4CEE1357220DEF585D496D02F280A
SHA-256:	2668EDCFE9A292F6A226FDEEF73B345422DD21600D096E8D23C9D9A0CAAC490D
SHA-512:	C3E5610ADE3EA4DE6885D40D89F18083F537178039138BA8450E6A93CDC7735A35C6D1493D2A9B87E0361614E25437D21E0EF06C0E5B13453D2693C4789ABCDE
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E...<..g.....N.dZb..S.xx.R....D.H)...`............/..6.nv...A...a.).]{..{Tu.<.....+(.z.Vz....Umd.8}."..m...hM....3..f(."..a....a..q....ct1...YD..\.9........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.631312828853234
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tetHuHB87k0qFFrKcAiS9dEVtjnsBVPjp:6v/787CIq7kzFocAiS96Vt49
MD5:	F8C79EC18D79602B5C9594E729FC04D1
SHA1:	0062FD92EFFF89DBF22CB9ABC67492EC80FF064C
SHA-256:	F329F8F577E3206B19001D1A6568DF0079B94EBDCD8CCE0DCE4A3E39633D1FEB
SHA-512:	1B111BD007D9B5D6AC7BE6008E5E1615ACF6CDA28BF3AC859FB80F01095EC4A5E1269DD6776C55DB21A7840621B840D54BA6472C784A39DD14ACF14B4AFC0370
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D9..p..\..,k...8..A3.......<..b..p.i..Sr....oX.3.iv$...^`m..;...u.+.0.).U{..{<.Yp.;\|.......;.......p..........kQ...xa{.;PX..+,.0....=....F..."i...N.79.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	278
Entropy (8bit):	6.542867536494459
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teD/1UMrPE9q49Nvulh0jh78y1CtVp:6v/787ItUMr74Py49B1Ct7
MD5:	CBF18B74F74699FB99E7520B44B872A3
SHA1:	476C86C2F050B8B470FE93FD9707C75A000BE9F4
SHA-256:	DDA6E05428DB1EB29C411F34E1E6EAF63FB1057313202B9A9803998449AA204D
SHA-512:	18CF53719154594406B9101666CD9672CE36E5833E67FA7F60366F1DED838CB5FF7F0E36EDC560D76E2A8A9408B3D164F5D8533DD74A1ADE09F31253C3ED587D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D=..p..X...k/.m..C.w....1)C.y...D...`.;.......+.....s/.p....=..=.s.Ts...p...D.n.......p.."...y.b{Z..;#^...........0.6.y.....U....vTq5../......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.6080044126061965
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tehIBy3TapyMLN+WDdaMF3PJSSEdtVp:6v/787uIByjasGZtPgt7
MD5:	9533EE36F838E1DB5FC54489F1461CA6
SHA1:	A1B8067862B610E63F30D4BBC7EEFF3A33653BE4
SHA-256:	257A29D9A463CE6B1A89F6E3C81E50D3E72292842B7F55D5DAF4A5B79ECFBA10
SHA-512:	C38AE0813621B9D581DBFCE7D83BB6539048750920235A68DB40A2671506DEE4BD988929AAAF7681141C7C7A3FADAE988355AADFBF3B936747800AD41DB28483
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D=-.p..X..,k/*m..C.xI-.)...?. ....w'..5...q%..n.....x.......h.Yp..........'.ps..x..}.".....b{Z..;#^..........8.....MP.gt1A.v-.!..cq5...64....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.633209464045776
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tehHgcY695AGyZlQ5R61RYidtnyRBaIl/Vp:6v/787uAGJKoMFtn0lz
MD5:	A9E6960536B7E8EE3D4B7F09A8A702AC
SHA1:	B40755A07CCF739F1E98FA42781A984A55BA4724
SHA-256:	55E4B451B6CAD486747612A96AC66C4313ED17E5B2E5BFAD9A69F9568BEAACDB
SHA-512:	866CF9DCDA79ADA2EBFD6EDD40230D928B7B6D7F89200E86575F8E768BB1BFA3E4A2DC6841EC5A7B832D2240BD4B8508E252C10851FE153357FBF033F40C1D01
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..;.. .D9......&.l.Ee..aX.P<..<&....B.Vq.H./..ko..Y..\|g.....'..........`..gA3O.5..>.....`...<..>..,0k.X....\|...q..E.....0sm\..T..M.`...7W.5F.."l....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.689677071852409
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teAk1O/ArGM5FA6SVR5wceB2jeemxs9/R3kyup:6v/787K1KArGYFCiJ2iPsZRRc
MD5:	6A0DE03C703EAB4B26AC2C9952C3467E
SHA1:	9C39CA99285FFEB981E1FDBA9847429C9EC33B3F
SHA-256:	C235AD901BF0F2E76531D1C14D348FE93E20F2630CE793FE494203410C3DC53D
SHA-512:	8EC9D5701C49DD16BF5E9D6D72D3B0CA84DB0A3790B6193ECDD854C0B2FD53EEFFA415F6E9E26075A7D96B9A9A0203CF3D85A69B3FE4F5417AEF795D63625064
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.. ..}-....8.x,g>*m.,K!.a.Z.)........J.X..........JpA=.\{S...L9[..0....1O....}.+3.O.......p.<Ed.;f....(.wF..]..(,....p..icc.....b.Rd-.!..W.5F...>....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.71229650566524
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teFVQdWeg14WZWL2dC/+avlabUOY8L7zP1Fozn/p:6v/7876ogymWLH8QOz31FunR
MD5:	6F01C286508985A8394416597356016C
SHA1:	7680FFF90AF53A73F8028E6325406E26B679FAAA
SHA-256:	05F373324FC50A6095EFA708B7E60480A145B28720F6B67EF8280B90BCD1B0E3
SHA-512:	48EE7CDA6D669FF29B5EA86DA5F6C539D16BDD3C74076A9608ABC2F9F877B3D1B8AEDB619C9112D8034D5305C21CA3B8EC3246295256380C7D7B1C950CF1DBFD
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|.o.....2].%.r`.c"...`.1.....ha.....x..g..3.;..Ek.d........8i.....o....A..............O_S ec0.........=3.........1P...bsm....<.A.b...H?...\|BZ..c....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.734597206293652
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRhQddOugXcpUsGPI2yky0U0aPDWiHcWHrp:6v/787ehzugXJsGnU0aPxcWHF
MD5:	DAC3AA53178CCB6AEFC82E6F3B00C255
SHA1:	E9F7AC8F0854447BF61A43484593F4D442231CF1
SHA-256:	702CD2699366D076DBB29B5FEB8AB608071AF75F0482EAB2B1024D182DA1E397
SHA-512:	C3057647F55AA6A1BE3EDF7B20B11865579B2D0FB1628149D3A4921183FF9206D794A46585771C0A43523F8D0E670F9011CC2AF7097D5BBA3C16157992843DFC
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|.o....+.2Y.e=....9w8...R.1..@.......{o.~..+O.....K.Q.h.k`..'.GSW.e...~...oa..h'.nj_f....f..m...^.....=3^....+....*.....{^..^...r......z...>.Y..R....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	289
Entropy (8bit):	6.7385489329089205
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teZVVyp1/tHBdcZLnu4j4Hu/Vp:6v/787GkJdcBJH/7
MD5:	9EDFABF1DDA4B6A1E5286EB641A9689D
SHA1:	DAE63AAEDF954BAC85F4BF5DB15621507F144666
SHA-256:	ADBB3840AEEF718A841B01E7BC2C4EC44AC1978E552343F2E8D0CE7D74327D4C
SHA-512:	10041BA097B0D9E2D77C19A13E3FE6E763BC41C454C4BA9BCE512F465F1069354EBBAA7EAE4919B4565CD61FE04E1807EAFB3F6DA2269FA4B740138FA412DD8A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0....-`.4...cr...........q.)...<J).;.....c.o....\|;..../7.Z*`X{..#..#N}..s._;....8..O.H....9.HA8f.b.Z..(.q...4lP.0..ck-.`....vX...._...9..=......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.774667252259033
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teWWIIpRSgDfYYbSAWuhL5LAp:6v/7873sLSYYASA/hL5+
MD5:	94D2A949479991E5CD1E9BC4249AE742
SHA1:	E9A91C69C8F9B6A771789780AC4A36EB95B22384
SHA-256:	C236ED781BD9CB5352A30629E55A7906817E354F50A30416EFF9A5D5AD088E89
SHA-512:	6658A74CCBEAC17C48448B5ACEF39F00844D9AE45CA93427B68ED5ACC58488A232395631943EFEE2CB0D1213D6E0EE59618BCA9871D11EE736CD155B880F356A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..1.. .C=........P{.N..$.:!..x#.$d.Xr.Q.s...uI).m....I...x1.;..C.?....k.T.s.G.S.X...........Fwb`.4..u...}M....(&P.8..@.q...q..h&.....a..k..............BZ6.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.713160061614641
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRhQbsclPppjqZmt0GeprmRlJnKanFB8CDCh2Dbp:6v/787ehWTlPp1qhG6r65KKF+CDx1
MD5:	C9736975CDB5CC16F3E5315306A9EBF9
SHA1:	348EB6697AC33886E6B18C8C3025919DAE2D839D
SHA-256:	0D33F271A56399F736E0A0CF23BF31BB3E4CAC33CCDEF7D60A515AE3D58B4431
SHA-512:	A7A91F5CAC5234F315136F78D83C014E5DD7844C8F09B76DEDA58A31A7104E436FE0F162956D46803581A870D77A5D46A74DE49B9039574AF9F61018BEEB844B
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.. ....<..~..H=.9_....8.F...a.e....RZ..s..A....xI.\..f....._.....o.T.5.Q.....Z.....f0t.h.N...v.b.....]...`.&P...@.q.8lx.jt%....u`.6.O..]^)K.T..vA....\|>...g6....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	292
Entropy (8bit):	6.726981687205644
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te7kko78mePPK1fPFoEBlCN8ViwAo30gjp:6v/787kto8Py1HTSqGgN
MD5:	6F52B8120B8D648AC1054767C35FF7F7
SHA1:	FBEA7A247AAEF0BE3C949FFB4E4F722BC67C1DF4
SHA-256:	8C1A349DEF795E81A463C5E178762296C9E2C86B67E34BB56191A993EB663ECF
SHA-512:	5AA8A970B1FCDFE64541A70029B240688ADDA97968D0BEAF5EF9477AD1CF64D0F7BD418FD57BF02E40F5AF7AA87E629100A3D315709DB4F5983EFDCE148D7B10
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.E...z`..zL...L....y.px(../...Z.RJ...>M..c.g.......;W...O7.g..a...m..4.q.S...n....F&`'.>.".g..g.#.a.+.....Da......a...9Lo[..6..!.h..1'L...\|...9.u.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.74186001800852
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tephtdFzGyzmLHDLO0Mt9vpWXt8xOLEYD1Tp:6v/7876F6yzm3LOv9v0OxOLEYR9
MD5:	EF3907F9D943C884BA3BB4E3B254B2C2
SHA1:	6FC2B449F9F400277A64033B124F9176EE49B0EF
SHA-256:	B018233AE4A8E1DE666CCD8A1097BD8F146FDEA327A24FEF91E00039CFAB2455
SHA-512:	E1FC512F36AD3842E183179C661ECC7309B5E417FFDB2B363BD5F194B8CAF247C16B0D6CEEB94FECC0B1A605EB2549A6F9671D38B4C82F6E989FCDFADB602D29
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.....x\..O.}...P..H{r....@...k...2.%"....0W&.mW........Bcw2j.[......xU..;t.1`g...)A...X.M.b]...w_S ec...8..o...8q.vz.jt%.....a..k....lC..0yCD.?P.9..2Z.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	292
Entropy (8bit):	6.660161012120954
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te7kko78K+Xq8BkM1VslwEOu0SACYVp:6v/787ktox+a3wEjY7
MD5:	0A051D0AE458DB641CBB9E6C4E206525
SHA1:	447D3F7D0A1C1FAAD5FF961EBEB975495B4817BC
SHA-256:	1873497D081F6117AD18B31BF84293DFC7115C79569E97F41A5A378067FD12FE
SHA-512:	2A17E16988E34E790F320E1F3B2EDBE46CCBAD12C49BFAD31AE2C432D9B12AAFED0B7CB61FAD44D6D5E59080254FD7E99ED1BE7D10A2C9C3E09434607CEC5517
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.....0.E...p`..zL...2Yc...aGm.O21..r.R.._j...z..kg.3.......vF......T.....QG..G\....v..oa#.p.._z..;..s...p....iU.wV.._.....A..\...g...\|.....u...@.....9....R....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	293
Entropy (8bit):	6.756918014752394
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tetVcaddiTFLLFaem9tMqifkrU7xJr+/p:6v/787CVcad0aem0+0xER
MD5:	E0CE46BCC7B85F31A155DBA224B30C58
SHA1:	46593BCF6CFC4C95A956BB17F686F4C1EE83FE86
SHA-256:	EFD3A0A13E491BFEE1355933740E410F9BF7630CB90F3B186EFAB3E9CA868DE1
SHA-512:	52DCA441D47D7313BF73DFDC20226052AE5EE40E62795879CD2877044EC284B3118B2E96BF6B1250FD11BF274D4BD5CC51BFB68136074EA504DA4A0F1B4CD61E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A..0..y-...p..c...xA^V,..c...0b......[)e........!.}d..!^.?....v'...5P1..'......;;..........h........5.R6...@..j..z...a.w.F#1h.T......>elv}.4.KD.7Dn9.&4.-....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.63793560952095
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te3kk1O/Apocd5dchasO/AXip:6v/787Yt1KAp3dchasAAXo
MD5:	498A320175341E193A4ABD7EA719D634
SHA1:	9FBF97768B900A730BC8D925B1A8483373BA4C2E
SHA-256:	3C9A19F903F0AB53AE27FF1E58636867F9EE2CB6EB63C3DA3AAB4A5B148C6F6C
SHA-512:	974F80FC4CA355050302021FE4AC46543D0B4EDC82BDA8BF76BF33AB50BBE329038617FE26E93F6A9EC83A2547BC3DD04C4F5447A0DC4E3674DCD7632B967044
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..A.. ..}-....8.x,g?*m.,K!.a..w.MD._RJ.....1..fW..Y..\|.+.....7.p....=..=.s.4.O3..CX......3O.3..s....f....(.wF..]....M...8....5..3.4..$<H@5.I..C....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.63523958272751
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3te3kgcjUEK9hNlEaMuRYCrtnyRB7jp:6v/787Y/MUlD79tnYN
MD5:	AD8E78DBE68090F372041567B683256A
SHA1:	B46A2BB2EC5236D1707C67D56E8ADCA4FB14903B
SHA-256:	C32FFCC29EE4AC26576045D4028CB59B1FF3B3D6D290BB666E0D558267695A4C
SHA-512:	D6EF4715D78C4955FB8228F639F5A1681C9B6B638791B6900F4D9C595F64ACEC2F48373A960131DABA63B8363CFC17840C8A38F043D9E844B5F94954FC4B18FB
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..;.. .D9-.....&.K.Ee..aX.P<..<&..1^".Wq.H./..ko..Y.;\|g..'..'..........`..gA3O.5..>.....`...<..>..,0k.X....\|...q..E.....0sm\..T..M.`..7W@5..-......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	286
Entropy (8bit):	6.635340441755769
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teQ/YN4P6Pg2JHQjavsCVaTIRyExEjgVp:6v/7879YQ2gny9VaTWvxD
MD5:	F46B228C466776C219D0EEAB29BE9D02
SHA1:	7D2E28A7DF4F7945B3B831F57FDE6A2DE1BC575A
SHA-256:	696A15F20A6A43AD44F1828208E0807DA417BFDA0790A7B94800663108CD7F7C
SHA-512:	0582FFFF9AF2E503B39EA228DEBEE1FF49426D86E57315A51FB2CE10A4ECA4386DA91603956D672953CA438E703EFD6A1BD508E0CC91E421D0EC13F5197F6C70
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D=..p..X...k.*m..C!~./..<....I1....]J..pM.3...........;......=.'..G...<.............=O.3..s...n..........v.w..h.VX.a....k^...F.....s.t.Z.5........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\48.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.533791415580225
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lQkx8DVlZDUldp:6v/lhPAkRTp
MD5:	E7D31AC53D124242B574C8090362FFC6
SHA1:	39BB8F5AD0330977037D5C25C53B2E66B1CEC898
SHA-256:	A901AFAE7BDB66678F08A39B32F8A46DA9864C8A64FABC0E77A7F12B93DF12BA
SHA-512:	96D66670CC0D53E5B937B6136A69BACE772DB75D76A7DEC8102F47E3DCA2E739AF5E82A01696BA6288CAD3B001CCCEE82CD2D285320D190B870175EC3D4956AA
Malicious:	false
Preview:	.PNG........IHDR................a....IDATx.c`...`...........E.,....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	300
Entropy (8bit):	6.747778963768392
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tem/QB7EBSb0huHLtGevgdDc7ZfGzTp:6v/787nKEBCHtGevgu7Zfc
MD5:	CA09BB083F8FA3FF2CF10B14C0768113
SHA1:	4D6CEC139F63DAC9E52425EB3CFAF0453EA1A2FB
SHA-256:	6076E02F3643199C3087180DD2F8F831B6C01A5E978446A20E3F3F30598C8E1B
SHA-512:	EFC53553067232C6BFB17D0416CC74680A4D2C2ED39B9D278E5914F6A0A100D0B57F5B71DF57587BCFD08CCBAFB8D7C582A84F3618553B76BBB6EC5ABC510866
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E...<..g.....N.d..5.o!..K*..R..,_.............k)..'..(....l..N.k..w..s...G...x.Up..4g.W..........?r_f.......mVT\.............O..Y.T..:..6.E.8..!....`f..[W>.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.69587744195681
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tepmAnru2KV8O6pV4j958Ap:6v/787VR2KOO64958K
MD5:	2ED82B3CB5FB8AFA5B67B10C854DC5A1
SHA1:	AE16B0116F8C4224D4D6B8A9A3614E720FBF43A4
SHA-256:	9AED2B4907D5DD9A8BB0771E4227CEA684D723A64F59E735EBE64DE3F279D049
SHA-512:	985AF4A0DF2EDACDBD3FE35F2F3EC64157FD5B93BFA920819C2CD8A1569A86FBBF5D176EDF2930547C489376B10363F87629C908C48DDFAD48DF5E17273B286C
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...<.g.......dL .....X.aXt0.#........B....Kb...3....4/..6.{'.v.=....Xy..,..............@...J....@...1.j..v....Fx.r.^A..b..*...\{..M.;G......o.:NU......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297
Entropy (8bit):	6.713160061614642
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teRhQzegHOFXtQ1OiSu6vtC3YDtVT/c/1p:6v/787ehVgHO3KOa6vsOpcz
MD5:	3CC81D5B89DF6298DF8D5E236AAAD4A6
SHA1:	9125F5A317F18B97EE925C59EB968F904C19D8CF
SHA-256:	6E3AE14CB27011D87F52775EAB541EABA6D28BF9831AF24A1BD08F161A78BFB0
SHA-512:	3306AE462D80904CEDA4C842812759A455AFEE685A9A51FB15304633BD5C90D2671453A6ECDDC65A4E0CD0174FA1C534CC0822E7F534F49DA7A448A159D6A62A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....\|.o....+.2Y.u=..c......b.[...B.&...&OL... ......4/...._v.k. Q.h.k`..'......y...@[..AK..p.T{s.\|............3..f,....a....a..y....kt1...9..P/9..:#v....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.697369149092007
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3tepkuB4F8Ru8MiBeZplSuqm4ie+D8lidEVtjnqVFsup:6v/7874TMiBeZiuq7ie9M6Vt+
MD5:	095CE125819DD1932899B6A973947556
SHA1:	0C1292F43E1DB8CE8433C0EDEE9F1D5B32DCADD6
SHA-256:	C1357249BCE0293470CF70BCCA814D084094AAFEBFC26543A5C092FF887044ED
SHA-512:	E80AD5331BC38C6B417B00E63154D9003F2D4D94105F05FAF80AB4BC1050417A0A3A83C0C86FE78D50CC6BCD230E81E686BDA02DF015F1BB4FCC0037FFC188FE
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D=..p..X...k...8..Q3.......<.2.H..@....<...R.!.....H..5.....v........x.lw..0.Q...1w.4.n..+=.w.......p..E`......kQ...xa{.;PX..+,.0....=....F..."i...I'.}9..M%>....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.655916654479611
Encrypted:	false
SSDEEP:	6:6v/lhPUeM9/U9ZA3teVhQqkN4PG6tQV2xMu19npIm2Q/Vp:6v/787KhDkQGAxxGm2Qz
MD5:	48EFBE0284E8D28D22BEA83A9C217625
SHA1:	FFE5F6E78961D84583BB89AB9AA797B9AF2FF222
SHA-256:	782ADA0BA17ED2949C9A66FDF8399EA993569B70805852D160DA0F78C3FBD8B7
SHA-512:	1EA341E71B82E99906A5CB6324A130C13105246AB6AD5421BE5651D6447788D92A954228D763D7FD57C4E35C2643B2EA1450A39BCBC31ED5202E406E08DC14DD
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...p...p.!..j....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K.. .D=..p..X...k.*m..C....,.)q...c\gY..%_...ko..X.;..O.....6.p.....=..=.}.....f..wae$.N0..y...N...,p.,....\|......E.....0.m.y.T..]L.......f.5..(1w....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\silver\glass_silver.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.845350936622436
Encrypted:	false
SSDEEP:	3:a5I7kRo42d:aWARv2d
MD5:	C0510A97EE72CEAAFD0237A4ADEE7FA4
SHA1:	7CD2927703E00E5B6BD8DEDC12202C6E2B446363
SHA-256:	6B1A5D365B57E02E1F605360A2DC0AF86D21E22E6E45028496B6EB16DA6ABCF1
SHA-512:	42CCEAACF0E018CF3F261430D130A260E861800B655198F2EB87F1372F34113A5E18EA14C9D4E23D4D73A71D25A229B62A59A303CA7B9FDED5EC59D68EE42DB1
Malicious:	false
Preview:	tiles=1-48..metadata:8

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.7572244475774355
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3tepp3+oqkrzvzcbz90+kuZalws4l8dYlrz/ZFVp:6v/78I2Iq+UrH60KZSj4nlrz/ZV
MD5:	F74C208422313C9134832FD710790DC7
SHA1:	8B1CB68C042D27B84525CAC2337CC5A132BE9C41
SHA-256:	2DA259DA7877E5CB56E93B737D062557749A4F55DBFC759D5D644F23B71EF422
SHA-512:	B19BF1D1B0AE175DA682541A8504150A3E10402C108D6343470D72E76461952B7E343D8692210A3E80D212AB03B9BF60D712545CEB08A981344685C582A31781
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....fa.....W.....$....9;..4.df...Z-.1..@Q.h....b5.9....(.....I..A..l.I....5.6...8r5...."Us.Op2.6.#.o..>....q\7....z...x.).].0.<df..I...-.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.495967684689782
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teXvLB3STRjz97H2l5p:6v/78I2I8vFOl5Di
MD5:	2F27F439D0562A7242DCF93C1DC3E734
SHA1:	8A5965A7C27A40D0D8A1EA71E22E18548A630E28
SHA-256:	C2938BA2892877F628C2CD5A98212AD36BBB147E72748B8FF1B3C22D9C2E1524
SHA-512:	51AF558CDB64F3DF37832DB0F2CE60CBBA830B6ED2E19AF917004D4F802D4D0540B09F6047C8D39EF0DED4237D6AB0BACD9473105280FB638599E079BD809371
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....zIDAT8O..... .C{...^..t.[$h.>..1.~DU/).Z{.f.~[.F.U..G..\|..1.}..f.C....`#..I..Xc..N.0.).F..K.... *..........9...w.+.s.,r.Z...epg.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.5507485425604886
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3te1+q4YL3HCA1EyMmBUS4zjp:6v/78I2Iq2q3HF1TBr4J
MD5:	0E53C8244FF330BA88F9750D043B633E
SHA1:	7E7FD864E42F3A91AFBD6912F3E7E7684B1243D1
SHA-256:	327690B511F682629ADFAB1478B238577B823E48103B8E9F8A75240597BA92DD
SHA-512:	504795FA10860D38106D966A88898171C71E2320E5382260EA681EBAA0522D10E23B2C283958896E73BA08BB3A06F0EC23B6606F18B4E3CA9CDEB1D99A53D712
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....yIDAT8O.Q.. .Cw...^=.tkY$..E?.`hc..^'......o...Z..........c@..........F.3-(..Xc...:....#..-.... +.....`....1\..W........t.Y........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	250
Entropy (8bit):	6.471631588416423
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3tec/qZ1AiawV19LDIKak+obTxjp:6v/78I2IBqZHT97BN
MD5:	2CF5F79F1AEC0638A498FEEE458B9A76
SHA1:	8FC54372B0E2158C6AC422514EB673D4E3560CD1
SHA-256:	F348394B84E5C647FC9667F5AFCB809A3E8B9B16A3208F89A2F385EA1B0B43F4
SHA-512:	A68AA6F2ED7C79F697F5D236F28AA6F160D70DF45AEC1C44F6251F356D0DDCDAC65652BE780031BE68FAEA71B8DF17341D1B69B93EE53BA78743128A1C8F0BC1
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....vIDAT8O.....0....S..>cL3.....y ....].0.H.-\|........0...(..4.2w.3[2. ..n..<.N3.M..?..LA.K......mM4.....3By...:'.f.n..Y(.?.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	278
Entropy (8bit):	6.618260430470872
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teWizaMpxknlrU85LM00lSm99UVp:6v/78I2IkaMslrU85MlvK7
MD5:	8A6E03C8FFD29255D293DA078F51C1E9
SHA1:	041D058E634C5C20B98D1C2B99498A34408B99D5
SHA-256:	2A77004B49D0163B1D48B66C60D23C66628D46B6DF9DE41EEF439F5088032596
SHA-512:	E651FDF1F9EBD4DB25DAB4C56455DFFA50E6635F9E34B35014E8AEA53F580A3612F9E7209FD2D54A5C098BF46582DA66A4A9BB7DB5F3A3C7A81890B4D32B273D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....S\|.....Y...D...P.+..j*..3.HU...D:.Z....M.......................!....pc.k..-#.._{......'3...vA.G...7x.a....9......../....=......cs....&....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.575835038054724
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3tenx27oTtpp7nrA/T1nyNEa/z++Qlbp:6v/78I2I/k9jroNyN7z++Ql1
MD5:	CE97B85F244AB2CFB4DA9BAFED0BBAFE
SHA1:	B299125F7CE17CE1E8EC2562B262C9096FE9C246
SHA-256:	2C67145F3B80207D332D82EF6D3D7D23E1544D10EB9CE3B3AD70D1554CA9CF8C
SHA-512:	0812A3D538F23EF788AFF6B587A95FBBBEE859433B5DAB25DC596D3A45CF2459384617BF67C02BCFA8FEAC0514E3E16976DEA3245FBB124DC20F8EAD6EA92A14
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....S...0NHj:...2A.1&c.....U....E...6-....32..0g...4q3.Q."[...h.jFz.....v../.>....\|...<.o`....R....\c..8#.W"..eK\|.u....\|.P.b.a....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.547071171273554
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3te52fslt53b2rXIi5G2PEuHXVp:6v/78I2Im2f23bS4i5GZuHL
MD5:	3C1115B9E58F950666BB886DB6969CB3
SHA1:	1A10639DC88D035C2763CA9D77991F1AECFB6C2D
SHA-256:	613F979F7F9A101B2994841BC15712E6CE71CE111D0A10AE587F4DB43BEA5DB7
SHA-512:	1D55FCF210CA42306BC37D0E0BFF6007488A66B43B507F4DEE1DED7D316627DDAA99C000BE43F4B56797B3A76BF1CACBAFA79ECC640D5BC0CDDB31A5F7B29074
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....}IDAT8O.Q.. .C{...^.C.).....=([c..Z....).x.Zk.l1..~\.0.Q......&5k..`...5..iNz.QM=..`.S4....)...Q...f.j.+..pF..eU..f7..%...Y....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	277
Entropy (8bit):	6.617900382612764
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3te9VBdb0dnhjKVj6CWPhArgoa3ukup:6v/78I2ISlb0dM2bm7aA
MD5:	827D141A2AF3B838CF47098ABB8A40B5
SHA1:	8F41C740E755B63B3DF593A6315F99971832AA6A
SHA-256:	7BB248B783F94370C1DF50FCE76CBDF709409587A42EEA759404B7770840BC2B
SHA-512:	B8C8BAD2234A7DCD78E0472E40BFB5240880CB2CB0BEBFCA00C1E6BA5D090D4621C13A32AD08687564B8AC86966649B037F85A87214590C5FD9D2E63FAFF9E96
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .........a.o.}....S..J).*58.$".'.Z.:.s~....1.p!.......r.m.Z......0........hp.k...X..-G.>.f`..C....o.....1.....b.\|...3.e...8DD...2H.R.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	275
Entropy (8bit):	6.617354142989403
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teN5uo2jShBRC3HdT7Dfg/4OTo3Zytljp:6v/78I2IuhmXp7Dq4Wgy9
MD5:	8B4FEA2FB40D25723EC182021CAF8D02
SHA1:	6C8A24A92568ABBB7C05522C3C47F63B8F7CB701
SHA-256:	5216A459E93D9E68588BD62F28296F51B4BAD81A8B9E6B7620F7E258A1CDB911
SHA-512:	9B4F9155E9F5C62B2BC99BA0A68DB3FF3A045BA3A41C26A0BDAC0D1FD0BA0BBCB7B5A075256DA8D2AB22953CEC133B99895D65D9D08D66CEFAC1EF1AF1620978
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...gq..0VL.\...%$.s'.Tk..'"..Ak-Eq.........g..b...+..a..6E.A...W.....x..e.....%2..-.p.x.6..>..+.op.q7...W\|..p.z.k.....N.s_CD..X.F.OP[.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.654050693060786
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teBQokolHTa9OsBYUyg3suK0cGAMp:6v/78I2IIQ5olHcbXpsuVcGA+
MD5:	D86FD2135A3B6C1A6761CA2E9A96995D
SHA1:	FD76D532F0CFEFE089CEC80F8D5D67086A4E8609
SHA-256:	265C676BA0B645BE22A1B7DFE9A13C7DB38C1C44C6E6344B6799370E5BF908AD
SHA-512:	19A6A384F36B10080C6406C402B2F49608567CCDC9F9A3BBC139CED24BE7B76BE89E505B85F49DC201A37BA91749D3FE9D147AAA79F0ADCA2D37868FB39A350C
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....fa..A.G.O..^..B..r.......ks.V.....].1hp.^if....x....\.5...R.D.[+.....9Pw..bc...=..Xv.[.....V...5x...a..)-....,3.O.3.)>p..9...y...p.&.=..W].....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	265
Entropy (8bit):	6.521937528704466
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3texVCAy8V0TdxeXvVJmWpM8BWnuHvb5/jp:6v/78I2I+A7yVJmnmWevb5/N
MD5:	B9273C623179E496CA90868BCF64B8BC
SHA1:	925537D7874993DC190F6D72CE8D24AF47BEE9AF
SHA-256:	9624CE891311E5A8CF1BB4AD9E5C1EC24EA28EFEF28ED3C8F9ABEAEFAADEDD50
SHA-512:	BB222DBE5055E631B90847CDE209E68979BC8298BB2A59FABBBD1E6F98C01EF5050A962A5369289E10609F2DBF8430C1C18BB2D452022E609F6DF4E67909D486
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....S\|...3.Yg$h.;(.m...ZkNAD.....b.....%+@{3....D,f3f.u!..Bl....3.`6..{..f..;./...XA.Z...5x..fe7{..[...hr).N..^KD........I.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	278
Entropy (8bit):	6.575821707209311
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teWBSZJQGAgxZeP2+An9OD4Tp:6v/78I2IRSwGAgxkP2Tn9ODq
MD5:	6E661B203C7433BA22F9F8932FDFE9E2
SHA1:	9F95CC2266D8DAA29B028ADE696DDFF8F50A9467
SHA-256:	AF5C36F70C6A00FB2D4A5A297CED72C4494414AC054208722FB4F06C33CC822C
SHA-512:	BA90D2EE08603FB78B174DB2609C215D0B8CA91F4685A1B4B8D22AF9489A8B66D562E71652B29DCB19520B6AD7B4F230FC6663A4DFC168B37497E93805AF3CA2
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...gq..0VL.."./!..]...ZA..S.j...dq.........32.\|1g.....0.Q.D.B...pT.....x..e..1.yHf..-\|q.x.6..~/.....5&..3B.I.....1.Z..o[8......u.*WD....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	275
Entropy (8bit):	6.581345275633197
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teN5kAAom0UN1BjhZP3K0jsvh8isjp:6v/78I2IrAAhRhZP6tBsN
MD5:	54167D1AD3D38EF910E145C51622E38B
SHA1:	823AD888A13B5B2082AAFF3828CDF6CE51D3590F
SHA-256:	FBB04DF1A06B7C76230249C70A7A23838C6FF9B997ADABFE53F354A76BB8ACE9
SHA-512:	9F53FADA2127B83849ABD385826085BABC9E8690EB4E0735981088C17E541486293A9C83D62C1BFF42794AA714941EA88C5D1815466006B788438594332E78D7
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E..Q<........X..oI.EH..~BDWmk.UD).1@..7..L.'Y.\|F....$..,f..f....Y^...8...'..}....1.@.+.".XF...&.60.`.2..J..9...2.d`.MwmG.Q>..T.9.^.A....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.527684499226026
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3te1+qg4TpfU4fYjxpNSp4Ep:6v/78I2IqK2fUmYNKpn
MD5:	536B9192AF12F23B4CF0E2D53B8F4071
SHA1:	10F4F19065BC0947EDEE82235B0F6DE1F1871FCA
SHA-256:	7A5F051B2A227EADC414244AEC1E1BB1B2E58A9567CAAB02242F62F0880C871B
SHA-512:	1876D5E96EEE7B9DE1D330A7E08346FB29C7E7802CAE2F9996AF365D902E065247CBB38F91F4F6B2272EB03773F35164A2C47E7DF27F2F9F439777D6A71AEA71
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....yIDAT8O..... ......_}F..Hp-.=........q..[b6..l.D8. .....Ll.0.....6.\iI{...{.%..<.p...oq....U..V.f..k.'...2.._.>'.7.....pt.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	255
Entropy (8bit):	6.508273485530623
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teKmVlmZB/YApNG/p:6v/78I2IYXsBLpNGR
MD5:	DD991927F13885BD6236B46988EADAD2
SHA1:	2FEF999852271426045391A78AD7FF0891F40823
SHA-256:	338DADF62089CE945B1E2FDA2D9A4FFEE5221EA9F8CBCB1AAEB974CFA73C01BF
SHA-512:	6D8310305FAF2903D2FF59B866BD8B4B4EFB73FCEF1053C5F5C1FE8093C4E05DE0D0F9C8B090C5EFAAF2418D7C7EFCFAF3078BDEDB1D9C6CE0667129E7B11456
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....{IDAT8O.]..0..w...^=F.v..f..>..`.$.joED..Y.m..}W...)*.9,......9.m2/.0G. ]8a.=....:.p.../.).`.Q....x..G.Y..ax......~.....-......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.482945085984896
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3tepIHJbmvuHPCi8tnqn0/c1p:6v/78I2IFJbmv6Cjqmm
MD5:	CF890C0873DAEC5E67B709CE9F244DE0
SHA1:	3DBFA8113C3EE37207D96B54ADF4E51192EF6FE8
SHA-256:	A384321E064C3EFE9C29C8ABCE28C713FA68AD5F590BDF4573FE18CF230872F8
SHA-512:	878A9DE021DB5232F43893030E59B50841DD240CC7432844D568E52974447860ADAD35B5D8AC70E2B987A99E8652509887B28E8BD1CC7254768775DFC8CD15D6
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....zIDAT8O.]..0..{..x..cL;..]..>..`.$.GZk..Q.;.{O.-..vU.......r.\|.0....&.B...s.......m.-.9......Oa.;.....l.k..,a.3...o..!r.......4.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.443900890240374
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3te+qe2eLDU731Bn+pCJIp9D600ljp:6v/78I2IFB2TxB+0AholN
MD5:	9E72AB7B426347941B61B1D03CDB881D
SHA1:	3D2AEF8D64575148CBD8E29A4843DBD6C13B4337
SHA-256:	DA094F049A94BEB65FF4AAF65ED325ADBFE6CB094FDE17AB1D9238DE26022546
SHA-512:	DAEAECA08AEC59C70C1863E75C68319C1314B3319418EADF5B9D3F0AFFCD8F45DCB38211AD47F7DFE901F4862DE609404E4B4AB85086348BE84DB4F2EC9DFA06
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....wIDAT8O.....0.C..Qv....)ddNi...3MB?2...U-.-..v........r.\|.0....^....d#........S-...........dE.Z.....1.....ix.Uy..f...I...^.y....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	275
Entropy (8bit):	6.537275596017303
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teN5kolrurgFjMbnBAPuhDU2uMGOUjp:6v/78I2IrolrFj43DsN
MD5:	5CB5DCB6B5533FEF9CDE650503964961
SHA1:	D1C39CDBCEA83FED22D683773ABE9231EAB7D3ED
SHA-256:	46187E2A0F6751017F37E6C94CEE750C993DC9D85A6ADA2DCA7986E91CB1EC3A
SHA-512:	98B8BF7902B8D5A1A972223E040D85F55C30ED51E449C0C52C7B5E66B715390B5CCB602B857AB9FEE89A2CBFCF07217DED989B8D56D00E9A53E708A26A61C7E1
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....gq..0..\|.RP.KH*./..{..'"R.`.Q.X.Z{..6...0Rd.g6.t..."..b..@/m!..jd9#.....hL#p...,..;c.g'.."..Q?..........g.q.`'.Q.r.'..i.."R/..C.I.5.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	263
Entropy (8bit):	6.615124850128957
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3tex/tHwPm4eci3h0nYUjcImt5i/bp:6v/78I2I+QPm4e9BSca
MD5:	CDFC09E39BB0892F15BF0989C9080713
SHA1:	C6D5EDFDAF9826642CBD59B6148C1225D242B935
SHA-256:	717E940041A729CAEA456005DB23B259BC3BDB10BC1F4CFEF53FA52E544ABB54
SHA-512:	2AB2099C04AC2C62AAA7A934D7B95CE39494142D33B8163E11B193D8CC47F6063E8C2A72098C0ADD163AD14D738DCC6AB9C654776E8A47CB6918C6671D434ECC
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ......_>C..DbMU..@k..j.......5.#.`8.H...T..p.....lFm.J).0Y...}.........q.{I...-<8.........x..1..h.....l...v.1{.9..S\|..r....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	248
Entropy (8bit):	6.460405332189184
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3terYB7ScGgBMhFwhmbhup:6v/78I2Iki7SCM7wk2
MD5:	DD22185F151AC498566DB1C8DF185B5B
SHA1:	F8FEC06C924F55B3CABCADE4A7603361393CAB29
SHA-256:	88FC7AC8E4850FAE02626447D459AE888F694AF5C806F81BB3B6A0CD962CB458
SHA-512:	8B71AFB035597CA4EB634776F7C5B6E09F0B2D3D392E595B4EA8F12F3823B7023BBF91EA6B15CE109D1F97C29D650F7E6CD61BC2223283E3784F90E7FC2ED167
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....tIDAT8O....0.......=.LS....1..D....c..Y"....^...l..t9..%-..l.{.2.".Y....i..S..De....+....Ez[..y..)7.D.".WyZ.....[.H.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.568774519997646
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3tephQcAEQiWFuubcBQ/pUVtjBTTp:6v/78I2IWhvA8qufqR+jBT9
MD5:	F6E5CA2F6CC81C6B1D1FF27C73F586E7
SHA1:	31CB03C76553CC79AA039D9DA885DC6CBB339398
SHA-256:	BDEB7A814637D97AE9D54ABC5EF04AAE9A7AE688D22E96BD2C055A37A85497EB
SHA-512:	BCF600045DFA7440B62CF4CF7C836060095B42F5CCA155151A38F21BF273F0D186C299CBC7B0F1C7B613751DEDDC123951A797D86C0BE7876449396C6081391A
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E..Q<........(........?.Hj.Z.R;r..SJIo.:..b<=...\|.@..&...C....p"..5./.8.9...,..-[.>..f`..C......d......f`Wi._.....2..:...t.Rf.?\|l......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	263
Entropy (8bit):	6.625121772117895
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3tex5kp0S6qLju80x2ZiRc897cXll/jp:6v/78I2I3pLu80QZspct
MD5:	9BDB2831B6CCFC762B2DCA6B350E9861
SHA1:	50E288EF2633EB0E0D694D7F107D54A911E85976
SHA-256:	426FA472074FD31E1441547D86E7ADADC15EFD0473AB2617E4FD2B913F8F2C6C
SHA-512:	1EAEDB452948AF775B646B4863F4D7F8CDD33F63D8933BA6BD386DBBFD999539727F4D927969C1051EE0D6A2A7D6AD1F6F1F79C1ED1620057555DEE18F99D909
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....../.!N.HVS...Z..V+.${$.F@.......=..p%...K8.....lFm..@..B.j...5...5..~/..x....\.w........^.k...#..d.....5..h.>.X!........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	269
Entropy (8bit):	6.6056803344649815
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3telseKwuamRjtei2IhHau3iGzfXe/p:6v/78I2IaQwunRhvht1M
MD5:	C98A247625E63BE9FDFDCA24627A716D
SHA1:	65D7013F2AFEBC6BA030D23E7502F571B1F606FB
SHA-256:	0FA21083677336085189E0966C7F1011026E3754350804187A53D0E31B5D3DDD
SHA-512:	51225A6848843411AF35CF9626555D8D748C78420CF27552EBE88479EE0544A18C2B75A7A004FD7A805BC5C98E7E4E96C7CD19338240C28F52F93A9F3FCB11D9
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....S\|...3.-e..-...I.Zz.Un..+3sO.c...U.....qF...p64..T.f.&.B.THq4s...T..-.>E.4.........k9*.k.L..`5g........V.h.{....).N).._U....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	258
Entropy (8bit):	6.560227282051717
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3tet7c/OvTjaLbt53b2rE98RHYoxsC5p:6v/78I2ISgATez3bSU6YBO
MD5:	BE0D9711F106040C7036CEEF939E8E12
SHA1:	0F1D7AD62ABB22999501C1A6D9BCE97CAEDF08D5
SHA-256:	0B16607D3017B4F3ACF4CBAE3F58AABAB303D8227A14BD5189E762A99DA4D0F7
SHA-512:	D61D13308835AE70427274181EB69B8F310073A727CA859489224C2B3F3B4240BDCC182B1CAD34DD062FE4E9AB3CB419619DC74B0586C6DFA93AB7202C78B65E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....~IDAT8O.Q.. .C..Q.W.!n).....=([c..,...)7....<Sz..l1..~\.0.Q......&5k..`...5..iNzp..z.9....h..}?.S....".-G...W...0.....^.O)6......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	263
Entropy (8bit):	6.494547626031568
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3texCAZWJeGi3ZGpEkj3gVFqIq98Weup:6v/78I2I8ZWJ4gt3gJqyWz
MD5:	B65E8AFB51327682005E976D6DF00563
SHA1:	A318DAF57253713CED5197D090C995BE1EAE8B47
SHA-256:	09A47A4FD21D37E4A1777CA1451D32B81C3F64750C86E5FF066D09B37A7A11A1
SHA-512:	3AE0BC7CDBA2DBA15EDB40CAC69DB009E1E2845848395D15909079CB13E4C0BAF61C863DFE3109F26332B83047E36B5E9EF254EB1D9F115CB7E8FFD29120C369
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....S.W.!N.H...;.hM.ZS)%.?.Zk..+.`8....T@.o...s."....i2.e.,.X...A.k.Amkk.4.^.......y2.@.*h....^.k...#..f.....3..(.,.B.!.ZUB.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.522947704580096
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3te5RuUk3vzmt0vbBK91K+VxaqvmT3t2up:6v/78I2Im0Uk/zk0zB0VxHvmTd7
MD5:	191B04B117431A38D91097A22076EF94
SHA1:	17E4E7C35D545BD044B262F0C32CF0066660845A
SHA-256:	04F22CE7EFE09F1D62550FC1DC8DBDE8CB038B3D89677DDCC34A8AFE04664181
SHA-512:	4B368C51E481940A0484BFF731978DA1E1DE5117A89EA174D8F416F9403CA5E9F910EF2BBF05CF49FA2398EBD4F6A62460EC05B7C89F5AFF730CF54B81186823
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....}IDAT8O..... ......_>C.)....A...0..Z..ut_M).3.ZKg...........\..4.Y....\|...Hs..j..d..a.....0..DEz[..y..).0...ax.U.9w.f/.+)6Cm......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	249
Entropy (8bit):	6.407241506455458
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teBhg1vqjcGuoWYrMWm4WlIp:6v/78I2IOhgV02YnWc
MD5:	06642267B98FCAC21FDB5DE69AC77195
SHA1:	BBA841E53397D196174FC655FFFA822A6CA3CB03
SHA-256:	0D66B9104324538FE3259954F684B79880C36389ECC09516D6FA4DE7E0C195DB
SHA-512:	B1A143A844E0EF4EB7680B7C1BF856D7EDF10FB183AB628F1500E6B635ACD615657157FA6EE0C37481829DFABBBF7465F042864C50D24F2678E793FDF63036AC
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....uIDAT8O....0....S..>cT3....1..D.....\|....{.^...l..t9..%-..lbfS.Zd9.....f.a6...\.2........"....y..)7.D.".WyZ..f.N.....T......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	249
Entropy (8bit):	6.452312048391727
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teBhCZAqm4YyKJf6xFgLlbp:6v/78I2IOhCZY4Ynf6x6z
MD5:	A47BED98DB87A38B4531F671E259F5B6
SHA1:	8A53560AD426D68CC1FCD403511338E65427B77D
SHA-256:	3AF3173577FF3E2F021D4463880A439692B79FE16341DDC73A0D284B39BCD506
SHA-512:	17CF1ABB995C802877B8CF51422000BA09C3731296A5C4A02ED0FE0B34B07945CA69B521EB3BDC955B47DAE51871F784984BD2DD4BAF219AAE6C884A1BE39560
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....uIDAT8O.....0.......=.T3....y ....._p..Y".......wV.9-.@.0.a......4.p........w.. .%*S..-.d.?......m.Ny. .....W.>g.......:Xy....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.482108151439387
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3te2/cEfyAsIxukLkzuylNVp:6v/78I2I3cPASkG7
MD5:	0DFFB12335E4C6EA638FCE7AC583EE45
SHA1:	1A962DFBE270F055974BC406F8901969E64C0654
SHA-256:	6C325E88655CAD592DFE1FDE28D9E847C278734786667861B979C43DD5174E0D
SHA-512:	FD8E3A3E9C02B39A55C3994836F9A00DCBA62C59715E0F834D12544F5C2534BD8F1088F950DF5893BB436093E4B3EECD9D6D2BBEBD943AB2A1BEAD97B7A8517F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....xIDAT8O.].. ....Q.W.Q......E...`.I.jo..Y.-1.}W..8RV.sZ....&6s.......0gZP....hA.0.%.F...8.;.AV.........;c."..2+......^....k.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.519293903490612
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3te2/CkihhR0Tk9iQJQL3v3rup:6v/78I2I3nchCo9iQJQL/3Y
MD5:	294A66F081EA61221BD39FF0C9F212F5
SHA1:	6959E33D000BAD0DA9574E44FE72DCB9467389AD
SHA-256:	9F4571830361412EFE005A64B656624FE4B815E3C92F9B4C9F710B0D42E817F8
SHA-512:	B244C6C567D2E9F0D9DB623C4FA64B531CAFDB886F4E820F33B7D6A3F211E0A85CE49088EDD5484205E6EB8F76CECDD4706B0ABAB7F11B6C9630326BC343D78B
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r....xIDAT8O..... ....S...n-.....C..0.U.ct.H.]...=].a]....r..+0......B>........k.fD....a.x...V..^....f..k./....7\|.<O....._.YDj+.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.592231395652734
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teAkoh5opG11rIy9I1v7AW0p:6v/78I2IKoh5og1rrZ
MD5:	66AB2709E029795DAB7E720F1BC1915E
SHA1:	799030CFD766114E92CBC810EC8AB3F93D68C5C0
SHA-256:	625AEE76AD9DB2C4B042AD9B56E61E42A7FE5B08804DA8C2631A2DC661A2C5F6
SHA-512:	6FB6D897FFBBA6109B02E9B0CCB82E296437E62B97A19859C81270A973FF2204C8BE746851EC183B15FDA5CE67032B41E7F1DA6A06632C2E8BF8AB01A8629932
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .....fa...h...&%...\...BK.?1...c..iGk.1P..H4.H+..j......(....... ..BY.I7n4.5.4...8.5.u....S...`e4..G.....>....q\785.U.....M.S..Oa.......ev...]....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	274
Entropy (8bit):	6.669519393024939
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3te0/RRXopaxN9j4frg/7hC2/jp:6v/78I2I5rkaL9GG75N
MD5:	1133DADC8ED130A661622A486BA8411B
SHA1:	8637F80317EC3BF9C19B09D213E5BBCFE25442E1
SHA-256:	6D3A47330ABBA239A37D1497BBF5536CC5AA3C1982E27B8266F8399ECBA1AB87
SHA-512:	432F3D2271B25DED4C06F2C463F6D13EC75A5C65BF5637026B7F53C4C960A03642CB7DCA59054B5CB0F682EC0156A9D3528F39E2B9E582C72197903E949CC313
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...gq..!...1Q......hS.5.?.Ak-Eq.........g..b...+..a..6D"2=&.b......x..e.....%2..-.p.x.6...C...7...[q.+>.@8.=.5.\JY.k'..!"...4CF..wP....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	261
Entropy (8bit):	6.477244996162009
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teNhQJT801q/h5wlRbUCbcDmjZap:6v/78I2IihC4+uh5wl99bcwK
MD5:	30E977D1F46420CF3363271E8167DE70
SHA1:	940CDE6347434DB0BD44FDEE4B5577729DA39EFC
SHA-256:	12D6330A4EBF2F7F81A4F2470C68B11F35FEAA2D45EABA163275ED5E856D4809
SHA-512:	D6EF231EB947C0201D4DC8FED9EDC54EEE7B0DB5366062DCFDE1BBD0AF7F4D7DB720B49C5BD38DDC35F82895A46B4E6441522ECCF635BCE2E3BD250C0F01BCCF
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....S\|...3.-.H...A.I.L..Z.k.YXk...0.....lh...X...l...).f.pq.3.p..s..f..~.'3... ......:S.3....y...s.\JY.Y'.u.2.\|.0J.._.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	286
Entropy (8bit):	6.667986057206695
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3teQ/Blkj0CfU5+dYBemBgiPDUAp:6v/78I2I9fXCfU5+GPWYD7
MD5:	7DF588D0C76B5416E07CF21EBA82C2DA
SHA1:	2BDAED7DF62D526E1143978155612E90D4A3FD0D
SHA-256:	F95ACCA582AEAC1C50FC634F92FE9DB21F82F03FE07DE82E73DF8DC0BF478737
SHA-512:	8200A0D98995E3E9B78B93475AEF81BE310E2C9C3A3B676BDFAFC7086011C19692C861C84E30857B0B9BE1E511A0B8324385E055F75AC9D3324E911B2B82FC62
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...gq..0.#bO../..(..B.9.B..DDkB)e..).......'....b6.n`...L...n.zC......F..8..~.e..s4...C.<..+v...OK.d...1\<.....O>...2.e.BM.W..S,.}HD...jm.4Y.#....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.647364987052701
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3te1QXVoGm+9kmYIzalz3psLUfI8XeGwOeup:6v/78I2IrnmcYIuRZ+UgVGwOec
MD5:	F4F4E9A44FCEB301CFE14D7411DADC6C
SHA1:	62312B5682097456FC62E34DEB131DFDA52D6518
SHA-256:	0B5F0A149A365C3947DFA8F190DB4EDAA574D17284D0EC35FFF1DF86E8DAA226
SHA-512:	7E25B6283A3B0531BBEA20D5301CE13C15C26181D393DDD03A7ACA775E26BEADC35636CB5A06D6F29C1563EAB5577AC488E7C1EDFFAD8F631A4B8DEE3B68617E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .D...fa..A.k,...........".tRk.jE..1`J).A....12....X2. ..d...V....f{.....8..~.e..gi...].<..-.....p.u...N.j.[..7/k...?.D.)>p.c..[.9$"..p.:2.39.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	263
Entropy (8bit):	6.554914952928883
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3texx4o6xRDbho9/IfMJ8dtovTVp:6v/78I2IPRDSifcT7
MD5:	62B0309B43505114D5B8711D02F0EEF4
SHA1:	069A364184036F0C9657FD05CDD46C575AEE3B36
SHA-256:	DBA0889CCA74BA739C942A7CEE8E70C9A231F8F206CDEF145C668F1507D8C66C
SHA-512:	E31CA9D9CCDE82AB01F9185700EEC72050E93B4648394A48A6013032D34F602DB163DD4BD40A025D04E4E2DE37EFBC5562A66522239C33B69C7069417A6D495C
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... ....S\|.........Bf....m...k9EU..b.....%/.z7....D,f3f/".L.B.....g..l.-.>..0.w.#...xA.Z...5x.,fc6G..]...Xrkm.g]........8......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass\stainless\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	274
Entropy (8bit):	6.571500936947058
Encrypted:	false
SSDEEP:	6:6v/lhPUeay3G9ZA3te0/HAMQi3mFiXG/KSSHG8Oyd7Tp:6v/78I2I5HAU36izHGi/
MD5:	5DD9ACEC2E881301D15226BE4EF39CFE
SHA1:	FB163C3E5E3C0F0CF6D35F31BB8A37B5D5599ADE
SHA-256:	D65B405BBAF893C983AD5680FC6581F46A28D2BE3E54238C36F2161E96C78E97
SHA-512:	6BCCC4E1C3F66EF949843FA6F4E4F267BDF1606B8B03076BC6F0E1E11E7C51CD4BCC0F0EE340F343808D5144C811BDEDC71AF0EF1368E15079ECB680B678022F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....pHYs...r...r.^e[.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..... .E..Q<................?.Hj.Zk..9..)..7..ND1....l>u..@.T...n..@n8..b.....8..~...ei..a..]....3.m58Y..1.....UZ.3.x..<....".N$...3{......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\0.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.870690511550459
Encrypted:	false
SSDEEP:	6:6v/lhPKjQQJfPGZqB/4hm/AO2cXxmNdNF5grfdQvCOYVp:6v/7ipHGZqBQWlx/OY7
MD5:	F24CF5F5897CD5B1C1CF9D1FB7B23B61
SHA1:	5D3C7D74CB08DF7CCEE652A96942F8959CFFA9CC
SHA-256:	1F11ED15E420723DE46A9816703422B30E541EC04B0DD05D34A2FFC2A80C1E49
SHA-512:	211E71258B06F64848ACA12011DF8358252A9FF5B76517EBD745CE39D8C41AB83D58BD85968E1232C667D4AB4CCC30D78A6F04E6C1A556B31B402F6DDC7E9EDD
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...v........+0..5..Jm)\..a)...#p..R.G.IUe5..v^......3-J....<..\|V-@.p.....$...l.........?.+"....v.'.z.*.....#...C...p.J./.eE..p.@Q..@..=..)..5.Ms...nA..>.?..@$<........9.\... a.y..'"rn8.....).\.W...9..8 .....`..........;Z......"....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.9317250268785715
Encrypted:	false
SSDEEP:	6:6v/lhPK2Why5BjwGxCTrg5lbWxlc4Qs+lj61y13iwxgiiotuqkoWikTp:6v/7i2Uy5N3xCng51Sv+F61S3iwxgJwy
MD5:	6E34D54420F62EEED4E805952A8A7404
SHA1:	F06B49A389CD45105F54F9B96F5EFD0408F057B0
SHA-256:	040F6E983EE1A9F0666855CB8A1DF37CF0513D76EC16DB45B2D526CA27ADD5D2
SHA-512:	C12C2E1675766CD8AF2F917095436429464A2924E3D7DAC6BCC171B6044F79E3B02F74A96FAA9A682985A7170C89C971523E78FDF0FCF3A8FC31D42443294055
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...v...\|Fb.f....i.VU[..o..R.Q.S0.......N5c...[@.Y4z/J@...x...}..y.....vD..pF.../...%..m.\"P.-Y%M.V.{........kv...%..*.F....C ...9@..x.7..0.'.......'....f....?.H.h......N#@`8As.4..V..S.F.#fH.....O.C:J+.v.w......-......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.801125559078826
Encrypted:	false
SSDEEP:	6:6v/lhPKwnTjYVwy7FQF3mMs2/mEiacTnTp:6v/7itVwotMsZzacr9
MD5:	AA73B8465CA561B64BE93C5D40813ACE
SHA1:	C5C24DBF3CEE380656296A1F6742CC22DA8BBFCF
SHA-256:	BCB807F5EBFC467B5229460C168FD0BCB615B6A19AF2A21A4B2FAFC59EA45FAC
SHA-512:	392C7FD0C172EDAEDA17B89E4F359AF80C0DDF3962320CB207467CDB72FFE676C2259C8BB5CA02763292280D571D8C6CFB96FE0597CF6C09B3C211FC8F97AD3B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .........\|F..T...U.D!.....1#0.2...S...]..G..(.....o.`..U..kG.&..D......Co.@. ..F`._r"E..... ...4.%.....p.k...><.....l\|..\|S%.I....qQ2....3.g.t.Q....._....8.......i..n.Uv.P...b.z<........6.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	248
Entropy (8bit):	6.73866023306037
Encrypted:	false
SSDEEP:	6:6v/lhPK8hrEq4FC/adOHXOQA40vLYgbU2Cm93u5tQuJTWvXsup:6v/7ii/leLXU233uxWfN
MD5:	CB88671AB7E9842064B18EC64C186FCD
SHA1:	C872F689C719F030BF317AFD8F1A77A5EF5C9898
SHA-256:	1C235A5B02E1A47A324B579676FCF86978D4EFCDF3E08A52A4C821FFBEFEF038
SHA-512:	FB02B1741FAA1DD4AE83819579F4DC6333B8519ED1D4CFF5ED4E217FC1F788687FF5E1119D01D219E1446A9FE13D48F51504A1200C0B8C078BC0D3055716FA13
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0...F...+...)=Q..A.;..z..Q..Rk]2....$K...%p......>+ .#...+"........#O@.......H...O...CA.......[.....>....,.z.L>...%..$.H..3.J0..5.D..............,..........p..T.en.k.z.n.(..........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.889445960771781
Encrypted:	false
SSDEEP:	6:6v/lhPKp5VOWm2mU/v03ilj/L31QqBiPdJctqnDLbGG7/xebp:6v/7i0W5mj6LFQIiPdJcQjZE1
MD5:	A679261207750BC4E70B8CB07BC94F3D
SHA1:	417BF26712269CCA7FDCC9CCE1D5E9335E78D029
SHA-256:	9D3F2BD7A6286B14CA2D774CCCCFC2CDADD48CBEB3B786E6BA1E8A80487CA8EC
SHA-512:	CDA73A6643D67E3E637CE7FAA004587D454114ABF5BEF834B01893B4803DCA56FE8F352FFF6C16B47A853D606D631948AC9BE55596CA6975BE716D17F7C967B0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.........!<...dM.-.ql..?.!8..-+.R:.h...h.8.....\|.M.4.....x..p.Y...f.rn.K`w..#....T'\"_n.W......Wr..P.....'\Z......$.$^V....*.b......#.....S.]u....A.....WW...$l.mE./..j...).-.>.(8.T..,N..`....s....`..'.`....H...).UT.IV....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.776388230305586
Encrypted:	false
SSDEEP:	6:6v/lhPKdQvlmHT1xXD83/swaLoAMhKGodc7b+T8lfri9YjVp:6v/7iK9ShWRAMbXzt
MD5:	2215F6E43F450B0D2DED73F18CE7D77C
SHA1:	636ED3A0F82D9551405DE33142EB4B11B79FDD03
SHA-256:	2AF6B42944F6E31EEFC4CAEA23F1778180EDA97EA2025D1CF15C538313919F65
SHA-512:	0324357129C075B7E8F08B55767098C1E779F916EAA0007835A2DE6C8927F43C80AC6DA94133758955AF1B0CC9F1EDA01E12F7B387B886F6D417E4534EBA7750
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E........l...!.t.....[.. ..{...Rng...g....{B.Y4[.%..g.<.U..+@.p....... ...p.K@@.F...@V.5..<.]...>.h ..D..n9.... .Up.@s.[.@..#r....o$.`.H.&.....O .^g.1]......)@.F...^D..p.........{^..=EY.8c...p...gN......@..@....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	260
Entropy (8bit):	6.904967196553251
Encrypted:	false
SSDEEP:	6:6v/lhPKohy3Zsqo3Li3uAJLwnX8x5nfSjG0X+pkm3QZNwp:6v/7i2yyL3Li3uQrnfSj7Os6
MD5:	6D0A9B929EAE8A64286779AE4EA724B2
SHA1:	AD35DD047C78B9A2F16064199D2B5D468550CC77
SHA-256:	CB4E010EB9B574AAFA30FDF644F1AFC293036BDD3ED7F17E607281EF34E1B4A5
SHA-512:	709385601389E195CDB31BC3868C13F379FC70E199E575205C3B16A6B260C81A107B73E1E058C8CAA286BD3B3A13A11E0456560D783B9562639719B682D38815
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...f...\|Fb....^...........1..R.A...3..s.bWt.Nv.Y./x.]....xT@...t.n.@:.#.=..IC.........H...w...C.h.<..,...H.{.Z..2.Xp....<.w....;.Jj>?..,..Q..J...r...:.-.>...]p.....4.,.3^.c.kH.0...........?.h.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	278
Entropy (8bit):	6.953144423432275
Encrypted:	false
SSDEEP:	6:6v/lhPKKGT2txPeuxOjk3onLk/uP/V7ivyv9XcCimKNRk1X3wXTp:6v/7i8JxOo3ons+73v9XdYi3wt
MD5:	CA7EE560DF667703A9CAFAE90F9F8B36
SHA1:	643F92E6653D8B3A48526E124AC02CCCB56BFFE5
SHA-256:	25B1D2D376446B40C3976F303C6307E399F105B896640A48A449842C52F87C5F
SHA-512:	122A8C2B294CA7760A06345C348D2E4CBE66D9D4F90A10752D89EAD9D9A9A044BB2DE736CD79B887342D3D72FA93492D711FB39323B2EA5EA0D743A7DAA29FBB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@Y........c...<Y."....P....,P.9#..2..g.....W.1..Fx...^.c....W..q.M......o.H..&.E{x...p.@7....S.h.T....Z0.X.g'.$.p>..7\$...!....u....-.:`.O......k(../T..B..q..~..a.y....8'.H.........n.........A=$Fv.,.7{0.TM.+....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	279
Entropy (8bit):	6.8723200111750025
Encrypted:	false
SSDEEP:	6:6v/lhPKJbhy59QmgCOotngJKhq4QaUbOWTv55zNKocfbEsJ1Xjp:6v/7izy5hgCOol8K84lUbODXTnDXN
MD5:	9280F141EFF842A0F72A81877B1E8BD2
SHA1:	6E88278CB835BC384766C5F9104547326DCD1D29
SHA-256:	3CFB3491AF402499F8A0C4FB00B36E3E2ADED0F44DF81E29F3404113040E1D2E
SHA-512:	DD6A376EA81A629FEA4F8F9419601D2035356A408A153374CEE4FE260476928036BB5EC27595E7AE928D8C4B54B1F748D82D7010D36A4C85A070F3F55A4A63E8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...v...\|Fb....2Y...........P.S0...R.G...%..Q4[.%..g...].....W....t..@8.% \#.F[ .......iBY...4.n."Y....m.UO..*.E.9.-B ...9@..x.7..0\|$P......'........\... c...g/".n8.........=.b...,..1Cj.8kB>.....dR..<..;.{...Q....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.895917728128201
Encrypted:	false
SSDEEP:	6:6v/lhPKiWhirQDeqCJPkikDqufkTvnAWOxUEM00b+hMllH6x6Lj7p:6v/7iiUi1VjkDakWOzM0V2lHZjV
MD5:	7F7DD35656DD3C42219573E378E67971
SHA1:	15F7107EE4759BAF1C0DCC5E879D16C4CEB15E44
SHA-256:	B5DA69DD0E0AE47ECEC41FC0FB8E1BAA3773E3CD0EC234B2DECCA8CAF7A2B7B6
SHA-512:	3C48700B4A400551C3E346DE3751A2FFBC7042FBBAF276AA9CE45D1DF1399C630F622629A8A622F48947E384C41C05BD377EB041D55EF2CBF50C6D5476F58752
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.......p..!2C..dM.=.um..}..)..@.I9...8S`r..v.H.a./x...9....~vH..pF.....H.....6.E...%g.....C.....+...nBM..e>..7\%P...!..g.9@.r..74.P...%h.\|.\].Hx.5!-........l4...BB.... p8A{...V.;wC..r.v\|..$......{........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.825061185302694
Encrypted:	false
SSDEEP:	6:6v/lhPKahy3bqXO2jInj7Bnna1qsOq7tExpdO2T9r/Yr/ssup:6v/7iwyrqXtInFna1FpyxxN/20sc
MD5:	75A80DE50483300754ED47DBD434412D
SHA1:	3D0DE35F55F6945B2478465711063901A4C674AD
SHA-256:	F7CAA1D98328527B7B2842802EE422E84E965B898AEE0382403C70C8594E994D
SHA-512:	B75670CCC94DCAA5F04E66F16F91851B8B106ED3F0CB852F2FE15541B86C7994BCD59348954938AD416F155EEA12A7DFEE956AFA48F37E12FBB8B98D943DB73A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...f...\|Fb...2Y.KU.U...9..xO`...R..EuR..r....Jx...........0z.@.....5.]..j....g.:.$;...'... J.[r@<.Z.w.F....C ...9...x.7..?.....\....&.L..@:.S.........n8...........p[9.C.$..{.....5...%r.5..]$....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	268
Entropy (8bit):	6.869854877571533
Encrypted:	false
SSDEEP:	6:6v/lhPKZQv9njENBR+DaqE0uUlFiIbQJAM5v8PQhU/2s7hB2Dagp:6v/7i2lYwDxuykemd5v8Pu0hB2Daq
MD5:	F4920EDEC5C4B472E64CBEB6CAC4EB52
SHA1:	6FE651E8F844D7D34FB2CCB8AA96B70ACF695E0C
SHA-256:	1DF0D9012753D1831146C1217B25AEADE11D57D38A5F33C0D2BE69C9549CA92E
SHA-512:	75E0FD265E33BA71B753B3B1BEC88F95C85588099C64D3E4FBB3058D9E9B0F0BC5B929953CE9E29CCBCB71DD9885597CDA00835F94612F6720F776BC3ECD545F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .Ei..m C.93C...le..<.....C.....@B..{....`... /........K@..i..?;$P@8#..p.@.$.E~y..G..@.....M.kxS ...YP.X..nBI.%a>..6\$.'.YC....s.&.q.oh...f.....\U.Kx.5!-.?........M....r....N.^..>u+f..=.S..]...c.....r.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264
Entropy (8bit):	6.864184850876826
Encrypted:	false
SSDEEP:	6:6v/lhPKshiZxwNNTnFO4/qJ96VFctsxWcY5IN9wR1cJnCUollbp:6v/7iSiZx8NTnEXq8cYmLwReJnda
MD5:	E0B50AC19805452B2F9770CC037EE316
SHA1:	3073EAE8F561CACC328EAAA851888491672E7713
SHA-256:	125C4EEA271C05162A9721755B63F94F71521B81999F63AAC47A55FE9DCEFA45
SHA-512:	2937504A848167FDDEB08CA2428C826D90988BFBA01655C7B6500044D88A2DE788B729F5C0CE80F29906FA88D426278AB47FD2B9EAAA82C103427F99FE04408D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.EY..f...8[...!.5.TU[...\| '..)..Zk...:5E..H*..W.h'<K.....^...{..........-........5.....i.t.....P...=9 .p.@8."0...!.....`.q..v...zR..<\T..&.J..@9.S....._...n8.......e.........H..K.1.1...y..9.a#.XM....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.830314203316491
Encrypted:	false
SSDEEP:	6:6v/lhPKinTjYqfo8r9mLXDDuL+RmEiRjp:6v/7i/qZRmLzUxzX
MD5:	64E5E6A214C8B52DE0CCA815A3056ED5
SHA1:	E16EA05E02E90E8F46CC00FF2E46CA098BB96AF3
SHA-256:	5A4D998848247BFED011F3A757E390FE5CE28126EF38F5ED92F551765F847965
SHA-512:	2E4ABEE556B56F373F93068E9341D6F60FC94D51035E8EDA47A9A7308B4B0EC3CDEC42C44D6B837E19A2D62CE1DF3EA03E9421F0F05E08EF1B214F68A279D72C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .........\|F..T..%ZmV!.....1#0.2...S..r,^.Jx....o.[...n.`........p.k....?k O...#0./9."..?.....Q.........5......Qp...6>...T....A.sk\...".L..@:.[....._....8.......i..n.Uv.P...bO..r<..9..A'YVR....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.887907754498353
Encrypted:	false
SSDEEP:	6:6v/lhPKL1yjrVFCPqS3+PXWFmwtmvAMrv/Spib98up:6v/7iZyjrVt4KHvqoT
MD5:	0976AACF921E3A5904DDFD676261E416
SHA1:	7166AD897FD79DB34706C0BD06F45CAC2C31F351
SHA-256:	382F057A1ECD286911BAF1DED6714099C00B9348509B4B82DD2A1226CFCDA197
SHA-512:	0210E9A13CD6F6EA4FFB864F0A58B0E0875A18B3717304086324EE2393847407A74F3A01B7ADA6AB293190581B851BEF69742326312264CC221D34EF6D64226D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F...f...\|Fb.L.$..j......7.{..!Skm?j+...7..x...Q.'.?]o.`..U..cG.&..D......M..@. ..D`.Or"M..... ...4.%.....p.k...><.....l..w\|S%.N......E..jB.....?.X.h...+`...0.N.\........0T@..X......q.A........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.826178403380507
Encrypted:	false
SSDEEP:	6:6v/lhPKVQv1yjrVFIIEgqS3+PXWFmwtmvAmX60ynEpbp:6v/7iCdyjrVPPq4Kf60R1
MD5:	64C4034DBC88A97DC4B791026C395A3A
SHA1:	3BE4DBB7BBC53FF329454CCBA4949E3FDA7E714A
SHA-256:	AA0CAD512C61A581676B0FA2407EF0741054B5CAC1C4021AFE88925CE4626829
SHA-512:	8B058FC42FE866EE2ED3CBE7BC8F433B20F46F9560BF3F201D964F47A9A028854F1FED31FFCEACBD47EBD3182F15E2D0A66390C46718B1FB4D7612B73A253F60
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F...f...\|Fb.L.$..j......7.{..YPkm?j+...7..x..*.Q.'.?]o.`..U..cG.&..D......M..@. ..D`.Or"M..... ...4.%.....p.k...><.....l..w\|S%.N......dx_5!g......l4.....w.i...'._.....[.4....O,.~.z.....ex......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	249
Entropy (8bit):	6.786372750429126
Encrypted:	false
SSDEEP:	6:6v/lhPKaWhrEq4FC/adOHZA40vLYgbU2Cm93u5tQuuOVp:6v/7iaU/l0LXU233uaO7
MD5:	990CE562D6F3B1E20EF442CC10563266
SHA1:	D8C8E115E0FFE455C7EC10F3F08A5B18A5D3F908
SHA-256:	9FBD2FA961FAD60EB429C27770AB6CC4FDB32FC5AC885E52BCAF0344F3B9D69B
SHA-512:	D965E1AC24D7766F7163BE1DA0A69C5E47E5DA58375D86E38372DC272A0C882942DFE086D873A37BDDFCB486463D613137C4A72ECF3E675B27A0A26AB4E97EAB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0...F...+...)=Q..A.;..z..Q..Rk].Z.....$K...%p......>+ .#...+"........#O@.......H...O...CA.......[.....>....,.z.L>...%..$.H..3.J0..5.D..............,..........p..T.en....e6...4......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.876040338918435
Encrypted:	false
SSDEEP:	6:6v/lhPKAGwdQtJ8TPJD0ZIXwt4l2L1H+KSSHhYup:6v/7iAPK8xoZIXxl2L1eKn
MD5:	D8616A80E310A1F4F5EEFF602C95322C
SHA1:	47F4618C0AC1B4622C9A0CBC69BDC418E466321C
SHA-256:	5031CCE66CD6416444E71BE0D50FCAF99E8C40E71FE35725A335A6A8424FEF27
SHA-512:	437834A895EBD070972D96F6164892AEBA4F4F7E5CF96EB06E57C0586DE869AE7471EF5B28B70210C2F74FB0BB128E3E0874B93C4C78B021F19642459A037B83
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...v...\|F.......Z.-%6.../.........Y.EU7...%..,p.....W ..a......A."......-....."....v.z.+..w....fAS`......NY.@4.%P..%B.......x.7..(.{...>.?.....[MX........o..l....D$.....0...`.\|h*....\N...c..........\|....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	260
Entropy (8bit):	6.826196404715892
Encrypted:	false
SSDEEP:	6:6v/lhPK40QTQpgHhNFbaBXlmBKeK/9Wg5B9PMbp:6v/7ixqQMhbcIAeKMg5Bm1
MD5:	2A4AD5B92A21AF15715E4B3F5EDFD931
SHA1:	29D966CED659BAA03229A59E4D38243A686EF918
SHA-256:	C7ED1E78A548064417DF51427EA65B1FB1CC649F8ADC2BFDC6C5B9D630E2499E
SHA-512:	B9ABE711C754C5FEA8FAB9CB8C03C816EC29FCB00E7F9B53C74D694A6A3989F80846DED73BEC551DDB1DE5E18C2185295F3C3FC95A46FB2189D6108589039C2C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.......p..!.!.5=.....\|0..{2..l....GVm..\|.e...Q./x.n.y.....;".A8#....p.\|..@.....^..B......."......UK.I.\|F....C ...9@.v\|.....>..A...p].D...sL+.....g...4......nF..p...ep..3wC.\N...cU=..M..R.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	244
Entropy (8bit):	6.776460387717311
Encrypted:	false
SSDEEP:	6:6v/lhPKRQ/GtJQwQTAbr5h1zsd0i8dUWE321gk0Zs7hM1Ejp:6v/7iOuQwQMftzsd0DE3Qgk0l1EN
MD5:	CD7B0B39EA2288C6BC0C363B667EE2A3
SHA1:	A4D3FAB4165917DCAA044D86576D66C2A06613F5
SHA-256:	803C72C12EB990D1EFA8A9B88AB693CD06A8F61052AAE254F1691A06262C47AC
SHA-512:	E4AD3420DF515E90E7A2D391C9524683FB5087C1CE9A2E948E1244C93FA82E6701448E0C0B9BCF8FDF072810141B33381E8C64BCB7BADB466B93CDD38DC71497
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A.. ........../..c.(e.%.ze&.lC.9/3+...d.@..%..................p.[.....H.h....>..!..&PA8.Da..PO.U..n.....!...G..`;..N3.o...>.....k.%.~......8h..W ..g..0...A.......*....w..m..-P.'!....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	265
Entropy (8bit):	6.845216909119255
Encrypted:	false
SSDEEP:	6:6v/lhPK/r6QetEBGS1nK+9wqNp2vAWb1UsJRx6AaVahQmghuuAap:6v/7i/Mtu159wRIWNNaUQx9
MD5:	E28BC806FF76A5D42A48160455FD6669
SHA1:	B0617EA5B190450E8E76DA211585FEC154D87BCF
SHA-256:	4D16F6548E13E51FE9E9665EBCC07BA6F34BB9EB0792AEAC8FEB7E7DCC2FA2B0
SHA-512:	AF67DC7C7E69130A0B714173EACD896E23757EF2793539032EA83061E30DB3142E0534FCE09893A4B3FAB61463D59FE885C3FD319054BE4202D6AAFDEB7DBA50
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.......p..!:C.kr..k.?...%RxO.`.r..x%..\|.E.H.n.'.x.......~vH..pF...*..H....3..E...%g.....C.....+...nBM..e>..5\%P...B....s...q.oh...a.....>.....2kB...9.w.?.H.h.....N%@.p...].[1G.......c...l....n......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.901740058701858
Encrypted:	false
SSDEEP:	6:6v/lhPKkhmjorq4WCGxueoR4cyQ0LdpK5nh05g+6PSIi/uckV/lp:6v/7iaJm4WCtziNnLW5nEguIcA
MD5:	2449B01E4E71B2EC3A703F7B72F5AA7C
SHA1:	EC44F12BADD34742FEDBD1ED828358CD815A0F08
SHA-256:	DACC268C316562370A9B3539D74E542FDE0CF9B383A49A83D4125F4BDEFEBF34
SHA-512:	D6A72F181AC8F472051F58B78E49A727F3F0F1DCB2DBDED74F6FCEBD3125D0A31417F31B05EE248F462C33A3A369FE233C3DA6482BF0600AF705CBC1E1F37CB2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.......,....".!...\...$..k..H3...r..L...(.W.j]....%..W.z..y....n;".A8#........6;.....t.JvI..,.L..pU..,...H..Z.hd.5...o..Qp...2..;.....3...>?..?.Hx]=...-...)@.Fs..~D..p.........-.b...4..1CJ.8jB>.....Y'.m.Q......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.880268793877924
Encrypted:	false
SSDEEP:	6:6v/lhPKahy3bq7LU9ajzJ0z3nMlkYoJOZtuvxVLrFItjp:6v/7iwyrqvMaKzX6iOzuvxV1YN
MD5:	C2D3FA5D204C2EC2DDC43B95337CD6A5
SHA1:	E22D21427F0348ADBE3B1EED91A4A9BEB973B1AD
SHA-256:	656C74FD1264E06FBCE84E2BFBA48C1B8CAC5B8A8132B65C0154C64659009CD9
SHA-512:	22C0BD4DAB85DB8781291494A5034922602B6507FE60EF2DF4D4AB0E9A864096468DD8BD6F3D7F1A2E348C44E4A0F3C36C2C1FB33DCA3DD9FA337C6CCC8AD873
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...f...\|Fb...:Y.K..Q...9....).#S)..d7....-(r.G.h%<J..........0........p.k..f.4....3.....).p..@..P#J.[..x...p.@3..@.\<......i%.I..5......uT.....H._.XYh...-`...0... ....n+_.P...b#...G.m.e[}....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.834625753471503
Encrypted:	false
SSDEEP:	6:6v/lhPKdQvnmF6nQFVC/TwDOW06+hk/1LhO/xiWV1JH0zqk98p0pp:6v/7iKHneVCo06e2585i8kq+8Wn
MD5:	A75E74680FC85BF5C8DA48875F460D0B
SHA1:	344A883643EA55618C3E1D0DC2F5C8ADB0A63E23
SHA-256:	32D236C32AF90DEA9F620FE193C48086391F62E10CFD297C799A2E2978862EFA
SHA-512:	E78B228C84CE8476BB4544732966946ADCE434C428ABF94D1F15C0CA112B1514CE0F236B2167585707C32DCE12F5C231D0994D1F74364754C8A8C3180B817D13
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@Y......>#1Df....i........!".'p.N9g...b...#(........&....X..8...`\v.@3.."....4....7....h._r..P .>..F8..t.V..I(I.".O$....T%.z.D....r;>..T.........{pu.".e.....w......0.<....8'.H.........n....P....`P... e...O.<..+..0....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.919545488746067
Encrypted:	false
SSDEEP:	6:6v/lhPKK0Qc1AoNN1YuVXZV63ZxXgh3Wndyk4d/iA9B/lVp:6v/7iHb1vfVXZc7XM4wqA9Bt7
MD5:	B0EAF6B35D911DA7578FB9629EF0DB85
SHA1:	4F5DE3F0D60CD85DE4129DF3197E5AC1EF2B3390
SHA-256:	A0A58CEFE025E331CED70A67410DA43258F482D0511812C61C4DA062EABC293C
SHA-512:	805775B78E1B61F3ADB5A6E672993DE8F74801C2C460FAF778A7E34DC993504ED7863AB0E77F6135BB243A9ED143306A5EDF882F964C719E46043D0F21507D94
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.......p..!.!.t...VU.9..F=p~O.......u.-P...,..<J....- ..U..cG.:.gD........o..H.\#..+.5C(Y.@..SA$Y.[...j."...4#.y.D..#...w\|#9..G.5(\|~..3.Hx.z.i%.[`9.S.&...~.#".. 0...`...+...3.S...XS.....m.3......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264
Entropy (8bit):	6.863099650039103
Encrypted:	false
SSDEEP:	6:6v/lhPKshy3bqXH7g69nnVs3lkYoJOZruieWt17H0EkKqkfp:6v/7iSyrqX15nVMiO4ieWbHaux
MD5:	E2F8FD29D6B3A8B4980826E0D93407D4
SHA1:	F3EA68E110378BDD1A381CB80212D9BF61506218
SHA-256:	C8267644BA1FA9556CD973DFD0A864EE76E6D84A67E55B232C6D2D7855E38A18
SHA-512:	304391E768F598DCF8A1A33F1B660B3538B33FF40A91EFD45A416F0E20CF8B3BD562418D9AA4374AC8940864D4E97BFFDAF799163543B33587209ABC07E3A906
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...f...\|Fb...2Y.KU.U...9....).#S)..d7..].-(r.G.h%<J.....V...[....@.....5.]..4....3.....).p..@..P#J.[..x...p.@3..@.\<......i%.I..5......uT.....H......\.[.....`.9AsA.<.5.V.....5...g..<.....mg..a....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	248
Entropy (8bit):	6.771723664270935
Encrypted:	false
SSDEEP:	6:6v/lhPKMlYzygf5N1zBDyU34ZRkvOCgjXcZP0s7dp:6v/7i/hytz9Kz
MD5:	8C2B80FC1162124C7FC1D10AE3C802E7
SHA1:	D0803816B5BCA31E84FF2879418E5592E5E00393
SHA-256:	07AE7314A1712D00D802382E2B91B94C22DA079AE4A5D4A23C183288CA7A2C2C
SHA-512:	D8EA9465B5D1B2B07C93E7B339E00492B4D079147EFB49AFA51FBEFE1BF9D0E78AC063CC38375E717A72B3E66AC749DEE618B9A669C689F9042545DBCBFB26B9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!..i..i......).%..N........2#l."...J...S.K`.....+...._..........p.[....?....3..\|...B:.N..p(...+9..p..;."....C..W....v..v...)\|~.W.....J$...?..q.\.W ..g..0...A......mH..'..g...n<.K..`....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	248
Entropy (8bit):	6.76523317848692
Encrypted:	false
SSDEEP:	6:6v/lhPK8hrEq4FkOHXOQA40VkKBRwCb5Y1m9TOXu5tQuJLUp:6v/7ii/4xSBG0ZOXupW
MD5:	F23E443202473B74FD7D6B28DAEA8EB5
SHA1:	C290E4FBAB36A419BF90D8325EB90D9A18B3B77E
SHA-256:	984BA086B36A5543B5D43655663C6E28F81B281721EC9BC8F5256684568EB6BB
SHA-512:	03A637DC6BAE92EF492E6C1506B54F090B16F22E1FFFA2F2C3CBF970C8D4DB571CF344D200C767B3E76540757048631E65F8B94CF7E62F891C635878C9227865
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0...F...+...)=Q..A....z..Q..Rk]2....$K...%p......>+ .#...+"......7.'......K.....'... ....z...p.@..w...\=r@&......h......ooM(....p............,..........p..T.en.k.z.......y.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	250
Entropy (8bit):	6.826918313171769
Encrypted:	false
SSDEEP:	6:6v/lhPK+ZJxH8T2J71KlWVE0gB4BJHUOhoR7OZ43Tp:6v/7iofY2tu0gB4BJPoRaZ439
MD5:	ABAF597403344ADB842D3FC660E890BB
SHA1:	2810BC8F30EADB5ABE7922B30FD412058A39D64C
SHA-256:	5F7413B45CB36FC7D3EC7C66E53EF8FF8E377174211DF6D12FDE7DC870C81D34
SHA-512:	07D02810714DA844AAC4605A94FB924D112398CEE9ECDDC088BAF61BB2E1EBB22F02269349157116AA992457A54E1838D1132C5CF898D14C689EA6DA127E95ED
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A.. .D........;y2uc..G).)q.-.iH9.u.eV%.......xa.@<...^;".@."..p.@....*....G..O.!CH.?.T...Q.\|$...n.p.[.. .z.....2.3..L..@!....J...6........b.4...+.....N. .....mH../..{j..8.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.82090333904262
Encrypted:	false
SSDEEP:	6:6v/lhPKinTjYqfo8r9mLXDDuL+RmEiiw/p:6v/7i/qZRmLzUxzii
MD5:	7FFBE34E8238D64970DB4CB560EF1F3A
SHA1:	125528719DF37BD4B5163BC265D349EBE83A2836
SHA-256:	383AFF2A0D2F030209B212905543A66678A1E31736CF91560F29FCB0D6A67768
SHA-512:	D6BCD12FF408F6AC27EB6F974E70B4A0A98063CDA304DD05843DD23B58E14DA95666C70689BA861372B24528B969C5EE3741B9B13D91EE142AAFE82356573B84
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .........\|F..T..%ZmV!.....1#0.2...S..r,^.Jx....o.[...n.`........p.k....?k O...#0./9."..?.....Q.........5......Qp...6>...T....A.sk\...".L..@:.[....._....8.......i..n.Uv.P...bO..rD..8...d.n.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	278
Entropy (8bit):	6.868726242783896
Encrypted:	false
SSDEEP:	6:6v/lhPKKhy5B48CC1YF5OiOqlHXeiBJ2njZ/EzuZJ3yD/kVKaytjp:6v/7igy5E2WkiOqf6FMzuZJC2KVN
MD5:	00E0F6F4498B2EF212E62DB66CDE473A
SHA1:	00F3E3BBD385ECBA040586A000789CFF1D23D42F
SHA-256:	6510E4CE49BF935BDE4E35E3623005F7FF8F535CF23ED0A24567ABC92A4007EA
SHA-512:	30E2B79C07AB13A904285848B19BA0ED51911E3A3A6E932D8A45C442A3C30B0A2310A39ECD2A3B3179AE4C9E336E212F3F137DDF8DE5848AB4D272F6007D1BDC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...v...\|Fb.f`.L.Dj.m).\|...D.......B..)..(.W.....M..G....\|Z..m..2.gD.....E[..\|/.@....d.H....x....K{AS`.\\...JY..5\%.&..B....}.&..n.P.@...D...}q5.<.U.U.....x5.C...f..>H..T..6'h.X..z....w...9../.m.AH.8..W..W#.W....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	268
Entropy (8bit):	6.827557450206243
Encrypted:	false
SSDEEP:	6:6v/lhPKZQvR03fytMWiYGCiD2800ZghbbPcoGCV0hyiuPYp:6v/7i2J0vuiIiDjZghbbhV0hfu6
MD5:	1F405ADBC496C2B8A3EBE6C12D23025E
SHA1:	B484944CC61C08F2524BD33BF2BF179775C3CF8A
SHA-256:	2DE3972FDC2AF73735B3E2A448C8DE6EE3688047E2F9137DB2172DDF878767AD
SHA-512:	A1DEEE68F11F98EE0A2BE78069485AE9369085DA9688A38A9B67F0CEB11B333A4D49671E9F6DFB102FEB654A13D70549A3D75B27B7CF515F7C3BFD46A2E023F8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx....B1.E..]..H..I.`..p2......^(...s..(.\.d..(.gQ....%.......\|U....t...;.% \#.F-.,.F..G.k.P..#...MA$Yp.)..^].".[..".y.D..#.h....Fr....jP..\\..".uv..N...v.......>{....Y...'h/.._y.s.n..)Gn....dR.....a..........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.822376272674029
Encrypted:	false
SSDEEP:	6:6v/lhPKjbhmaIE7d0xpPIucVC1a6UbyaxWrVkwNHYHYTp:6v/7ijNQMd0/A9w1UbiVrkY9
MD5:	F9ACADBD8FC327C8A664C6607D8415AD
SHA1:	819FBE6D21654A6D429439DF51F05F6DB66F6004
SHA-256:	CA22631718001D8DE0599236CD66E231FD1740780661B8AFEC0FF18BAB48988E
SHA-512:	EA804AA2A1B150D3CD940B9A29B62860083FB1AB8E7069D86A1A88056D94129D7FD2131667488F95610CE67BC63887F185BD9AA665BCA26DF026416A8D5089EE
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!..i.......F...p.].$:..k..zF`..Z..U...Y.K`...x....$..............[.........+..\|...B:.N..p(......H.U .n..Nx..`.5"..y....;.w...>?..$..l.%..-.......g.@..." `8A..48c..;.!U@....Y.I-......}A..=....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.879167108737925
Encrypted:	false
SSDEEP:	6:6v/lhPKAWhirQkOKamH4+9wqQq8g0vqdD85Kxx6AaVahQmghuBlVp:6v/7iAUiLYmHz9wjq8g0C9taUQxQ7
MD5:	8FA047A7F518DD2BF74EB1C0331DBB52
SHA1:	258B002EAF1EA86E9E7E88424A39210C689318D7
SHA-256:	86A2A7F3AFC7B6BB61A0EA34B9E0B0DF383BA20124C75D7AC07D35C3AC2FA6EC
SHA-512:	F5E61EEA0ADF02FB0E62478DB6A496F0489F50E567743F8D0FAEBF36AF79FB0AA4534659E311EB9E32159FD5FB2DB5BA372D5250AAF400B9F1C3586D168C2811
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.......p..!2C..di.=.um..s..)..@.I9.G`..19?...$p7...x.......~vH..pF...*..H......."..........@...Y.....7...2.J.......j!..g.9@..x.oh...a.....>.....2kB...9.w.?.H.h.....N%@.p...].[1G......v\|..1.I...............IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.845052608683543
Encrypted:	false
SSDEEP:	6:6v/lhPKdQvhy5RTtJbZPtbvXd9PdBz4DGJM6t+Iflp:6v/7iK5y5RR1d9PLkDGJM++kL
MD5:	C25AD6BF0A65DC0CFC83AFC770DAADB5
SHA1:	68F428983A9E096264A4DEAADF246FDDC002E308
SHA-256:	30D79C188A711F3EEDD4BC63589CD9320753D747F594FB48969158DA8FB03EB1
SHA-512:	A80F4963B6B319FB58DCF467B82A19936431F9BCBA12692C51354D9E1C61BA874676FC0D5CDAF797E0098BB7DE90F9E4849BDD3CA16934E075F1AA72E9E185AE
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...f...\|Fb...2YS......o..R.H.)...RJ.UG..X......P\|...E...Q.Ox......@.oG..gD..~.........F..G.j.PV.[...........m.eK....@1..@..=r....o$.`xK ......O ..{.1...L....`...{/".n..........-.b...F.8b...p...GN.:..@..........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.815027024582564
Encrypted:	false
SSDEEP:	6:6v/lhPKVQvhmaImxqtmFD025zjiAwigFbK6ywZREQxgu3BwK2sp:6v/7iC5QmssFD025EFj1Z2QxguxHB
MD5:	DCC935864C92540C370165B5C96A1812
SHA1:	26EFF919B3423554A45B0245BC06D15F13FB051C
SHA-256:	A0AD42925593E04D109C8384EC5D71BC52B1551A1C9B277C26462EBD36A88E30
SHA-512:	50889A3331BF95105110681330752071EF56DF07921092265BB3CFF9B61419CBDC7886636F61467E71CFE07554746EC7CBBE7F986F11205D2219B2C81096FE04
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!..i.......F....RY..(J..{.._...-J..q..B,.gd....%..7..H..+ .#...+".....K.?.....+..\|..iB:.J..ph...=s@#.V.p.E.;.=B...9 ..x...~%.H..gq.dx.5.d.....bl.....Ht.Y...N. .....mH.P.....m..:O....N7......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.789121098758503
Encrypted:	false
SSDEEP:	6:6v/lhPKdbhirQMqtNOVO7Yup4nS/5znugbgF/NtVdy191Vp:6v/7iPi8m+r/tnugbghBdg/
MD5:	DD8A5613BCB9FEF4827C0DA2C5196B68
SHA1:	42A7CCFBE09BE65E9BBF065FEDD22B201C7EB473
SHA-256:	96907685E63F89CA9890F29110F24865AFC8BBEEC08F42F62D2847CA37576444
SHA-512:	6881B213B14E92760E8D45DB1C6BFDF76203EA31F322273CB1D0D75784132E2CB9775F779C825D69A3C9C244FEEC7FC000222A96FABDF5C3F791BDF1666DA5E8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.......8[.....t.&.......s..)..@.I9.G`..cr9...f.n.'..K@..e..?;$PA. ..p.@U$mE......S...%G.w...]...ggAS`.\|..5...\|*.k.J.,....\,..-..;..9..%`..s?....p.5!m.......R6..\|x!!.S..8...`.\|.V,...D.....#......m..w.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	260
Entropy (8bit):	6.8104382450718495
Encrypted:	false
SSDEEP:	6:6v/lhPKohy3Zkn+jeLnkmw2zxz3PC1qsOq7tJgpxATdifuaVupttQp2up:6v/7i2yzj642zBq1FpoWsfV+vc
MD5:	59E5656DBEC425CA05405583501D11F3
SHA1:	7F58FE8E8342B802CB7BC180C9A44DD198836596
SHA-256:	6C42C6147C6A7E4C8E4798388A8820662C3E75183BA7AF823F8E10549F8D72AB
SHA-512:	B002EC07BCA85C85AD6DF420A6A6EC2F768F15A084167A363FC9C050254FA9A81B94CD157062E49B2C694EA946F62CBD1C26D940E95ACF1059ACBF9837D73496
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...f...\|Fb....:Y.KT5Q...9..xO`...R......e/.....(..^g.[...n.`........p.k..f.j....g.:.$;...'... J.[r@<.Z.w.F....C ...9...8.V..jP.\..%...9../....`e...G....N#.`8A..4x.4.VN.P......oc..5...[....wa.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	269
Entropy (8bit):	6.894303524564859
Encrypted:	false
SSDEEP:	6:6v/lhPK36QoVVvvwN+9nimdLpKSKhHdAmp8kcS4VnbF8zjlEbp:6v/7iOLdNxLpKHd/qD83lG
MD5:	95B1459986BF33972C1E7D95BCD12FB9
SHA1:	D391CD7ACCC8FB84FD22DEE624DA1B7E469AE9BA
SHA-256:	5F660F4FC534B69BDDB5157D3D20730B8DEE5B1C65A0AC2FADBCA1FC6CAF3C74
SHA-512:	199B164A9AD4D92B3BAB0E7F5B727D44D93F7D5324AC9EC59FA2C2F4BE95C778674F29DC3C7D8642B7D35116EC0877CA7BEBCCC9F3EC543A0DB77922A99F05EC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.......p..!:C..dM.=.ul.....D..).lR..q.-(...(...M../.% ........h ...k.J.)...^<..@.H........7\|(PA.t.t.v..M.i.........".Z.x..b..b9.....(\|X..4\|.....'...6........R6..\|z!!.S..8...`.\|.V..!G.....H..7..mg......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.770502267908546
Encrypted:	false
SSDEEP:	6:6v/lhPKwnaKPPlDmPtPVLd3d8H5Ac6I6bU76ldp:6v/7iI3UP/dN8ZD6r3
MD5:	8357C2843836286326053CD5F3D67B89
SHA1:	E7C2A1BC35678C1B8FC3FBD298874FF286A256F8
SHA-256:	0D99BA631B94E5BCEE49DFF58A7BEC546FD0486F17D8F19F4AD0B2605D820CBA
SHA-512:	702567711C001DD2F709F5F0C38916DD49476900AB7824905F648742AE2074EDB53905FC59D8D7550FBA1DE4FB5D01F41DFE241A9D3BC9AA08FD25805052A876
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!......E.>#.S..%........1#0.2..z.zQ..r...Jx...>........#...."....,...D. ..D`._r!E..... ...4.%.....p.k...>=.....l\|.O\|S%.N`...qQ2\|.3....o.V...\|....4....4...#.a....5.R.x.............IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	249
Entropy (8bit):	6.8108702021163126
Encrypted:	false
SSDEEP:	6:6v/lhPKaGZJx3lsT2J71KlWtMYFBnhgWYrWvIEPFgrJzNvNQUnuIEp:6v/7iagNo2ttMYFBhgEvIEgkXIG
MD5:	4B251A6310C2E8CBF3D9AD1F05EF7DE7
SHA1:	5DDF24CA7D71AFB974BB086016F832A4F7A045C2
SHA-256:	C6298E545E514612D8F490E0C0851C36FDB0D806D5104E3271512FF2B5F2A464
SHA-512:	76AC825E69C717A0338483507D7B2AE56A7A46499BBD2E62C8229E9768C7756EB89B8A12E0ED3E95E6AB4EE2A5B415C78DD81FF430C103998383076D00A7B35B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A.. .D........;y2u.c.(e:%..-.iH9.u.eV%.......xa.@<...^;".@."..p.@...P.i...#..'.!....*...(.>........-.u.^=.Xp....l./..L..@!..mq.`x..B.._...g.1.........Y...'._..gl.e.6...?...j.8J.yKm.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.751573395918176
Encrypted:	false
SSDEEP:	6:6v/lhPKinTjYqd8rHfkOEyv2vs7k030vbnhEQEYftjp:6v/7i/qCYQ3EbnhFN
MD5:	36B4B406E95633B1EF875E6BF64DDA13
SHA1:	2A6E288CEAA02AA67604F008B766B52B31F1E213
SHA-256:	2E07BE0170BAE977C2766F69664C31ECE34B3E3344FA41D2230A3433FFAD6227
SHA-512:	C3EEEC8D9ABF87785C75B89B02FC30CDE41D62E07ECF8B32833599F151643FF8D54B22D3F3376B987FAB970DEB6AC11F0ABF5AD7B5B2BADB5F10DE563C2A1FA7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .........\|F..T..%ZmV!.....bF`.........)ps9.W...%p....V...[..=vD`.pA........O.....o.&.$'...'... J.[r@<.Z.w.F`...C ...9....*.O.=(\|n....}.....H......\.W.....`0...A.<b.n..0T@.>.T.=...l.G.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	101
Entropy (8bit):	4.746062516230261
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrKVlnw7M9ffEE1q4Lp:6v/lhPKwnwIVfY4Lp
MD5:	4FC92C2E34F8AF5B7FA1E2299A27CB24
SHA1:	0F85EF601543042711C2DCA966304A92DA171519
SHA-256:	BF3F0987DCB0DE97C2798CDF5663D8D0CABF90387B235784073A73E664A2F918
SHA-512:	F6B9BFF3CA071CF4CC6F5E44709CEE6D1CBB136B668CFC80774923F2159D2FF16AD268E3581B21B123C7AB3E4D2C2CBCA133FCCE1F8A4290229B52BB13E9906C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....,IDATx...!..... o...3,.:i......................,...O!....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.798566835153401
Encrypted:	false
SSDEEP:	6:6v/lhPKdQvnmF6n2uhWll5b1O8t1Qir5IIM3evrnzrq5GCg1KQTp:6v/7iKHnjYxOzi+3qrz25GCO9
MD5:	116DF4263BC8099D682896D5AB9C71F3
SHA1:	3BFDA8B023AA7131F3FDE1F470BCBB54DC65BAF4
SHA-256:	8D4E41ECC38E5613DECEF0101958D9EC3A5C1A5FCE2CCE5A64141B556DA18456
SHA-512:	4ED8535C51F255A95C804666ABF75FF7EF5D651F91992FDAB2CC454F0B05AB99B161FB9400CD25CF129913E9DDBBC257FC8094D9A7544DFEB106923814FF58DC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@Y......>#1Df`.L.R.m)...9D.....)..8...q........1=m......9V-..p.....$.p..x.E.M0.(..G..g.4./I}?...O.....C.Upv.J......x.E.U....Qp......\|...>..T\|....@$.PI...?..j.......N^H.9.D.`,N..`.\u+F.&...p.....o.3.C&......7..`....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.865847402190187
Encrypted:	false
SSDEEP:	6:6v/lhPKAWhmj7h0EWCGxt9tXAXk5D2ucFNrdTVNAj+6PSIi/ucEBEshbp:6v/7iAUXEWCgF3D2XNr6juIcA
MD5:	F661E2CDB035F7B302ED617C0B7BE954
SHA1:	F0E957EADF1A4358DA967655CCC5EC45DDCF80BB
SHA-256:	9DEF16016CB29996F54A6CB41E855416B51FBA8EEEAAF61F9E50F950EA690542
SHA-512:	213CE77BDA75CE788B1F2E32981301841209E0E781E85D31B21F2306E35CD8BF4485C3CF2DD33117677DC6F383D27076CFCFEC9CBC81ECEAB856CBFF97502279
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.....L.....D...RY....$..k..H3...r?.T.#P...(..<J.....V..[...vD..pF...o...%.mv.#.......&.Y.@.. .Yp.-.6^....k....<.....d<.+.....3...>?..?.Hx]=...-...)@.Fs..~D..p.........-.b...4..1CJ.8jB>...'Y...q......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	265
Entropy (8bit):	6.85013439586635
Encrypted:	false
SSDEEP:	6:6v/lhPK/bhyqObGN8jbJMSIOcprPlodTg5eyQ6HYULn7YJS4p:6v/7i/NyqmXjFRSprP885QsYW7Y
MD5:	146899EE9952F6F83C51664E6BE32E71
SHA1:	7374DE7CDB22824C538D60CE58C51C6326E07F80
SHA-256:	36ECC913052C920C4013AFA349E572699B355302B4C37429B654AA91C5A7F77E
SHA-512:	8D10242DF3867EFAFC0B2587C3F5FA48CA83CAF8A4E5AA68164E4B620CDAD98E4CDD55D743D9D4984176863EC9DB1ABAD1BD560A28109CC471E709FCA3EBFA14
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .EY......>#1Dg.......*...9....).#.Z...e.>.r~........(...f.[...n. ..#...3"........#......J.....O...C.(.n........5......Qp...d<.O..+.O.-...<\%..".L..@:..@.Bs.K....N#@`s..4x.k..\|.C.8j......Y....3...m.]....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	250
Entropy (8bit):	6.9172786750349005
Encrypted:	false
SSDEEP:	6:6v/lhPKuh70KPjWUyfsqkDH9M0iAtdyPJQnALnEnhgmwmI9yTp:6v/7i8rjv1fDdh5GJ5EWV/M9
MD5:	36917D5773968F814D6D2C7834134496
SHA1:	9CA2BC50909569B2C9D2CB00579F0F10315A0F4F
SHA-256:	D2E40868D4E357A88B0B1616B1E0A33E810DE2F6BE9BFEF56AFC834C005CD96F
SHA-512:	CEBD1F4386184D51D5BC4ABC7FC2D53F7CBBB85DF75EF5900A2238C63FEA08CF0AB90F9BA2600B2565D4F95A33D84C8417FD4E3C455C3C53051F575D2551BFFE
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... ..i...E.~#.S*....%'..^../3...K.u?j.B<\..,.Wp.....O ..U.A.... \..w.E`X..S.y........@.....t...Q.\|%...n.p.[..".{.............@#..mp.`x{jB.._...g.16......w.Y...'h/..3..9.....3....e..A.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.768966683627672
Encrypted:	false
SSDEEP:	6:6v/lhPKinaKPARumOnTTrEm7JvmUS+zpgyfuaSiKomMNTp:6v/7iyIY1hmBspXfVplj
MD5:	C1C74D11FC338F1BC4739D0073F67D07
SHA1:	34F3477A968AFD8E1E238E0EC969C931FD56480D
SHA-256:	F8D65C2F7E33F9B120C8ECFFD549CF03BB43305B20CC339529B6C4FE5BFCC0E2
SHA-512:	C30FB74A22D1A322695A7E8A47DB0CC87AF474E5FDD9F05202C65C91709169156BD295956D38B70C5663AE7181FE14368E4AE1AEF217F1F7DD243A45186F8A25
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!......E.>#..V..%........bF`.....zQ......uT...x....V...[..=vD`.pA........OM....O...$....;... J.[r@<.Z.w.F`...C ...9.....7U...FP.\..%...9..+....`e...w....N#.`8A..4x.4..0T@.>.T.=./...Ae%......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_black\glass_black.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.426281076925009
Encrypted:	false
SSDEEP:	3:5gNRYKvSEB4xJgKRrIz4sSn:AYKfClRY4sS
MD5:	49C746E709063A5499B9708CADB4C26D
SHA1:	4876D2AB3B295088F988EA0DE05098926DE1EE50
SHA-256:	0A48586D0A243FA784CD31A7E5EBF2A00ACC3DCE2837CEDFC350609ED847739E
SHA-512:	7D04C1260B1A4090189ADAC3BD3F88285B032C346260248A31EB0431525BA16B8904C7B193C25EE36855F8393FE053849C38203995018024A164368674C2B25C
Malicious:	false
Preview:	matchBlocks=160 95..metadata=15..method=ctm..tiles=0-47

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\0.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	7.023574124424946
Encrypted:	false
SSDEEP:	6:6v/lhPKhIBls4+SptNFgpuhQTs3ozehZyhQ3jKgeQ1Ks3hop:6v/7iaY4dceozIX3jK6M
MD5:	32D3D714CA6ED4446C73B2C5200D01F2
SHA1:	893598B8AD71AA50AC5FD1455BC6EB9C436DFD64
SHA-256:	DC1E892CE53D1A48380BEF73DEBC8037EA958077044C5B3FD160451C1141D7A6
SHA-512:	6ECD4E02850C887B04E693E7755D2BA703C55C327ED3FEE65255B9351F7B2F2C54DB041E7AEAC54A814510664C5175320B1DB90AECAEBD2980EDED560A02BCC1
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0....k8...Y.~.:D6..@&...jL....RZ...z....vT.TQV..m.K@.Q4y.F. .0.;<....... ..v#.-...@1.....~A.....n.$g.....C.l....+...7...PV$....d%<{.D..c..r;^..4.............D.S..+......j.......>=..s...8.L.`.\u*f..#......pP.}.40JKc;..o..];R.%....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	289
Entropy (8bit):	6.928243902694424
Encrypted:	false
SSDEEP:	6:6v/lhPKXbhhU6cfR8XVJJliBtO3mcDgt7CG8o4jtCREt5rq/p:6v/7iXNhzYSJJs/eG8jtCR2rE
MD5:	FB3F3311C1E59857A9AFCA023E7ADEA5
SHA1:	1206E542B6399E4AEC970A67131EDEEDBDFF83E4
SHA-256:	6B5AEDD09A4F8C081E2A0A34FB1AB2C17E02E5F1B9B7D8DF8B62D8EBDE7A7564
SHA-512:	070B94C7FA7B09B27CFABDD587F2CAB990A3F6B4B192B6CE60561591E5C09C3E9AA9E7B2DDD76CA74AD4A5732F0545BEF727F0D469019D809ECD552AE0AFD8F4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E..k0..XY..H... u.NFA.....................vJ..jjy>\........T.,.;.h...P..+@.oG...gD .........%.Yp.@..d.4....*.7...[v...'.d.."P...!.... .r........(I..sp......F....?...h!...E7.E..p..ap....(..g.Z.N.`...v.6........@......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.902063463222138
Encrypted:	false
SSDEEP:	6:6v/lhPKVQv1yQi4WLa2K0d7hoLQG+cZ40yOFwu4E30YHep:6v/7iCdy3a27dDG+OyVRY0EM
MD5:	B593132EE8A488080B0D2D37E5E20F79
SHA1:	D0935F39E2575AF0221299F3C6FBFB130C8FB864
SHA-256:	45E481A8811EA6BF40299704665BAFC3163112715D32FD71CE30F6AD73E82203
SHA-512:	4587A7D38633753525CEBAC46AA4BA960BF3B303A17AE93073ED24B78B674257954BBE5D6133D7D3BB958E2ED0B73E9A6DF6E61124BD02FB23889B69991F88DE
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...Y.b....%#d...(J.......=..,.k...S...Y<.G..(./.=.o.`..U..kG....D......C...<A.......@.0.~'.A8.DipK..'\+....t#.{.D..#....G\|S%.N....O.dx..!g.....+...>...]p...........p....5.R.x....f!.4\.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.835470229526764
Encrypted:	false
SSDEEP:	6:6v/lhPKwhrGSOCnpNEQ6wBDyGdzu/EvinDVbMZxMeU7CnPydyp:6v/7iOvNB6whxzu/EvEOZWD6
MD5:	544852F9F6921D29D864116C350240AA
SHA1:	2363F6EF7224D1CBE0127C442976823B8915FE1D
SHA-256:	23F53F5105D73974AF434009325C933217AFA25C14DD7AA1C6BCA9DBF56981FD
SHA-512:	5DF3BE24AB7E3DDE543F233AD819F677EDA2B8FA1625F29CE3D8D0D193C2E5A89AEC658042FEA4B93A25FCCB596B16CA4D283A229E9FBEB4E0DE1421B9F08536
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0....A.4`...#..J....Bw.p.k?...g-...U...V.%.....................p.[....j....o.:.%;.t..@..P...Gr@=.V.w.E........9 ..q.w...TR.......OM(.._.p.Y@.........p..........i8gNC..2..5q=_...f!........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	291
Entropy (8bit):	6.881601085275866
Encrypted:	false
SSDEEP:	6:6v/lhPKV85VOW2Lq9KzARapt1t6NkYF0FARXifECYJxkokXPEk0/2bp:6v/7itWie8pjt62y08SHkxIP30A
MD5:	57879A1483579CE6AF747C6741173613
SHA1:	F5C62AE66A07880347541B48D40AB6BA3B4008A2
SHA-256:	3C2EEA5D5CEDBC40E29748BCAA6175D203EEE0C472DB97B040841D6FCCB6ECBE
SHA-512:	57D4D663C60311BDC24FA9E9F029AE211C48993A404473785FA898BC64354EEDF6D955FFC22186675333C4CE5D6CFA4E0BDE7851D4F4C99DB3D0C762326360AB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y@x.}.2.7(x.L...@[....C...9."-..c?.v....b_^.+ .....(...&p.p.Y...f.rn.K`s..#..................Wr.}W....d'\Z......$.$^R....*.l......#.....].]u....A.....WS..O.$..mE........R&Z.\|..Qp...Y.\s.,..+..!F%...N,....".c........m......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.858651971256777
Encrypted:	false
SSDEEP:	6:6v/lhPKkWlmH2LVCIiw4wuboNR1TqctDnyk3Z6p:6v/7ikQSiriwubc3pJ2
MD5:	5BB7C092849F4EF3D21FB03D94593C6B
SHA1:	7E278FCDDEEA6E6D5EB7003711FBB1818EA9F79E
SHA-256:	07EC2EEE4DB967D1F178B1AAA26000987E51623960350548228F7AF448B4FCBE
SHA-512:	1B0C8852E19B724D24C58064D8A43608AC88F7B7FBAAC5F6DEE3BC597F57FF090C73DC7FA5A5967E7657186024DD1C4148DEFD72B948943C01C616510B2C0334
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y@x....B...@'k.m)mq$}.>.r0.G,.[..z..uJ..ijy~...{..,..<K....z..E.....vD..pF.../............4.H6M..,xO..pS..,...h..x.Hf.-......Yp...rn.;.....=...>?..?.Lx9..i$.[`8.S.....?{.Qt.Y...'h......9z...p......v..U....v.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	263
Entropy (8bit):	6.820553343168366
Encrypted:	false
SSDEEP:	6:6v/lhPK5hy3lisVkBhs5poXaWG9uqlix2zz1lKvTtHxkdNK5zUp:6v/7iDywsOBhs5uKF9uqcxAKv8dNIzW
MD5:	BC0B5F8368DE11905CB15CF1A0EDA32A
SHA1:	2D2CCBAB0EF40E5230EEB6244B01C01F5A77F972
SHA-256:	37F050132809D1FD6CDDF2F67CF5286B742E4C958782F523C653E8A276333BD3
SHA-512:	8561D28F42DD56712316516CABD963409E11F0C53EBA00BE62B6A5C177DF3C681C2942671546202D1006FF4CAAB606EE3105F19D496C6BC9C10039705F8D5414
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.S...Y.b......T.~M/Q.V......xO..Yn....#.}$r\|6R....J8K../.......(........H.{..g.?.....#.....)B:.J..p..M.G..e...p.@..k...n.}@..q.oY...(....p.dx......L......R.[.....P.9As.48.5.V..T.c....x(/..nM...2....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.948505223431942
Encrypted:	false
SSDEEP:	6:6v/lhPK/QvnmgBaPSKh40TutMHNw3OVuP8ArqM2rVv9ioeIMjp:6v/7iU83TVA1rqMKv9uI+
MD5:	AF2F8AB92CEC7439BF73ADB15DEA3DB8
SHA1:	AAEBE9EC54C74BC980B158D16DA30E351A088E80
SHA-256:	4F6D7E67283AC234F6D7BB2848A33ADE3251E9AF6DB4AE744694577D8696E5A0
SHA-512:	910B21C5C2D9C001B7A3582DF32CB1F1D6016E9391CB81386CE1A3ECB59E9BF7D858566DD54B4C4327648C05588E85A163C10753F8139749DF137E589F6BDB84
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@.S...].b..H...y.N...C[..pp...=.c0\.wb.0.........d..l.....E8.,..p..:..%.........b.Q.?......t./.}?..O......C.Upq.j..(.S.D.U...o..Y..Q.......^.t.JR..>......%!.........L..8{!...S...8...Up...71......CRfw,.x.}.v.s.s.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.859098282022426
Encrypted:	false
SSDEEP:	6:6v/lhPK/QvlmH2PHukmix7AEAf2TnaunU+i0gW3l0+rWnBf1jRPPGzllvFaVp:6v/7iYSmsWBAYTUT45rWnZ1pPGzJa7
MD5:	158547706BE2F51E197BE6C48C2FB662
SHA1:	A5AF74F4EED057AFB9D922323039F79D8E612401
SHA-256:	352EBD4167ED966C2E0B6C55BF4E21C724449CA15EF51695B064573D9869B842
SHA-512:	517B76F44354745FEECF961EB05F7A1208F746D6FF3ED53F5D47547BF04208EABAD9E2E799E4B169A0B15AA6F817CBB0362614577F35D1796676221C92651A79
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...]@x....B...@&k.i)m.%}.>.f....m-.....mR.K..oE.uY.x.../..^...{....@....._...5..l.d.\#..#.4M(..g.....Hf.-.@.x..D2.n..Nx...sD..s;.....?.(I..sq.....uL#......dl..x.ED..g. 0...`.....)."..3.V..&.]`=$.%.R}....w.$N.m....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	276
Entropy (8bit):	6.881511549746972
Encrypted:	false
SSDEEP:	6:6v/lhPKYhir2vrAX82KxsjkLAtuWRlz6PFpbbZzmtovgSvPy6kGT5Vp:6v/7imiiv8s2Kx3LAtqnZzStVsT57
MD5:	DDBCFEF0C9DA98B4852649D54D944D9A
SHA1:	26CBFFDA07646969415A3D6E9CA56CA6574A9773
SHA-256:	30F9B64F3B7CC468960F28771288D016CC98343258466099E5E643D78127B7C7
SHA-512:	A3B8A440D4B0C8E0D0F64E1F9B7A2FFA6F2A6609A359ECD6BC624C3262E6757937CA347BA9390860EB581AF5253E6A408342F71AEB2DD0B66B1A65201385ED29
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...].y..<D6...2Y.C.m]..`..D..).l...<.x,.=.&.3h....&p.st...n. .C...3"..W.TE.V.?......./9z.+.........M.Ypq.j./+....*.b....(8{..2..=..9..%.A....j.D...i"..8.... e.y....rn8.......f.M.b^.....#..... $9....w.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.8921539327787595
Encrypted:	false
SSDEEP:	6:6v/lhPKehy3lCnHpj3PkqD0p92FvXxHVJi0LTVp3dhUuFSp:6v/7isyQHqqQ2vXxHji0/V9bfY
MD5:	DD7A419AC19B5DF55F3510C367767952
SHA1:	91AF706AD15B4B2304A3243DB0A420406C246AE3
SHA-256:	6F015E006C9E0A333C0A5B9A9270C1BAAECA4C799593B81A7877D810492973F1
SHA-512:	77E7B290DA20F7737D0CACEB9F9EF795967CE177C3EF8E18B475D08FB64038298EE1E4346853FD247135E43CFAF0635E2346D3AC3BD3646D6ACD0D3B9E8B4C7B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.S...Y.b......T.....%..(`...\|C.'0......2.V..\...:......et.U.=.V.F...h \..w.F.i6...\A.\|D..O.!M..... ...4.%.....p.k...^=.....l..#.i&.N....ipQ2....3....._.V6.......4...../H.GL.e.4....O...1.SC.\|.('oqn.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.830447259379733
Encrypted:	false
SSDEEP:	6:6v/lhPKkhiT/5AA5IPfZqEMljak2gj35RbXySxvFUdVDAlG9BcGsup:6v/7iaibP+fjk2gtROSxvmVDyI
MD5:	97C4969981CD9E576EC00AAC38DF576E
SHA1:	D516A21705DE652B14226067B99815B2EE6A4061
SHA-256:	54D41D72152ECFF65DD2ECBDED5557B9E9BDA7E640B1C40B7717DC79DF6B1D11
SHA-512:	1B6B6742684E140BA7CF0A2D8671A89526F2652EE7585104A9337CB04301A967620901AA07045F94444AB6235B5EC9CB1ACA921A56FAB0F32B62CA5CB1E17192
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E..k0G.....2D7@b.&..z..I.o.._..{...n../..ar....z.f..x...)......@...h.E.Y......wp.w.d.l._...W.....E.Y..&.4^....h.E.i..4...1.h........^-A4.>..(`...&....x6.&@.F.7/$..p"..........s7d..-.c....f.o.*lk.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.977281514329764
Encrypted:	false
SSDEEP:	6:6v/lhPKdbhi3vY0H+Uc9eWkh63o7wl906FcjqEIBs0mCyMtCldp:6v/7iPi3mC3VwFFcjUK0RTtC9
MD5:	3371746B43EE22CE31F6B78B28D77585
SHA1:	1FFA38162A048D29C43244A83D751E2A929BC215
SHA-256:	1DABBB27BC4191AB0D1C563C14B7FFC8CDE9D07F52C9DC3736EDC054924545F0
SHA-512:	AB920D09208579301B511A543CDA5C6FA99D8F68E04C45A77C4937E7CCB12345D9E67EE77F3D10313B4C28FD90BA23616A4C979A08FECA24C5E0ED6DCF5DFA81
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.kt.,...gK...T.~M/Q.V1......{.....O..]St\|....x..V....].....W........@8."0,.....A.\#0.+9.&L._.t...Q.........-......Yp...v.....~%.....bx.5!W.....ll.....pt.Y...'h.(.g.....0U@..X...].....w...HH....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	258
Entropy (8bit):	6.966484192275143
Encrypted:	false
SSDEEP:	6:6v/lhPK3Qv1yQXJW4HTkQtPVUiMHV5/Wf0tUAZ8Vdp:6v/7iAysoQrMHTOfw8N
MD5:	BB18ADD314287FDC53C1A2B504113E5E
SHA1:	F4A3F45FD63F8877001E7B133C0C85C3231C61CA
SHA-256:	F2AF5C4C1498D86E4C1FCDD7F307BD86713C73B7BEF03FA8AE600B6ABEAC6FB1
SHA-512:	FA9BEEF5BAAD35B2BE45392ACD66F59A091B7B6DED5F973D6AB130E17C1953BEC5458B104A419ACD10C384ABC65E36E1959BA06E24074BB75C57A58D3DEBFCBB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...Y.b....#d.$..j.......=..,.ky..k....X<.G..(........*..#....".......VG. ..D`._r E..... ...4.%.....p.k....=.....l\|.+...~'...qQ2...3.....O.V...\|....4....4...#..Z..C.$j.=....\|.;.f}........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	261
Entropy (8bit):	6.866427251683077
Encrypted:	false
SSDEEP:	6:6v/lhPKOW1y1mI4sqEOkbGeDY9FJeqyu1cZN9FlXigYm6xsBjp:6v/7iOwy1aEOyRtr881igL0CN
MD5:	974199DB4AE9660109BDF5BE7C163DF6
SHA1:	05F0D32C298AA1B569C0715CD2B2C2719B522194
SHA-256:	E82DEFB53A7AEE80BEEF74E389872BE7A87762BABAC0A0E9D3D6BEE3E426A017
SHA-512:	4D5F464C79606842908F72A2667C1A81641FA8C58523D0410B052BD278B6EC25D64EBBACC7A473C8F7053BE6ADE19565D7BCA341AF7DF90F84DC3BB1E24D79D0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...Y.b....#d..=DU......!.........RT+.n.[.l.U..>.vw.U.=.V.F.... \..w.F`h6=..\A.......@.0.~%.A8.DipK..'\+....t#.{.D..#..x.{\|S%.J......dx.5!g.......l4.....w.i...'h.H.G..K.o.* QC,........&f}\.Y.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	260
Entropy (8bit):	6.834846301913494
Encrypted:	false
SSDEEP:	6:6v/lhPKo1y1mI4su3OkbGeDY9FJeqyu1cZN9241G+27tI6gXdp:6v/7iiy1IOyRtr8V4G+eSD
MD5:	3F3BE0334D66293CF19FB94DBF643006
SHA1:	9A3A1CC3ADEBD8148D412F69C42B5F8B103D824A
SHA-256:	7152EA72FE62B2B52D0F61F10DA3BA570835E895A237DA86F6644EC8592151BB
SHA-512:	F0BDFED6FA744D8955DCADFC0110288F86617F827A35B16A1B48C00BF7717C6558A289115F92B2E9EFFD6878D7656BCFCA413C3B4D7FDFE8F399EBB9A05AA986
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...Y.b....#d..=DU......!........RT+.n.[.l.U..>.vw.U.=.V.F.... \..w.F`h6=..\A.......@.0.~%.A8.DipK..'\+....t#.{.D..#..x.{\|S%.J....apQ2...3....._.V6..\|....4...../H.GL.r...H.'.....z...f!......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.84009495506329
Encrypted:	false
SSDEEP:	6:6v/lhPKjbhrGiSOCFvHRahPGGP93HiuzQTNTp:6v/7ijNiHDvHvGRWj
MD5:	7EC9E73C9AFF85F01DC1A96EEE4E86CC
SHA1:	DC21D834192469AE20436C0A2B8C6D0129A76C5D
SHA-256:	340C7EC0ECE6027253AC0AF16BA5ABEAFDE6666CEE76C3E894D647C0E2B449BB
SHA-512:	0AFA7DC94A00CBF40415FA980D1040F167319AB30FA0DE80D578D0EAC42ABBF68F89CB42A30C6008AF50CD9B313ED2D9D7F145C6A8B3BDB2D00798FC81B79E93
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0....A.4`...#..J...Bw.p.k?...g-..\|.......$K...%..+....>* .#...+"....t...'....t.Kv....;... ....z...p.@..7...\=r@............\%.^..P".............,..........p..T.en....g.f!l.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	274
Entropy (8bit):	6.913130164088353
Encrypted:	false
SSDEEP:	6:6v/lhPKGfQH6npg7EgdmUszP9nJrlJ5/FXBp:6v/7ikS6Y+UshnllTZv
MD5:	1C6698077781BB593A11B8079C79457A
SHA1:	730F76AC15AB4156D3CABE8D0890ABF82DA6333C
SHA-256:	9A305E5ABA66DF9FACDC803E3A8528C9990FC00A540DD376A48E98D07AC75F54
SHA-512:	659D8EC4265F5213A5617BBBA3C8DCCBE911C2C6C597E555A71D09C839AEC272E6353EF228CF63701565987D4A1CB257C44BD33BE8CAB82CC264A7E5AE2C3D8A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E..k0..XY..H... e?.H@H.\|.D.\|.T........^..M....t/.%`.........w..x..........6.n..?.o....$......M.6.).A.5......&.4^r...........,.F.t^...P.....$R.\|....Lx.5a1.+..5........"....7.K@.p...Q.Xg.:s9...M....w1........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.73355187156708
Encrypted:	false
SSDEEP:	6:6v/lhPKKiAN61KklWjouvO+KGscC20AWVp:6v/7iANapu2LGC20AW7
MD5:	4F5E48EE1436E86D7907CA29886B9953
SHA1:	AC5573030328AD1E52742D67DC1DACE1191DA36D
SHA-256:	12FEB96F7EEB6DBDF7E0F7CB51A70B1549803B220289E8E84E9AB952C8C0BA18
SHA-512:	CE6841627E9068E476FA98FF7A6CB66D0BD7F4E3B13F45B1CA55B63B14029EC244D29A36DE72B6B1E4E64B79624522F693F8202EDBB4D19C7583CC8D32A3BEEF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx....B1.E.N....@...M:........Q..\(..sR.m.N..m.KUm....U...Y..x.n.E.....;"0@8#....p.\|..@.....^..B....:.7..T.-.@;x..DR...t'.G.d.9"...W\|#9..g.-)\|..._...v...J...r.....-.~.#.....N.^.....s.n..)..v..;..nM.{Dx....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	249
Entropy (8bit):	6.772173527323542
Encrypted:	false
SSDEEP:	6:6v/lhPKaGSUZjkGEbb1bTZ+d50auY4P/c83Up:6v/7iat2E5cd508Km
MD5:	9775419366F86AC2E99450338B5A28F0
SHA1:	FF28DB77013F528ABC16535F62279C4187FE30D2
SHA-256:	F90CD5E82C887664B950284DA135EE31E3887B9FD8AB92B1AF02EA8CF91ADD14
SHA-512:	48A1AC4F7C15B05DDED8CC100DD2D9ADBB8E803729A81B3B9582ECE772A462AFA685B2241B988A56F25FB7B287E247AA1C486B01E2CAFDE91AF53B390666D528
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.....:h......%.^.NI....../3.f-.q>..J...Y.K`...x......_..........p.[.....U....3..\|...B:.'PA8.Da..PO.U..n.....!...G..b;..v.{...>_.+...h.%..).....q.\.W ..g..0...A......mH.....O..p.eiPX......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	268
Entropy (8bit):	6.893009240514268
Encrypted:	false
SSDEEP:	6:6v/lhPKZQ/62gry+6CA9QcWkJFxvRTS5ELYDS6uSlSlvl4sSxDdp:6v/7i2Fgw79bnv1S582S6uN8LxH
MD5:	56D9F45C3B7F2A38B12810E33E21ADDF
SHA1:	882CACF9E7FE580B9244CEB84F3648E563B153DE
SHA-256:	2BD143A5138E968E4EAB6150E73652058DB441CA778CD74A0D279F88C2C7E5FE
SHA-512:	029D4D93BD0D5F7DC7C85B255C68BE089A2A627FA0D48B6BA985F43B29601DF3C523E59CA90A8712203DC4380B658369D01A18443E68B94427BE1C3849CBF66C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...].y..<D7.....rh....F=p...S .....H.....% .......d... .C...3"`.W.TE.V....)...../9z.+.........M.Upq.j./+.....2./..^p...4Y.k\|Cs..wK...........Q..B..q...&@.F.../$d.p........O.9r7....q;...oVnMY.W.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	276
Entropy (8bit):	6.86063774886845
Encrypted:	false
SSDEEP:	6:6v/lhPKYhmlwCTTEhxCMZ2mS3n09SYJnWXFjtdbAmemsDrp:6v/7imowaToCMLaUSYJnuBbAmlsh
MD5:	6DE7B54FF150FC649E0F53B6FA9CDACA
SHA1:	46F230AF7BFA8EC7068097E3C6A7F0CECCFEB373
SHA-256:	6AF81FC9CC7C1C238ED6E18641E97B61DAA6D8DCE11B7F37BE6EB591681E3314
SHA-512:	BF5DED25B3F2A424A08D24A2AD48E13675E76A191F7E1638C67F0E5A93EAF2F9F3E0164674EF0CBDEA7E46DBC1391EEFF34055A1FE3CC5FA6C7862A364615A2F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!...)m..k.....(.."..T..G.(......H3...r...{mI.(......E...Q...J.[...n. t.......p..........,.D..W.K.pd.g.....hd.5.@.x..D#...hFx.....G...8..........y...D...9.3.....?.H.h......N#@`8As.ip....(..G.R....K.x.=.[.n...F.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.909556904519701
Encrypted:	false
SSDEEP:	6:6v/lhPKehsam4daHr3kCiVCi1BFk6vYi3431F+agDt5tmJrNp:6v/7issamtHj5iVC0Fk7io32d5E
MD5:	FC7FEB4E48C4336ACF888326A92195F0
SHA1:	D1012D821B44733A955656CDD67120F5BE204F06
SHA-256:	FC4DA9C53D904C2918823A1E3E8903DF322F621DA122BD5179079F946DB57AEB
SHA-512:	370A66D9830153B05BEE01A25A34049F45AED01311206EAF4729E9F6937DDE4585DF0B1C494894617CA79E0A285549D6D1EB55F1DB82E19653B2E90D6F6AE73A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E..k0G...@.2.. u.&.\...........=5.#..z...9..D..FJ=..u....x...z..F.....vD.......-...4..h....^..!.~&.@8....>P#.V.p.E.9.-B....}@...n..~&PH....dx...f.....j,.....ht.Y..lN.\..g.....*PYC,s:......n.s..3....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.96993897433993
Encrypted:	false
SSDEEP:	6:6v/lhPKkWnm/TpHvx5wAXUDOW3Vcvp0L3NF6yCGjL/iQav7ckup:6v/7ikFNHJqAXY3Vc+N2ejiQM7u
MD5:	D5EA9733BF053AA7393C9EFDA19DB28B
SHA1:	7089B0C8AF16E6E65079FBCD7A9E2295CDA0F1B7
SHA-256:	03A246F40F0C9135F55E191E061B799CB20BB7587D9AE13E57D6EAA67E9649A5
SHA-512:	13FFDEDB260BB1EF42F24B404CA3E13334CBBA07767A529618593F6E6DD6ADC010CF3DF4B27C0C73EF0DA64370F038289A19610222793119DAC176EC21204B2F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@.kt.,`..g$.....@'kR........".{...t.?..]..g:.[P.#...i!<L..g.X..8...`\v.@3.E....h.I{Q....B8K...I...@4\|(P.pn-.....P.xY8.H.....Jx......:.....oS...[..........g*.a"..8.....0.<.....N$...d..f.U.....`Z.......-..pi._......a>....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.818643125741582
Encrypted:	false
SSDEEP:	6:6v/lhPKO0VoVhePyvYaRfXaUydGX/Iv/RZ4B96B7nAdfjHldp:6v/7ijiiUxXwqB96B7nARjFz
MD5:	E62AD7689CF275915B5C5E2E5D9D88D7
SHA1:	E815E9E2474940E7EB72F85028AB2445B2DD6983
SHA-256:	C5F95130F4E8AFE9D6AAACFC5D98387199F1DA8D4E995034766513D742D71A3A
SHA-512:	F65F62F97CEBBB72F1DF49D394D5FE890795711919877FFAA8917CBC58FD0C6AB532DB6062C3DFBFDD22EE3C180E736911BCE8B8AD4103F5197DA601193277CF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<..T.....U.V..Q.....f.\o...Z..x+..P...vx.n.y.....;".@8#....p.\|.@.....^..B...*...".......K.I.\|D....C ...9@.v........(A...p.......f.?....48h....y..........._1g....?n.z<..^n./2......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	268
Entropy (8bit):	6.853624327969702
Encrypted:	false
SSDEEP:	6:6v/lhPKZQvhi3v9un+oxeGZomTON35SFgtfM08D+gw4ZCCn2up:6v/7i25i31oxeGws306+gtSc
MD5:	1A43F30B07322A3D44EE3489450AABA7
SHA1:	31078D3FF6C6587A910F0E650EF5E545610E43CD
SHA-256:	9326A10D9DD2AA18C5573D663A699C1E3258152F6FC34652FD9AF01961223AA0
SHA-512:	7DCDD04747603AE2FCA2E841ACC4E69A5058BEEE3F7ADBA4F4D98FD0E62D8A2FFC2A7C9720C1C4B46CCD11B3DBE4B800083E2ED55F78F1B508B1D2A003C89687
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.kt.,....<D7...:Y.KT5Q0\|.......c,..\|.B^.#....nai..G...2..*..p....... ."..p.@.lz...A.\|D..W.#E....h .jDipK...p..;\#...!....}...q.o....(A...pQ2.HE....t...+........8............2.5...QC.......\|...n...Mp....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.8253013608238495
Encrypted:	false
SSDEEP:	6:6v/lhPKgHODiBoKhaHhesWP8UvMncRsx1rd6VLpRdUBXuUMTp:6v/7i3DioFAUcKxf6VLpoQ9
MD5:	DA1AC82DEF84E2528246A35D380C8E02
SHA1:	AF3FF8D1DA1FA3DAF1420B1524A4DD20865B9C2C
SHA-256:	0313A2768537BBC9EA4D52985FA78CDB6A3B576171F65CA942D70345F4A8C1B2
SHA-512:	FD75CB26C018CF6ED99F02360060B163AA8688EECA096DF0A888F33CB9F0F021CF04F65A343AC4E53D6F911150456CBA68C153FB932950C02BFB23EDA0C11239
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.)kt...X.g$v......`..Q.....i{.ye%...*Y%0.g.........z.@.....-..r.EU..4..@..dC.....T...Q.\|&...n.p.[..$.z.....2.O\|...@!....J..r7..........8h..W ..g..0...A......mH.........p.e.[.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.794311791718068
Encrypted:	false
SSDEEP:	6:6v/lhPKwhyAOmNY+sNDqjDN1boptoGBPV4kIf6RRlRRwmI9SQ7wp:6v/7iOyr0KDO4pzOk7LUJm
MD5:	7C16F98225FFC055036F8A605A4B5CDF
SHA1:	0927371432AF588816E3829AF197D0A554201B22
SHA-256:	DF89D8618D4ED800EE902BEE4E6DDE741B2FAA56AA3C7B34CA86D5D632A927AD
SHA-512:	8E78A5268132FB43C442DC6362272B0B430FD7C6DF35CECAE636265CCCC655A160374777B1D44705D8133940312E6A0EFDDA8C2EBBE2406B150443DEB55AEE5E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.kt.,`...H..2Y.KU5Q.\|...+...\..}.B<\.%Y.Sp...^.O ..U.A.... \..w.E.[....<..>#../.&........(..........-.m..<.Xp...Y\|.o\|.L..@%..ip.`x.5.D......bl4.....w.Y...'h/..3..9............e..].g....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.871584524439759
Encrypted:	false
SSDEEP:	6:6v/lhPKSNG7vsNQh/qvpGAgZmoZ505xZeup:6v/7iTscqro45xp
MD5:	9360D67B2BBE583973CA282208B2CC32
SHA1:	183360A00676F4C95144110BD3A20EF925B5227A
SHA-256:	E6F7237E165DFC144D0BA8D253797B3DD3C0BB38087D0AFD4228FFAA63FE1121
SHA-512:	400BCD92A127473C5155E1A54DEED4C981739789C76CE7C10E5C5B0CA2446D4F434016D3DF0965218F9B986500823C6639E2AB1CADBD63B03DBB634D8193948C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0....A.4`...#..J....Bw......3..Y+.3-.V.J..u+.%..g....n.x.{...vD..pE.....j9.......E..O."CH.......Q..'...n.p.[.J'.x.......#..H..@&....J...4..........8h..W ..g..0...A......*.o......;[f!..m.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	258
Entropy (8bit):	6.975261953928206
Encrypted:	false
SSDEEP:	6:6v/lhPK3Qv1yQXJW4HTkQtPVUiMHV5/Wf0tUAdDMN8up:6v/7iAysoQrMHTOfeMuc
MD5:	283F979BC82AA1A56F97916F08A6EDA0
SHA1:	6E1C66D0F18B36CFF1D016719C55657453C26070
SHA-256:	37FDD047AEF2F1CF517AC4645E6748442F48285C3E8A972B0D68D0523AA60071
SHA-512:	54C933F644C0BE2C2514919434BF46803278DEA2C9D1C65BB965CCBC9B05103D449669279638DEF4AEAAF6BB6312205D2397FBC09242B380020E557DA587CB9B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...Y.b....#d.$..j.......=..,.ky..k....X<.G..(........*..#....".......VG. ..D`._r E..... ...4.%.....p.k....=.....l\|.+...~'...qQ2...3.....O.V...\|....4....4...#..Z..C.$j.=....}.;[f!...h....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.9511558941800695
Encrypted:	false
SSDEEP:	6:6v/lhPK/Qvhy52ysnLKgKDSozsF3KwxQhEHr/DCmWhEZcTp:6v/7icy5mnLKohhHL/qh9
MD5:	E996FDA19D889E413CD779D291324D82
SHA1:	25CD479D45DF9568A7474C99BD7217FA263BD827
SHA-256:	F38B16A6DC77E191BF7D2698AE5F2A9EC3DF8A2167AAF0C62E34959EAC9F42A0
SHA-512:	868F8F91BE5B959A90F6518FBB91F8AA6613EAD12E4110A9371D2FE19C49FFEA1D3EBF7FAFB4A3C87EA023C9C114287449BB6E19EA734AF70E95D190BAE53716
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.S...].b......*.@&k"....l..._"........,G<.E.....Z% ........2......@...X.U.I.h-......"......M.oxS .pi/.....PSxA)....... <Z.x....`:.....(.....\|./...'<.......s.......,.......J........C.b^9....=.....F.d.......d..3....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.89603730190097
Encrypted:	false
SSDEEP:	6:6v/lhPKAWhhU6C7+lGgtFcydGX/It1lC1rqHtk0bOsXQPCRJnup:6v/7iAUhzCn8m1r8k0q+vLc
MD5:	1778DFE33E8780CDD102083D8ECE7B28
SHA1:	2DA8ADCBA20EBC4E1AB492EA8199E48204576517
SHA-256:	A9E24235A5378ED83E0E931D8B1C1287CE960F06533E4D6FFB25696D01152D75
SHA-512:	781946138F170BE749DB3009BBD457D4F1F4CBAC8BEBE7F78765F04C4483B57C90EE39C8A99BCFE7CF763BE28242CBF8D08B9E15817B5833E0C4CA01031B30D9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E..k0..XY..H... ....J......}O...o.....%..@....T.(..^.[@..Y.B.;".@8#....p.\|.@........B...*.7..d.-.@;xe&.$.n.....!..g....v........(A..sq......uL+......d.4...ED..g. 0...`.\|.U..!g........A......w[........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.8254991088834105
Encrypted:	false
SSDEEP:	6:6v/lhPKVQvhmlwiGbRn90DsvvA6FwxTxtsNqGVsCDNgVp:6v/7iC5owPbN9csv466xDsNxVRS7
MD5:	3930970CED253205A341475B491A57DA
SHA1:	58184ADE3E31E9968CE1361951A45F5C1D130DF1
SHA-256:	9EF82082BD895CE05EF0E5DF45B95B29616226240AAA9E933F6FA81190FA2565
SHA-512:	4B188F93F24E463F2C74A24A02B790EDD7882CD7630A49BF72E4B4EB0EEF37BAC1E524E386D6FD23D6625139EB7257702CA95EE0B5F017E45FA9A2A2DDF6D68A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!...)m..k.....(".DJ.I>.(w:..k..zF`....me.bs..............{..=vD..pE.....nizR....\|F..O.#CH._.4...Q.........-...o..,.F.8.c...~%PI.sX\%.^GC(....t.....-.>z..=p...........p[............T.7..n.\|..l....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	274
Entropy (8bit):	6.857355043290481
Encrypted:	false
SSDEEP:	6:6v/lhPKWhir2RhAf8oXg+hBzsGFXuGgv1JkgJEB63u6+je7J8Gkme887XxR3It8Q:6v/7iUiigUehRsGFXrgogJYAubjG8P8f
MD5:	D983CB0E1BDCE61BB5608ABD6094BC32
SHA1:	83F5FB3812F7EB3A0676AB40E91E13DB06791E23
SHA-256:	7CD5018BD688CB323A4660F40573EA59965B8C1775DAC3C40658E91875B50B08
SHA-512:	9FEF91F2A6AC00B387C39888FF814D291D802A1EE85F1CCDA682FDB80A6293DC742429C4AA8E12D61CD4FAAEAC0B738E433AB6D3C826BF7FF64B7CA469EE3367
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<D6...:Y.C.M].....D..).l......H.....%0.w.8...d.W....!.......... i+..{..O.T.......w......M.U..&.4^....X.E.E./..^p....,.g\|Cs..wK......j.x...i!..8^... a.Y....2n8.......V.U.b...9r9e...P.>......bw[Y.EH....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.911330882419224
Encrypted:	false
SSDEEP:	6:6v/lhPKQlmH2LV5s4J3lR1TqctDnyk3Z2vked9p:6v/7iqSiIw3pJw80
MD5:	421E59D7F03A5F7B638BD068B0A2792A
SHA1:	C3FCE2F12B72815B8F2373A72F72399FB3BE0EEE
SHA-256:	3CFCF8F2B999ED47448EC62719B423095F9353276CB15F9492BC216DD0E2B2DB
SHA-512:	038104DCD95A90773710C0253FE5B1D37A4D42B322929413BE33BAC5F79EED0517F77FC60952714BB3566440FBC25245781E297A2AEC181E53555B666228574C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y@x....B...@&k.m)mq$}.>.r0.G,.[..z..:%..4.<?...l]....%....z..E.....vD..pF.../............4.H6M..,xO..pS..,...h..x.Hf.-......Yp...rn.;.....=...>?..?.Lx9..i$.[`8.S.....?{.Qt.Y...'h......9z...p......v..5.....wKP5......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	260
Entropy (8bit):	6.868490490955699
Encrypted:	false
SSDEEP:	6:6v/lhPKohUpZkaXE6RQAAfAxY4qD3vKUWnMugDO+75ldp:6v/7i2wZkSLAfAxVqzvDfupu/
MD5:	A3A6AECB6906F571C7524E459D08EA3D
SHA1:	3BEA2BDBCB495C4BCA56A222144BC070EFD84C8B
SHA-256:	4B923125A0EF4425378386D898C0AF0384D59C8EE5FECAF7166D81076B7C070C
SHA-512:	0249DDE92D29FB00297C416EF6CA7F37F643121532943A96D73D7593177244B3C98DBEFACF5D86B9EB33EFEC605B8A2A62FD67B14B66003D298A59E8E3F137B8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....1....mP.5`...#..:@..*....K..:..zF.c+.r.?.l.R..u........xe_.D.....;".A."..p.@.....\..>#..'.&........Q..3.4.n...[....".Xp.......+.g..4\|~.WI..Q.J&.[ ..) .F...^.D7.E@........m...T.e...........Mo........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.800085309092197
Encrypted:	false
SSDEEP:	6:6v/lhPKAWhir2RhAgvXCA1qHIkh5n783GI4wOkme887XxRp:6v/7iAUiigg6zx57G88T9
MD5:	8EDBD62329C3CFAA6FC2DE61B0E3ACD8
SHA1:	1DB3ED1CAE42EF51F9386C486CD0FFCEA9238116
SHA-256:	C2EC76C2D39648998CCEEA6350E60DA853158EC2196F0F27CCAEDF943C910430
SHA-512:	A440ADAAE085DFA86BB892FD234F9570F859497E021310A2BC1D9791EA6B6D02C060C9AAD27ED3E07823A18872A0915CBBEFE8EC850A8BF04E7F3AA4DBF9FBF3
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<D6...:Y.C.M\.....D..).l.........'(J`..&p..w..... .C...3"`...TA.V.?......../9z.+......>;......M(i.,.'.......^,...l1.HY........ ;.........Q..B..8^... a.Y....2n8.......V.U.b...9r9e.........Bn........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264
Entropy (8bit):	6.882722172807055
Encrypted:	false
SSDEEP:	6:6v/lhPKshy3lhfgJwcm9knZrdpJB8O7tzvrygZ62GKwW3sup:6v/7iSy8Jw1knVlBd7RGg6VKwAN
MD5:	F0FF767D6D9260801310063338A04EBD
SHA1:	9F8DDE56F1DC0068254F46594FDB3C48901F6226
SHA-256:	1075534ACA42D16BE05F48CCF62C2032055AACCD462D5F1D46CD39840EA3DC42
SHA-512:	137CFEDD140E1ED6007B0A60B1D541E8E652E510692757222A151C78053AEEB100C369BC7BB57C7F46970878841265DC31349FA20E1C490F7C451356B665EDFB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.S...Y.b....".D.....%..`...\|C.'0...m.Xo..\..u4..%....z..{.....;".@. ..p.@.l..r.a....>.4a8.N..p(......O.V.....Fx.....G...:.....;...>?..............l4.x...w.i...'._.......i.* Q..].e..SC.\|.].o.`..b....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.84795627016108
Encrypted:	false
SSDEEP:	6:6v/lhPK062Rh+d8negvjUvOsJHBgIZKaRjn+xkyvTntEbJDbQC+5Ksxtsp:6v/7iSa8neMovOsJ2IX4kwnGFbd+Te
MD5:	3B2F051312B8CB4D507D2A315C24AE47
SHA1:	37A1F453642B20FBBE65DA33938475628930EB1A
SHA-256:	5B6A976CE88B395A7C78F3067AE0BC19D41819DEA86764B721FBD0214B775AFA
SHA-512:	06AD2F9F2A1CA6FBABEE8B0DFF011A7F3722BF153319BB062319DE7AB7DAB622DF6BEAB35337FB513B31CE4054C8B33B69B2E84C9DFF81D304E610C64970641B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<D7...:Y.C.M]........{...t..{lA.H..y........x..........@...X.U.U......[.....K....x....KgAS`.\.....\|.k.J.L.....-..M..=..9..%.N..\|p5.<.y....u........,.....7.J........S.b...9r9...E./9.n...k.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.867382491215729
Encrypted:	false
SSDEEP:	6:6v/lhPKVQv1y75Jqqvs97jarTEMhOdtJudQflTk0U7Tmubp:6v/7iCdy2L1Zd3xNg0w1
MD5:	43524C0D46D4F8F5BDE4E95289DB36BD
SHA1:	F268880B671B0A683C75521D05460BC8C86C685B
SHA-256:	C3268F04D59942363DD0C57CC787928BB797A7620D001504DE45D5E5555A9648
SHA-512:	875F6E8B1E329DF1026A2CA3282A78DEDD863427718E6A56E93C83D216D4BC314762198B5114A3DAB7A0C3B0B6A21E288916676B763DF16C8BFF76A6358E1C8D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...,`...H...:Y.K..U........\|.i{<[.zQ...^..G..(.....o.`..U..kG.&..D......C...<A.......D.0.~%0@8.DipK..'\+.....#\|x.D..#.......J..@.....E..*B.....G.V...\|....4....4...#.a....5.R.x.v.oe........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.829857443340828
Encrypted:	false
SSDEEP:	6:6v/lhPKjrHOmyWm45mRpwh1Rv8VbR7oWo5OJCRpYldp:6v/7ijCfVGmGRUVblosMR2lz
MD5:	41B559AE52C055F50115D081FDB1E6C9
SHA1:	03723990D0ED692573956225F7C645D823B212B6
SHA-256:	01D9D119FBF5B51F3003875C52BBAC1AB5E15DD4120B9422A01A172A2A050A6C
SHA-512:	CC538E12701CE5006416F2FD7DDFDF3943F5CA5B16E004BB1411F076741A4CA64F60A947257CDB8F1CAFF3893AD45D845A475833BB55F6382DD79938CBB2257B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.kt.,`...H..2Y..(`..Q........V.J............n.x.g...vD..pE.....j9......\|D..O."CH.......Q.\|&...n.p.[..$.x.....2.O\|...;.L....J....B........8h...+.....N. .....mH........:.e.cc.}....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	258
Entropy (8bit):	6.80523519179745
Encrypted:	false
SSDEEP:	6:6v/lhPK3Qv1yQXJFI7Bx7MvnhOD7VroIpj7Uczi9bUQAMAp:6v/7iAy7dM/MD939zsbXAn
MD5:	E0930443F9E8CD4D64B284878FC17467
SHA1:	2B70CE767D3D6856E5B3BDC745185440F5211A4D
SHA-256:	8335BA258CBE7DB04BA219C5F118009DBD3EEE0F94F8F7066A5D181DE1AEDD6A
SHA-512:	E9BF84648C901493D4167BD0F768DE24E0881E1A22845AC14E109D1A68367DA9CFA1DDD2F70793D41326D72A1DB331EC972CB7AB9028E40A6BDF5049834A0417
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...Y.b....#d.$..j......7.{..Y.kyoG.E.Q..r...Q%<J..........0z.......5.C...........I.....w...CA....x...p.@7..@.\<r...q.7U...ZP....J..Y.r&.[ ..)..Fs..^.{7.F..p...i..i.VN.P....R..\|..!f..h%....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.863963243328428
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrO/WVtm4MJj3MQkg1p:6v/lhPKaYmJDZkup
MD5:	10FE6526F26F94258565BC48607A6F87
SHA1:	2645D8639FFFB508E6063A11768D14D62DEA57F7
SHA-256:	1719A9C6592483F917DDC25987270BCFDD237BC702F3C43ECBE6857940A2A45B
SHA-512:	0307E97B6E03CFE5E13E14B50C5270486D5F1BC5A89003ADE06A18025DFF89E9B65158DDE00548ED2DDAC54147717189200AF35DF7F30A0F8D09E8685877DEAA
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz..../IDATx...!......w..iIH....e..................v.....=.C.d....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.979658846152918
Encrypted:	false
SSDEEP:	6:6v/lhPK2Wnmgr7gtVQgmrLnuoYB8ES5efJKMUZHll0lpMISUj/tPrH9p:6v/7i2SgnfmJYqd5eBkZHornjlH
MD5:	0E4D3935556D3848D7B9A9AA7EFF9408
SHA1:	44C34D774A5D53917D9DB040818940FA630A6A83
SHA-256:	ED62EB94463733D38503240B114C2BB77D16CF2F3D77C1A5209385C2F36BA988
SHA-512:	2608B8AEEDA408DF3F20F91383C112FD0785048A81B7E2CD165C966C121F395F0B151F50E8E2AB3C2B2C87398E2B00DDEFB461A9CCBC13E1B11B625FFA108A0E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@.S...Y.b....".Tb.L.R.M).?88....1.n.GebWF.......t.2c*,.....ip.Z...j.4..I...d......`.V.?.wX...(._...+....d#\|..4.f...P.xI8.H.....Jx.....G.@.v\|...X..-HA..zp5.".KB...9.g..P.h.p.B...'.@cq2....[1971...E...C.......x...wK.(.X....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.924778377833179
Encrypted:	false
SSDEEP:	6:6v/lhPKiWhdDkL4fUaaS3n09SYJnWXFjtdfKfG/3wkvg/dp:6v/7iiUdtf9JUSYJnuBiu/Q/z
MD5:	59BABE13C926EBD5F4C96DACBA4E5DF9
SHA1:	278FE0C209C7BD7949D2B9A9D153010F8D69F1C0
SHA-256:	DC650DF01E83FE2E7F1F3EEFBA7DFBEA727955353B930D974085115B296BF662
SHA-512:	611E67F447F6EAD62A34189D246679C4FD6A7BCC33495B1969AD27E97240A9E0CE4C5EAA57F39F068F32068719A5FB719417ED96582B83DD5C696B0552A24418
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.F..5......!.........._K.....(......Q....@.>.V..D.(.'.J.[...n. t.......p..........,.D..W.K.pd.g.....hd.5.@.x..D#...hFx.....G...8..........y...D...9...o...O.R6..\|.#".....N.\..n..........R*.Q.r....\8o.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	268
Entropy (8bit):	6.929686720496302
Encrypted:	false
SSDEEP:	6:6v/lhPKZQvhir2RhAX82AxeLjLUNa3oSFgtfM9WUkffUlG3/EwZDNN/up:6v/7i25iigs2AxeL32S39Iffh3/hN/c
MD5:	462D919903359843B0E7D8C26203A9CC
SHA1:	7B9A7A4144025992C46AC78A727826487E0D76EB
SHA-256:	82FA5F387127F3AC36095E6BB64503C8692029A4A3DC0BCD3CCD3B22120DAA45
SHA-512:	1D7C6830171AFC6F3BA1ED5F603B25426C6C22CD9001428D83C4BEA9C98EC69BF364ECC8E0E7F79E934482F29A0928E095E809B2E240FC2C390B3BE8D045E90E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<D6...2Y.KU.Q0\|.......c,......l#).g...!i]....8.ut.U.<.V.B.;".A8#..p.@.lz...A.\|D..W.#E....h .jDipK.`O.V....hFx.....G. .q\|.w.....A.......!e........,4..t...4..6'h.H.G.....0T....S`.....o..o.!..*....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.895235699050743
Encrypted:	false
SSDEEP:	6:6v/lhPKihrAb9uChoTwBDy6RahPGGP3HbUU7CndVjNGtVp:6v/7iIIpoTwhy6vGPbt
MD5:	01169F165FB7CDC44117CDD6DFE5D239
SHA1:	1814A91C4BD722035C395F401A1E34EF6DAE1A58
SHA-256:	D55C5B7C9151CF2FFF628E68941A48E9D542206299EC3025445BD509AC9C6373
SHA-512:	D2F43A2F47CD7A8E7AB8AEA181C0145693591DDF16A653FEC2D1EE407DFBDF493267245F11E9242CCB9112C17569826CEEC6001FDC15DF8D9D85A0720489963A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0....mP..Xi..H.....B..p.k?...g-.i^....*..u/..x.g.\|................p.[....?.'....t.Kv....;... ....z...p.@..7...\=r@............\%.^..P".W.p.Y@.........p..........i.dNC..2....\|..hGf}..F.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	258
Entropy (8bit):	6.809036025404114
Encrypted:	false
SSDEEP:	6:6v/lhPK3Qv1y75JqqmYYEFWecis0flPiG+M3RUYpU7zuN7apdEdfiTp:6v/7iAy2FfeTs01mM3aajep6q9
MD5:	35D7AC11A2502519B479C378129EC906
SHA1:	D979970E022B60F0DE38517EBA944FCF1717FD44
SHA-256:	34C77853222E659916AA9E1A4F3FE4FE0C9C7077735A3080310D432DE221C5AD
SHA-512:	51FD46F5D525ED08080342DC2307D48EF551FBFE3D6BFD399A0DC506A5554E0285E4A89AAFBE0FB7B0DBF1BCD9C5F469771B354E99EACF7EDC37ABF09BB20A75
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...,`...H..2Y.KU.U.......=..,h{..Y.....\...:..G.....z..{.....;"0A. ..p...l...r.a.;..\|..i.p.....P...-9 .p..;\#0...!.....`.u..*.W.=(\|~..%....9..-....`e...W....N#.`8A..4x.4l..0T@.>.T.=oO..f}.j......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_blue\glass_blue.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.412555849612946
Encrypted:	false
SSDEEP:	3:5gNRYKvSEB4xNb0YRrIz4sSn:AYKfCb9RY4sS
MD5:	DE9E133B91678B7BCC8D396F519F0E32
SHA1:	26958733D44EB9D3CBA48B38135AAA0723DCB8F9
SHA-256:	BDC5789258BE4FC35993DD7316EF1328B029D8DFA18D41A0B6A52F3D05E938AD
SHA-512:	995C0989BB967175AADC95486B06EEED468BC2C44D0BAA2239673354F19DDAAA1F2D53F029210CE8EF5D910C8DBC5311874F2F43D7705205B2D0E3B4128A8FC8
Malicious:	false
Preview:	matchBlocks=160 95..metadata=11..method=ctm..tiles=0-47

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\0.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.957624782148535
Encrypted:	false
SSDEEP:	6:6v/lhPKIj5VOW2Lq+0fr6lwek2Ntgpw38QTs3ozehZyhQ3jKgeQ1KJjp:6v/7iIeWi3oulHl0RozIX3jK6W
MD5:	F81AF78228383B6FA632293F0EF69CD4
SHA1:	990A0946270984D3B1389DFD052011B4077B8AB9
SHA-256:	CF72C7CFDF21977B50606D786AA3C8B09F25120DCB59E1B35C212B122D6278BB
SHA-512:	798461AB2493D5365F44D96F17A6CB2996CDE7B0737CA2FBA8DD20DB783D1CC94B5FEDABC62513F5AC9B5BABA502A9EC79869F8C120C4D2C6C43DED5B6520F92
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y@x.}.2.g....ii.m]....A...`+.._/.:....T..{@.Y4y.F. .0.;<....... ...#.-...@1.....~A.....a.$g.....C.l....+...7...PV$....d%<{.D..c..r;^..4.............D.S..+......j.......>=..s...8.L.`.\u*f..#......pP.}.40JKc;..os1XNQP......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.924223961321785
Encrypted:	false
SSDEEP:	6:6v/lhPKBhh/YPxNFhQMU8H4E2DQniRWJvBQ4hnBf1leBeV3op:6v/7ibh/YP9GMlh2yiii4hnZ1QeE
MD5:	64F0351D423A043B024A67383D842190
SHA1:	AD1F22B0EFCF7ADA35D233253AFC3BA30340E9A1
SHA-256:	A040163A84E8BAD9B41ABB7C5AB799A0A76290538A653864C90F6A407556137C
SHA-512:	CABE0AF6FC5C4C1795316D04C0C30701616BA4DB0B65BCCFDC45BD9FA31A3ABCAD422C63E72A90C111CEA66FA43C9D2740C033A150E9C1FDF3667EBBFBC57B9C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E..k0G.....2.g......!@..o'.K=T}O.../.....uJ..ijy>...G..{Y.*x...^..{.(... ..#...3"............,.F..[.i.Pf.{.....Hf.-.@.x..D2.n..Nx...sD..s9...........9...d...qL#......dl........"@`8As.0..V..S.E.3fH..'....];J..v.wn\|.O.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.810318107546165
Encrypted:	false
SSDEEP:	6:6v/lhPKi1yPcZ+07HtWG+othOdt+Q1qBU7u3TIVp:6v/7icyPcZ+4kdwQ1n22
MD5:	DC5680F0306C98DD3C85D56299D8E134
SHA1:	E3137436EDF207EEAF2B907F20367F50C6641097
SHA-256:	C016E6CC3BE53392B7766282E1034D241123B888D5D6F066BF032ABFF2C7D494
SHA-512:	F0492E8CF7A45AC6024722A67B7D321EF09CDDD333CE968C63199D0C88E68E007B09CB71A5EC09ADB476334A49E901556B85770DDF74EA2CEA89780D56F603D2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...,`...H....^.(.B..?.n....Lm{.......x...Q.?x.....p.....L....;\#05.^..<A.......D.0.~'0@8.DipK..'\+.....#\|x.D..#.......J..@...S.dx_.!g.....+.......]p...........Uv.P...b.z<...=6...C.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.774163361113507
Encrypted:	false
SSDEEP:	6:6v/lhPKdhp+AwFLnFjVEGPZg15th3pIOCWDfAlh9RuKbpb1S8up:6v/7ifkAwBZG5TCOMuGO
MD5:	811561F5C785023455E37D6C40593C8A
SHA1:	14BE809E8F411866C0600D33E123A360690321E5
SHA-256:	0E735E02D21FF7CBEF6DA1ACA7BA5515D60C5E4CB8874E8AB71CA1B7D13D8E92
SHA-512:	A1A315A41C48AF524833ADD6F19306B13E1B41BDC276B85A5E8E3B16A5EAA5A963F4A92EA44183547DB3E4CAC43206760EA21BC44B866B3D83F974A448818DA7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0...S.H.n.....S*...Ew.$xYx...l..R.fV!..{I..+8K..7....\|V@.kG...WD..n...C.TG....#0./9.&....:...(.>........-.}..=.Xp....\|.3.K&.N....gp.`x{jB.......bl4.../.....N.^..gL.9........\|..>^6..8.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.8705851798445945
Encrypted:	false
SSDEEP:	6:6v/lhPKz5VOW2LqVB8In7i/VIaApLVCL5F8xG/3KJ1IkYTd1r+nVp:6v/7iuWiQ84IiRpCL5FiGPS1na16
MD5:	AC4CC27294B80634B5A0C9254BDAEC6C
SHA1:	831F40BFA819C6C9F455F36137F168F7D66C03C2
SHA-256:	2C37CA01457F14417B6BA7C1E405FF5FC4F7C6E8B7A2A39712F66F7D49419C83
SHA-512:	0E6E4F7DD740C38FD599E5231E654EF3ADF17DAF972747437EAD7D818E160F4161A6F25B3E332FB455503F81A0D2D57F8B445620E959EFE758C5F3C9F47B282C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y@x.}.2.g....)........ ..s.eEZ..c?.v....b_...\|...T.....x.p.Y...f.rn.K`s..#.....'\".../...\$.9..........N...4.f..I.I...U.D.U......(8G..2..\|....=..*>..WS..O.$..mE........).-.>.(8.T..,N..`....s....`..'.`..[..H..D_O.+.n....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.80643158340677
Encrypted:	false
SSDEEP:	6:6v/lhPK/QvlmH2U3xSrUrjNJgCMhKGodc7b+T8+idYzYixTp:6v/7iYSV3xGUrjrhMbcpFx9
MD5:	465E29D23310A5C3B904CB3CE20C6DF4
SHA1:	3E2E09909B2B9CA772DA26DD09ED78C0A8D4AE25
SHA-256:	32211EB9F8176B11C495BFDB18AC5CE55CF48CFE330674629BD4F026F31061F2
SHA-512:	D5E233CA9E8976AE00CDED70CCA2C11A643050E53E7A95823FFE1031239C2D701D5A01BE3E3283D3DF9FB0EC675C036B17721F23780CC9E91113F4BA9A4357D0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...^@x....B3d.N...R.bK.R\|..`x.X...r....%..5.=?JB.Q4[.%..g.<.U..+@.p....... ...p.K@@.F...@V.5..<.]...>.h ..D..n9.... .Up.@s.[.@..#r....o$.`.H.&.....O .^g.1....8..)@.F...^D..p.......N.{^..=EY.8c...p..[2.cU..M.F...-g....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.83494702677515
Encrypted:	false
SSDEEP:	6:6v/lhPKahmRA35bYKn2lYAZua+SKTae/ir1Vp:6v/7iwcA35bYH0azmbix
MD5:	36F91F9CB99DEC3B25214710A63DE3CD
SHA1:	C63F360F571361508B638C93BEB892ED6B6E41F5
SHA-256:	4BCA4E5CC1C03DA64F80F490065687AE25848780CEC30C214714F944FE389AC0
SHA-512:	DD2708752C376A4AC4A839335162FF0A90B25AA284906D40AA2941AF1F5326CE05E87917DC26DDA70AC839E84BBF79D16245B277FD4E6873C96ADBF9BBC81194
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!...S.H.4`..o$.H.._..(J..{...B..0F.r...<.9V"....l...^..+..p....... .!..p...l.'.9..\|E`.Wr EH._.t..5.4....H.U .n..Nx..`.[D.P.q..._.TR..y.$.^gE...o.t.....-.>...]p.....4.....a...R..k.eN.Ky.'!>>Y(......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.8218033973915295
Encrypted:	false
SSDEEP:	6:6v/lhPKdQvVaogsn9z+IPBAnyznOdlJE/E7XNsy5+5wIJbp:6v/7iKAodn9z+IJ2yLyoM7Xqy5+5wm1
MD5:	37C1834CE765CFBBB02035A5EE7A8653
SHA1:	F12A0FDDE238B570A3E6C7CCEE5D751B0758F9C9
SHA-256:	44A7339230063ECDB06A7AC89186001960BA7FF39D6616B0973F627E951C3006
SHA-512:	29210FA71D85DCFC909BB59DD2806D546774A8FAE3DB0B4EA2612666EA94C60DC93D807AF3D58BB9FF398313FCEB2E0AD5AF5A6447983FD35DC2595C2409689C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@.)kd./.c...1.g...,N.".A.(..y.@.....1q....(..H....1T6...^..k....Y......N8z......t.....l.......d.........8.5.W......f....,8F..0n.\|...>..T\|....@&.rI...?..j...(.-..^H 8.T..,N..`..t+..&..F.J..zH..E.O.fF.+.,.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.903818457700166
Encrypted:	false
SSDEEP:	6:6v/lhPKzhilVoVhjJ+78E0YEqNl5IrYq19t/Ry6THvYyzBL/Z2b9z4zp:6v/7iVili206IEqjSevYyzJR2hz4d
MD5:	6E62ED375B9EEC1665892E9A696BEA5B
SHA1:	84890118D15CB82F74F4C50B61914AD925913E9A
SHA-256:	F7D0C115D0F8EE076305C458B95195D34291A8B0B45338EA31FE9D9D79850FE3
SHA-512:	978ED2B16A445A3FAEF2AB6D8B2F6711B0D6EA3BBA3BC8DE7C4564A8F227F636E94CFBF6440FCB205A8F640B62BCA2CE6DA018987684652457AF38A72A536790
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<.3t.L.DJ...l.C\|.f.=...,....k.T.(.{.h]....%p..v.W.".^.B.;".@8#....p.\|.m..k..x$...e..'PA.).d..r...W<A$........,8G..9....H...@I.....@&...c...-p9.S........(..,....4.\....9z...p.........N.k.T.y.+qG.<XL.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	275
Entropy (8bit):	6.898158299604951
Encrypted:	false
SSDEEP:	6:6v/lhPKlhir2RhqH+o/foWiPkw8GlVybvlDkVMaSNfGMQEhSXoRa/xp:6v/7iXiiKRFw8GlKLZNbXxyf
MD5:	4851562DB262BE180F85DA1A4553F938
SHA1:	CE62472D6B98FA90D45A63C50A1F8AAA41C340D3
SHA-256:	4B72069B324963653AD9E20CE03629EE54F8A1478A17A89A5C66E50F22FFD16E
SHA-512:	E4034A7D97ABD8A4590AF3CA13F148B86718D716BD08ABE9BE55653EE3AA2FD663574EF24B733809BBCD469C4586B227C540D7E58FEEFB13085BCF33AA57ABCB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<Df.....!.....`.\"....6i{>.+..8.cr....$p7.7<{.......~vH..pF.....H......."..........@...Y..X..7...2.J....(..b!..g.9@...74.Px...i.\|.\M.Ox.5!-........l4...BB.... p8A{....#wC.\N.s;>&c..$...)MG.JSi.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264
Entropy (8bit):	6.840672372200371
Encrypted:	false
SSDEEP:	6:6v/lhPKshy3hpaZAvr2h7Ij7BnnSNg42+QK83RGmk1bo/4gUenkt1jEp:6v/7iSyTbK7InFnCg4Dh0cJoT3naG
MD5:	7F0C2445511B8CD049A2B2EAE7BB641E
SHA1:	1BA2FCFBB560E6EE2753C088777DAB006E31C55A
SHA-256:	B894467DDA178B6905DB790FA45ACC29B78B472D955C1F4D7D6AD81DAA70E72F
SHA-512:	E4BCB34540DB23D88EF408C121B17090EB58F592F33DDA253F5F7A2B3976CB1DE84E7E2138F6CC8EA2F0A444449D0969252441156D32890DF20F5218E2FCCB1B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.S...,`...H....@&kr..6...6........\|.G.E.S..r....Jx...........0z.@.....5.]..E5....3..\|..i.p..@..P...-9 .p..;\#...!.....`.u\|.V...jP....J..Q.r&.W ..-..Fs..^.{7.F..p...i..iXVN.P...../cm......?b... ....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	270
Entropy (8bit):	6.873407356876404
Encrypted:	false
SSDEEP:	6:6v/lhPK7QvhyAODiBkMkVALD366qim5k3603tIlKNWUwdpBDkDej8up:6v/7i4yrDitcOD366kyx3tg6WUwdnD79
MD5:	74A124EE21256DBD7A3427115FC266C6
SHA1:	6BF8817B5F5C5B895C5101F10CF84EBEEADF0B64
SHA-256:	437E1582DDAEB06F6D66455C5DB4DECBCD3B3003E64EA3BBD863B453256BD755
SHA-512:	B8452A9545B77F88423222DA5FF4B40104001D9CD13F7E4866CA498523E183AFA4F665E225CBDDF70610BFA8211A824D802DF0FB22D466497B6D9533EAB13CC0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.kt...X.g$...]....zhB..m\|.%R..b.....w....`..k.....L..O.% ........( ...m.H....".<?.#\|J........5.+.A..,h..O7...0.H@.....!`.g.9@....oh...n....9.\M.Kx.5!m._....?..6..\|x!!....8...`.\|.V..!{..l.......->.vt!.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.8309604839974485
Encrypted:	false
SSDEEP:	6:6v/lhPKehi3YDY0HW3dRwK/qJ9iVFct4WcY5IN9wwOIEy1p:6v/7isi3kn23rwdS8cYmLwwOg
MD5:	223A801323ED93758FC0AE09CA676F07
SHA1:	5D306E398316A004EF0BA2218F25A45F14E51A60
SHA-256:	6FDAE0FF766A9DE08B351A2659078C1DB6C3CEB4A9A9ECF06725101EA5D7C455
SHA-512:	F73E7880899B07A5873AD0D48774BE0637A597A9F7AED0B22848C89D283BC3496BE5901835FF0C5E412172DF39DB9E870A50500D9DC335BBE26D4E395608A6CB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.kt./...gK..3d....j......d.=..[P..E=.uh..OK*9.W.h'<K.....^...{..........-........5.....i.t.....P...=9 .p.@8."0...!.....`.q..v..zR..<\T..&.J..@9.S....._...n8.......e....\|.S.$k.%.....U.<.voG..et.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.844390983002555
Encrypted:	false
SSDEEP:	6:6v/lhPKVQv1y75JqqmgZw71CnPWotm8sDK4Tk0iAdB5Ceup:6v/7iCdy2zgZq80lg0iApc
MD5:	E8531B2F8613323102044F093BED7975
SHA1:	A4133203799D9CC6F204A6725F329E3F13D4D767
SHA-256:	53E0CD6F7722E036CE539DB2E9C85CDFF0956A1DBE5ACCA3CBEB40524F6E5479
SHA-512:	942B8E107397B354E95332833E2F3431C363FE0E65D191ABB9526FDE06D25B33F488EBEFADF207185046B35CADC39180F75A3C2DE6DF577A3E868257D4590949
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...,`...H...\..B..?.n....L..S...^..G..(..........#...."....L...@. ..D`._r"E..... ...4.%.....p.k...><.....l\|.O\|S%.N....O.dx_.!g....o.V...\|....4....4...#.a....5..{.x~..)6n..3.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.895758230173098
Encrypted:	false
SSDEEP:	6:6v/lhPK8W1y75Jqqm5ReiKfLWFRH71mvAJyrv/S3culjp:6v/7i8wy2zjCCTI44vqsqN
MD5:	EDFD107E83268A7192C1CCED6BE6A9E0
SHA1:	B1B21233123C88BFC0ECD2D191852A6C292C0598
SHA-256:	CC659DB12D1B4AE80D7C4F8B5DDA06A222DDBED649AD76C152BD6B464EF18D97
SHA-512:	3B3D0A5022894EF07750D895DEFD502CF5B1BC35C2E9CFAD5B3AE6A8ABEB1A8F4AAD0E9AEF6BD1079CE5FEEB548DD68B5493E7C77295BEB75BB1739AB7448544
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...,`...H...PUm.b..9..xO`>dj.m?...N...Y.ZG..(.'..]o.`..U..cG.&..D......M..@. .~G`.Or"M..... ...4.%.....p.k...><.....l..w\|S%.J......E..jB.....?.X.h...+`...0.N.\.....[.o.* QC,......y.6n........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	258
Entropy (8bit):	6.85643743440984
Encrypted:	false
SSDEEP:	6:6v/lhPK3Qv1y75JqqmkeiKfLWFRH71mvAJ8X6GIMjp:6v/7iAy2zkCCTI4C6G5
MD5:	5C08E9DFC7793FDC1CF16365595E2DE4
SHA1:	81B83333C289578DB63AE3466C8BEB47D2E661DA
SHA-256:	12F5AC642BA719C8F1A81B28DEC127CF22ABAFD137D0FB64F1B790BE518F480C
SHA-512:	F288D52F0AE72FA379E05F6A2D5A777BB52727F6127F21B64E4512074AC0043B8BEC22D8627C58E568660E128030FB71C9FEC135184AC92557BC137CE0DF0DB2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...,`...H...PUm.b..9..xO`>.j.m?...N...Y.ZG..(.'..]o.`..U..cG.&..D......M..@. .~G`.Or"M..... ...4.%.....p.k...><.....l..w\|S%.J......dx_5!g......l4.....w.i...'._......r...H.'....:.yK6.W.71....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.757108879290822
Encrypted:	false
SSDEEP:	6:6v/lhPKdhp4VOBpF5ykk09M0C+xHKx+m5S9CWgNdV/lVp:6v/7iffpzZhTHKxBSu7
MD5:	C3A2E38920213A6A7B695BB85523E4D0
SHA1:	3C34D829FBA59DC680D4FC90077DC71752BEF5D1
SHA-256:	218516957E4AB2B9135ECE01D827F95250A828638BCDF398777D90D286A0BE18
SHA-512:	A62BCC797830795443B4E05D1B9FB8E9BB833891FAF44C8247CCC7985360BF9E7034230437CFABFA60BAAD7CD53F12D53A34BC941BFBDD6697F427361B9577A1
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0...S.H.n......U....%.$xYx...l..R..W.B<\..,.Wp.....O ..Y.A.... \..w.E`X..S.y........@...... ...0.L..'.*.....Ix..`..#.d.9~.]2.w...>..U....%.~.......h.._ ..g..0... ...5s.R.........l6...q.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.961689652132836
Encrypted:	false
SSDEEP:	6:6v/lhPKiGKMODgSMvvqTnWInngTEk8ylYigiS34a7LuM8/tXOT1EXjp:6v/7ii5DKvSLHwkylYigigrEtk18N
MD5:	0ED54AD6C83DC6895972DA17BD2DD83C
SHA1:	42E4D3E5863A85DA13FC8B4DF72E95C9E170D595
SHA-256:	8659DFDA6E5278068E30572C7A1E094E78856226C412789D71EAF63999C937B6
SHA-512:	3CEDCC4C7D714A6304CC1458A8660864F39D40E299AFEA7A56FA5E3854C188963A3F74AA04AB601A959F5209365FF7EC9329F7B303639F872670105F0AC0B055
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.kt.........._.Hm.`..'...$.....~+G...,D.=Jf.X.4.'<..@......;$..pE......-....."....6.z.)..7.2..fAU`.....KNY.@4.%.;.9B.......x.7..(.y...>.?.....jMX........o..l....D$.....0...`..k*....\N...c...]DG"%V......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	261
Entropy (8bit):	6.778229742071381
Encrypted:	false
SSDEEP:	6:6v/lhPKOGQD9Pu7RroabBbs+QJX01K8iBhLOsSp:6v/7iO7pg1lbs+QgKzLVY
MD5:	41A3E09E347BFA32FF45BE70684D20E6
SHA1:	1E41DD8EAAD0711FBED33E2EFF06F3065FE478D2
SHA-256:	9E170FC6122DB2AA76DC10936FFA37E9CE88D7EE058D0B1F025485B1246E653D
SHA-512:	56FCB96262AB6111CBAA1679629D28DAEF76DE74952BF5163D588559CBAC4258A7D41EF25F66813CF6B0DD02FF21B35200CB5B3373477A5A7A195F7109DF4A7B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....1......:....x[r...ry$....,...{F..._/........(..P.........{..=vD`.pF...O.....>k.T.5....C3.R...t.n."..[n.v.'...n..Nx...sD......Fr....ZR.\|=\..2...9...O...w.2.Z...GD..g. 0...`...+...+.S...XUw^.>>;.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	247
Entropy (8bit):	6.668315001725185
Encrypted:	false
SSDEEP:	6:6v/lhPK4GHODiG5D8nqzW1roarvsSVTcm4r+0BTkpncup:6v/7i4JDbCnqSU8vs0wtvBTkpcc
MD5:	E7AF33370EEF3A1C1F6039B97BFF496C
SHA1:	71176BC87F1787C2D8D4A435E624EACCF36BD317
SHA-256:	0936E5A36D7611094C54FD37B6E105ADE92D983EC24E0DF286AFF94CDFA099E1
SHA-512:	63BEE6E40B408791997DE377C24D458AFCED34EDFE8DD328D922C02DEF72ABAFFDD4D915E74A03D4FB1864C41A30D40FA21B95FBC59F2C742BB276C3B155A999
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.kt...X.gK....EM.`..Q......._ue....-Y%0.g.l..n.D.g...vD..pE......9.O....\|D..O.#CH._.....(.>........=.6.....\#r@&..wY...h..9-...owC(.._.t.Q@.....{..=p.............T.}..x.>..5Z..V.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.870142552169514
Encrypted:	false
SSDEEP:	6:6v/lhPKdr62GZhdDH7mmPk0UnAdJ8sCHC30c7TbQR4YgYgN/jp:6v/7iLcDI0tQjHa7TbZ/N
MD5:	026F827AF0054AC5098D61B8170ABE88
SHA1:	FD90984E77D501F0BA0B40BB01A9205044464DC9
SHA-256:	FA982236D75E52B51B8CDDBEB5AEFB3D6DABF5A49381C9565DF84565878809DC
SHA-512:	22C3503ECEBB7D36770D091E3C7A186509EE55CF921CE949B4B4F19D3453C0F8AD7842038325FC50FE3DEB8F64BE4980FC5908D9E5A75C44C6456D801DF14663
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<Dg.~I.=.um.....D..).l.....8.cr....$p7..<{.......~vH..pF...*..H....3..E...%G.w...].....)...nBM.ee>..5\%P&..B....s.&......@...d...yp5.<.y....u.....H.h.....N%@.p...U.[1G.....?n."....>>.t......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.87302124210656
Encrypted:	false
SSDEEP:	6:6v/lhPKiWRA8gfDgWekaypDaXwPh4FbFZb3sulsG8vp:6v/7iiEADgWDBWlXDsulsV
MD5:	BAF4AB45921FAF36A2413594FF4306E9
SHA1:	2EC371CC5AE6338D3E3E6F241840022DEC46160D
SHA-256:	CA2FA329BA2DAB0B0ABB4403098A17A9629AF2988291F879589CA11A7670753A
SHA-512:	4241BAE224F84814EBBD58DB3078550FA90C33F67A2C503E0FFD23AE198CC51850D9DE090AA4B66583EA043AC66821C33DAAFA260B5708D3D0789E5086008111
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx....B!.E..5......7.C0..8....Q.mo...?.s..BK.^nG...@.>.v..D.(.'.I.[...n. t.......p...&.......,.D`.WrH.pf.W.....hf.5.@.x..D3....Fx.....G...8....._.....y...D...9.3.....?.H.h......N#@`8As.ip....(..G.R....K.x^..N>.4..y....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264
Entropy (8bit):	6.804174372111737
Encrypted:	false
SSDEEP:	6:6v/lhPKshy3h72WHB8tcq1Ub0IKj/CUhPBEfSgytgidDwY4p:6v/7iSyJNKpUYIKjfh5EfSXddkYS
MD5:	61B3938E693C28207E8ABB057F33AD8D
SHA1:	87D8DD1FB8506EB77B3FCD7CAA0CC862B5F420EE
SHA-256:	A85ADC7E29F6E920EF9757C2C1EB9F25291D086120A8FBB4CDAC4C13A1108B36
SHA-512:	DFD316E3A66D7D029102735FF1DF009829BC44AC547A40F06DDDF8C2E3DC6D114ED02500D430F00644733BA07C9F397B2296F71E8D377AF67C572CD116CAB9DC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.S...,`...H....@'kz..&...6....=.cd..6..m&..JPd....Jx...^g.[...n.`..#...."....t..i....g.:x%;R...;...F......k.....f.7..(.x..6...i%.N..5...E..:B.......XYh...-`...0... .......a..D.....L..'}>..:.N....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.917412361656389
Encrypted:	false
SSDEEP:	6:6v/lhPKkWnmgrZxTNZJ7q5WhqGkYu7DO7ORgxcug9Lpm0xDuEPup:6v/7ikgzZJmJ4bcn9Lpm0xRc
MD5:	BD3354DF1545A84C018F552E53C09204
SHA1:	A81BED62D71AE500A3B2F7676D7D76ABD903205F
SHA-256:	8ED48AEB8C9FBF2A3AA589F16AB0B6AB53E7923693D1F0D183D387DDDF596C94
SHA-512:	E70942953C4F5564C093A844A5A0741005F35AAB2F8262728FE1745472728AB5759D3A7CE6D76ABA420C7F91E2A556D5145DF706056B100D7ECF49D2D1DE5242
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@.S...Y.b...."3.@'k...&.....CDxO.....Q..Q....c..:..1.....>.48V-..p.....$P.p..x.E.E0i+..;,...../.}....w...>Z......I(I.$.O$....d%<{.D....r;...T........s=......%!N........&......s...X.L}.,..VL.ML..p......@U.K{..mrO.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264
Entropy (8bit):	6.817496998458392
Encrypted:	false
SSDEEP:	6:6v/lhPKc0VoVpek25Z9YFaD05xXeRTb2Qw4KnWpp:6v/7iNiXebnzD0f4Tb3DKWn
MD5:	BDCD9F2026F80D7C9E90220E0CDFD912
SHA1:	72CA3A5FFE3EB82446D1CA4094DEDF5D4B116DE9
SHA-256:	31D76DF701CB791E0831A94DF1A2481E6423F1BA0D35FFE0008CA2D0605CAF5E
SHA-512:	BBB99DDA2D1755F5523B07A15D857809A3976D7CDFE85D5B4238FF998F74A5F096190CB6EFA7E1DF4950E01709C375A8CD6CB376238BB4F301C7EF0DED66013A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<.g.....!U.T.........o....c.5..@....D.(.7.D..<.V.B...h ...w...A.D..Z.....^.&.....T............K..,.F....C ...9@.v\|.....>.(A.sz.~.D...sL3.G...o.R.....GD.... 0...`...+...3.S...XR..^.>...W_....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.89750668224041
Encrypted:	false
SSDEEP:	6:6v/lhPKehy3JVkiBcYFkR81JMp4FtTmibjlp:6v/7isy3kic+k0JrTmi7
MD5:	B6BDDEC8DAEFF088F097B5F12731AD81
SHA1:	3E3B7103E4AD6C713323D8EE6EF2566F61A2C199
SHA-256:	4B89FA412557A67679AED587F80A9899A4BCCD645F7F8A72166D533DAC54A0C4
SHA-512:	07123D5C338D3B02F9B35447F3BF1FAC68FFB80D4401243E1A5ED848FA51EE97C2FA7C029EE5C3C1947822B85D7207ED7C5ABD061F07FDF68343BD17AF8F35DA
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.S...,`..g$...Y..5.TU....6....=.cd*...d3f......v..u...%p...z..{.....vD`......5.C..E:r.a....^..a8.N..p....-}.y...p.@7..@..y..6..}.J..@.j>...%.T.....H......\..-`...0... .......a.@..bO.W..,..T.>....L....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	250
Entropy (8bit):	6.799639036898032
Encrypted:	false
SSDEEP:	6:6v/lhPK+SS38Amqpsx1rdHtNpqgMknQOlTWTp:6v/7ilS3wlxf7p99O
MD5:	C99BE9B4414A08B9563E4A9A88DE5B1A
SHA1:	AA422DC66E107EA85830FF6A29C6A7655648620B
SHA-256:	F2705B055764E81B8A35FC577BFFB95EC5E9DB55777D1B659703F5E9E5D8C8C7
SHA-512:	C561533557C56F5AB773E9EE16999B5C8DEA1728119DD78E2F8F0475B4E3A2D6BCC1DEE638E2A29788AD6954032E3B219DCA8ABF45C0F5CCF98F37CF6170E536
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.....H.4`..H.t.]......../3.f-R~.yg%...,.%0.g.........z.@.....-..r.MU..4..@..dC.....T...Q.\|%...n.p.[..".z.......w\|...@!....J..2.B......?..8h...+.....N. ...y.6...?..g...r5.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	250
Entropy (8bit):	6.815331925362809
Encrypted:	false
SSDEEP:	6:6v/lhPKuhhrfkFaJ5kk09ikGonTWVaYqICgVkup:6v/7i8ugJ6ZikLniVaId1
MD5:	270647F7E16FAD48E815A78D24181EC8
SHA1:	739E168D0E746BAD76DBB17D0E1FA5F2B189CA8D
SHA-256:	0C9A2CE9E2BD24C7F840E24CD7401D5F96B26D86275C0F345CBE7E0B4C472A70
SHA-512:	C8BE86153C473F4C616DA8FAC92355C063C7AB6636BF3399AAD8CFF5AA9C81BC88A19EA5855B591A3ADAA3A903384980B1C5536376BD819FEDB6FB55566469CA
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0...S.:..r..-..T...tJ.$xYx...l..R?K.B<\..,.Wp.....O ..Y.A.... \..w.E`X....<...F`._r MH...t...Q.\|&...n.p.[..$.{.....2.......;.F....*......?.......h.._ ..g..0... ...5s.R.........>.5....v....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.830896239927886
Encrypted:	false
SSDEEP:	6:6v/lhPKgdFO8rFRap8s+pesxHorfKSh1gptNMxjp:6v/7ikOLanMCHorloptNMX
MD5:	5DCA7648996D76CB9A6D9E197470C46A
SHA1:	52D4F9970545D1FC83B00413996E768F674A9BCB
SHA-256:	37CFD07C5CBCAE3BBC00A6F247AD72FBB480741B501AD6555D819AE9A960DE40
SHA-512:	A95AB52AD401CEB9FD9081FE1DBDA7BE42800870B7A450FFC9EF5641D664157D30FCD528C4D7A275FADEF5F718470770FD5B093D73F6F872B50208F6966E431A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... ...)m\.4`..H...\|..].`.k.......H...{.Y....^2K....8.......z.@.....-..r.EU..4x.@..dC...... ...0.H..'.*.....Ax..`..#.d..g\|...;.B.......i.%..+........^.x..E@.p...ap.6.3.!U@..;.u...6.%.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.841442203697229
Encrypted:	false
SSDEEP:	6:6v/lhPKVQv1y75JqqmgZw71CnPWotm8sDK4Tk0iAt53AVp:6v/7iCdy2zgZq80lg0iA/A7
MD5:	B9EA57DC694B922B094F6495F63FE281
SHA1:	8312505F3C4B9EA904380A81B9A81CBEE8DB761A
SHA-256:	D36BA2621A313E0D693C615944243C45DF73862AFCFDF5870F5B0DE60CE4F945
SHA-512:	13FFAD66BED8277676AD5405D597FBF0B055FF9F598665EFE52536AA5D2F9BB5463ECF31B3639A7038C43B912A980C9E357F7D6A738C373F63223AB0EA4AF2CF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...,`...H...\..B..?.n....L..S...^..G..(..........#...."....L...@. ..D`._r"E..... ...4.%.....p.k...><.....l\|.O\|S%.N....O.dx_.!g....o.V...\|....4....4...#.a....5..{.~...6...t.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.818605046450937
Encrypted:	false
SSDEEP:	6:6v/lhPKzhy52yomkutNLHvZWYqluEVUr5AmRYdFl9TIyEqkry1/5RvFlL/llVp:6v/7iVy5i8LPZfeXmRYh9ThEfI/FR
MD5:	3FBF8B10EE7466F2E20F7E54E6AEB8DF
SHA1:	7732BC81B3B7AB32CBAB8A98DBF55E022336EB5D
SHA-256:	6AE8A61683CD32B3BD79A0660A6A2E33A7F192D1D6F0FF303744176E27EF63B1
SHA-512:	54FBB40450072CD79805A034A2E21E4542B12B0073E1237974BED8F26734D8A0B360BCB562682F431614837FE475D8E1CB2F01B909A0E5F52E2DC69996D65FA7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.S...Y.b......X .5..C[.6../..{...m.>....(....A..$p7....S@..a.....H ...k.J )..E..=_.y.\$..#...)..o.D....U.Ypq.j./(eU..p.@..G../8[...L.}C}..7S......U....Z....z........R..... !.S.....`.\|.U.+gC^9...t\|......q..e.P...#.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	270
Entropy (8bit):	6.883261043103495
Encrypted:	false
SSDEEP:	6:6v/lhPK7QvhilVoVhjkxlE26/FcydGX/It1lC1rqHtk0bOsXQPCoKip:6v/7i4ili0jEhtm1r8k0q+vvo
MD5:	0A7EB1E8B95AE760F7778CA6DCBCBB2E
SHA1:	0A75BD01A0157169D6766C0BCFAFDC62C501D371
SHA-256:	1C8C751FF4E61FF7A2746AC8C1473F0D01E56653FCD7123CEDB6F68D924F8BC6
SHA-512:	8B7744C2713F81AA466A7C922CDD0135FC39904320B5EA255E276AC87A49B726BEA3D9F5EF95C41BEEAA24173FC56012B76164088C9660210FFB736C76C91915
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<.3t.N.TJ...l..s.........v.U[...EY.x...^.[@..Y.B.;".@8#....p.\|.@........B....7..d.-.@;xe&.$.n.....!..g....v........(A..sq......uL+......d.4...ED..g. 0...`.\|.U..!g......O.k.T.y...GLb.}D....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.746517441134143
Encrypted:	false
SSDEEP:	6:6v/lhPKihml5N6GM8eDDuDh1hvFDKtZHYaRU9+p:6v/7iIo5NpM8efgh1nKPHYqN
MD5:	8E44AFAB2411ED06995D4B04B2AAFA2D
SHA1:	053A5E3AF8A896195384E5F42EFA15F89E1D2798
SHA-256:	35FA1A12A3341F8654294834D757E5BEB3B7B8CED8EEABE2B0534600BDB26829
SHA-512:	80B96599860AEA716D7CAA64CE8A95AED0CA2593546B0E0ECB5BBF752F1561DCFF99411444FF9373F5A6C5CE8ECE0468ECA7EC4D2B2856BEB145A4C0C9305B9D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!...)m....h.o$.....$.(J..{...g.f-J.......,.%..g....}......z.......-....Ou..h....>..!.~%.A8.DipO.h$.....t'.G.......w\|...+.F....U..m6.....H....q.B.W ..g..0...A......mH.P...t.1..>.`d>....s....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.841708983916752
Encrypted:	false
SSDEEP:	6:6v/lhPKiWhir2RhuTe8IfRvSBa5XfU8vxkAosSZlDbEmdp:6v/7iiUiigwvSwTkAosSZlF
MD5:	786BAADEF816F4EDED84E6A7DE7712BB
SHA1:	4DAC601537A0851B69F9BA42F182A6C6C0B783FA
SHA-256:	03850A06DF1B96B1B20FAD07CA5879EAE68B42F038AC566C2DC81CC46CD933A9
SHA-512:	3E3788AB15007C76D3F24A09A952AF5BDE180EE3CA9FDFB3EA66CEB0DD08DB4BA53B998F5B950DE3DC36CB02898E2E4050DC5E7E82CB298406AF61B9CC94D442
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<Df.....!.6..\|..\"....6i{>..q.....Z% ...\|.9....7....!.........."i+...=-....K....D....KgAS`.\.....\|.o.J....C ...s...8.74.Px..9h...\M.Hx.5!M._......R6..\|x!!.S..8...`..t+.!.\N9r;>...B....^.GL..(q....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.921074948632257
Encrypted:	false
SSDEEP:	6:6v/lhPK/Qvhy52ybXFteLQby0NUTXd9PdBz4DGJM6telwLip:6v/7icy5NFtesxGd9PLkDGJM+elwLo
MD5:	9CAC01002DB619ED67279AE3CDCD076B
SHA1:	A41D200BD9848564398F55C07952FF8D525B7923
SHA-256:	A4E92A04017F433AA15F1B5B178AEF640997AF37C9928FDA0DE4237A1A69CF76
SHA-512:	5011369B90308F1A03A9F0EA2BB247AD86C6E2A027A312F580070009275C9BB6E89F8E8AE21488811DB26205C52847E419457F8EAD02336561F9AB2395219BF4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.S...,`...H....@&k.U.V`.m8X...=...[....F..vMm.G.(>.z..T.(.'<k.[...n. ..#...3"............F..G.j.PV.[...........m.eK..*..@1..@..=r....o$.`xK ......O ..{.1...L....`...{/".n..........-.b...F.8b...p...".cM..MvG<q.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	258
Entropy (8bit):	6.867538288697913
Encrypted:	false
SSDEEP:	6:6v/lhPK3QvRA8gftq6+ChkMOMqFhh+gxdYZTFRchKhsjjp:6v/7i0AY6+Chk3jrYnnS5
MD5:	B6535271C1D2BAB6EBC0173DEDE2AAB0
SHA1:	C0E94C8D9B44606B8A0BBA1B8E1CC94C66ACDF0D
SHA-256:	425EE13C7CB24305F012E0B807B0DDFEA784B20A55A82E741866D2C29D90ED80
SHA-512:	1B1855F3E59F6FEC35702A4E13CD26318B23CDFD329E674D15C9485F18741137C8CA5E756DA93AEA0A2342D89304372CF980EF56BB3D367EBCEA09616F2AFC95
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx....B!.E..5......7.C8..8...c.<hoo...='P.P...8Rw......%..g....}......z.......-..R.O:r.4......@...?.. ..Dip...H.U .n..Nx..`.5b...:....4...Y\%..fM(..o.t.....-.>{...p....../H.3.a.........M.T..*.?....(....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	269
Entropy (8bit):	6.898836781174701
Encrypted:	false
SSDEEP:	6:6v/lhPKHhir2GZzj0vY913CUqXiHncx1cBHdxCla5i0oxWSsp:6v/7iBiiYn13WiHaC7Cr/Ve
MD5:	60EC09C59E2A7F0C55AFCFD79613DB87
SHA1:	823EFBE00B73B75065E7046CB1A74D837D4D382D
SHA-256:	D4537295268A1C4CFED094A46D00BF9F036966BDEC3B92E402F12A287DF6FEF6
SHA-512:	6B40CEEC6488411308311A30A7827B9346DD4C08B95B3BA6986260A46EB3D048ED799825CB2915EF5883E56F1ED1E3B1604B64C4CFE074B4762FBD3C3AAD42A4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..H..3t.L...CR.6.`.\"....6i.l{`..cr..E........].2.O....!.........."i-...g...........7........p.j./+............-..M......@...d..s?......kBZ..9.W./..l4.x.BB.... p8A{.*...#wC.\N.s;>"..7<.>.O.^.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.863963218085248
Encrypted:	false
SSDEEP:	6:6v/lhPKahy3xNIVvUfcZ7Bnna1qKK9q7tJQ1b+cnfuaslijp:6v/7iwyBsUfcFFna1FK0Y+4fVsG
MD5:	9F05D713938DA48DCB5E4E1C9AB175C3
SHA1:	C7D279E279D1AF0ACDA0936EBE23249F7BFC0330
SHA-256:	E15EBE1D576F47559DBBF4E6F20CF4179F4D5EE6515E14D24D0FC092BD98FE0E
SHA-512:	A5676823FD96C8C2879BFD9D53F10CFAE2F22E9002B644BA2AABEF555BA645F96161B4A73E33C5AEFBF4D0F1B172E56E7B515909A47AF37E66885FB252AF92B7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.S...,`...H....@'kr......6........=..zS......Jx...........0z.@.....5.]..j....g.:.$;...;... J.[r@<.Z.w.F....C ...9...8.V...jP....J..Q.r&.[ .~.`e...G....N#.`8A..4x.4,+.a..D}b.........../?.~.i.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.828974333375396
Encrypted:	false
SSDEEP:	6:6v/lhPKAG62Rhz+exXcXDlPkmZYKlVybvlDkVMcfFQQEfgkd928dsup:6v/7iAsT9cSClKLcwhH28uc
MD5:	28114BC1DE9084D819A48273B1B67494
SHA1:	72950CC40D78FF4BD46E4E926258050D2917BD85
SHA-256:	F46FFB35D77E9B5A863149F6003266B311D48F39CE31B9D7D844C2081FDD4EDB
SHA-512:	3B6A0C90F2D1B5E13B63957E5C13947B6AD5B7110AA2E94735692AAF8D1813216BDD03A6AC19413791BD52751CDF31700B72EDEC7ED68446980245124E29E7D8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.S...Y.y..<Dg.....!.6...`...H.=..M....[P<.cr...$p7..<{.......~vH..pF...*..H.r....."..........@...Y..X..7...2.J....(..b!..g.9@..8.74.Px...i...\M.Ox.5!-....../.R6..\|x!!.S..8...`.\|.V..!G.....H...2>.D.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.794446828813003
Encrypted:	false
SSDEEP:	6:6v/lhPKi1yPcZ+07HtWG+othOdt+Q1qBU7u3UVp:6v/7icyPcZ+4kdwQ1n2U7
MD5:	E7FD667FB86FEF48C1436E39D71914F9
SHA1:	8DCCF2F9F2DBA9D3F42F432EE00BE5529076D0F4
SHA-256:	959403EC113D31A4AC9DB72D240AE137FF452D810A955A67B09EBC5C43F45422
SHA-512:	091ADB5FE3BCB1543DCEB2BD2430B916944547048D004D28F54A3FE4319CCA31971142B6BE84C4999B93A0F051445DB7049EA6512A98DF7FFCED4FE615AFB2FD
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...,`...H....^.(.B..?.n....Lm{.......x...Q.?x.....p.....L....;\#05.^..<A.......D.0.~'0@8.DipK..'\+.....#\|x.D..#.......J..@...S.dx_.!g.....+.......]p...........Uv.P...b.x<o...5.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.730436467324297
Encrypted:	false
SSDEEP:	6:6v/lhPKtdf3aLZapX1z13ntoOu2eerk4mggptNwup:6v/7iTwavzVyOu2eerk4uptNZ
MD5:	FBFA4CF4044CBCE429A9611C57E3EDD6
SHA1:	6263422260745128F872E70AFDFB8974F5BC5C36
SHA-256:	5B0BF2F4E62739C404A8F7CCBC5472964D0B166B0C9BC2F489B7A6E0C60DC30C
SHA-512:	E7752D425013CCCB01F88D1D972346E34C1808DE120FD92D6FB2529F8488648E38F69105A93B87076C0BF1FD42C15B5FF38F896F561C05FF189BEAFF61B94CA9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .....H.4`..H....DQ.`.k.......Hy..{.Y....^2K......................p.[....?U....=..\|...B:.N..p(...#9..p..;."P...C..W....v..f....)\|~.W....!.H.U .~.....^.x..E@.p...ap.6.3.!U@..;...q5...Rp....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.801244961293114
Encrypted:	false
SSDEEP:	6:6v/lhPKVQv1y75Jqqm7J7oqk7Cvnnx+zSmh97of9KxVr/s4AU7Idp:6v/7iCdy2zViMY/hNd/4WIz
MD5:	A13BACB9D9B9FF6743916A619002088F
SHA1:	EF0F2FE25DEF3FC9FC8A174169511B08DE607DEA
SHA-256:	EF332215234923CC28F6EE5E9353216C1139F0CD5A0A49BA47B84867D22FCCAC
SHA-512:	8E98F2D91621A044CFB3F27BC9DBA55028A1D5D5A68C3871E839365F428D741879B9FDFE9461246B4C21A2D81BB76B6FC8B3A7F5051636DBC2C19AF65DEEFCB2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...,`...H..^..B..?......gA..g...)ps9.W...%..........0z.......5.S.........L.IN....w...CA....x...p..0..@.\<r....o.........\...&.L.U ..-..Fs..^.{7.F..p...i..i..a..D}b..{~...6........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.970372305104479
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWr2qWVtm4DQnLsGVp:6v/lhPKqn5QL5p
MD5:	67AFA5F73D71F066926DFB48BA1E402C
SHA1:	E888B7BAEC4651EDE8290BB85D8BEB13C6BDDB60
SHA-256:	B9D4259DE279D3BE47334411F8C216C2224AEA488B928CB21651139F94F9C0F6
SHA-512:	3C27A4A2DE473625623693F72712255F5FF80E58AA694FE7CDEF88140D6F25F8795C9E01D6FACFF3B80C31774E06C8DC4381760479546EBEEB8E1EB7D91AC866
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....0IDATx...!......w..9....7....)..............................IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.919374045620856
Encrypted:	false
SSDEEP:	6:6v/lhPKkWnm/Tw3Im/SVjydqDOQjcf1UV1J6vPxHOdLluh7iCTp:6v/7ikFVmqVjyd+cdQ/6HxSL6WU
MD5:	330C99CA686D2E33C59F71FB4065BBF4
SHA1:	873A67B823CF04DA2BDED31BC8895ED2BDED681D
SHA-256:	ACBD889523DF99F3C4A250A091B2C2A5A6C5FC8E959BCBF207A069F3266E67E9
SHA-512:	F8D63FB5874CE9838F0682C4CED02297EC1DC4C70B7BCA0084EF7E1B922B4386EC83ABE7385B823B7C65AFD468E70324BB6C55248B59C233D66671E051F511AD
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@.kt.,`...H...X .5..C...pp...=.cp..F...#..-(.. ....&..g.X..8...`\v.@5.."....T...(7........_..~(.....#.[......$.$^..'.......^<....Q.@....m..V.p.rP..?.....L%!L._.......&......s...X.L}.,..V..MLK.."...!?.G`.L...KRG<.Rn.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.926490108560441
Encrypted:	false
SSDEEP:	6:6v/lhPKiWRAc49nXjmtLsBG1UDrpqHOJpZLhieK+kIHeup:6v/7iiEAT9nSlsUWDrIHOHphiDIT
MD5:	7C2E4EC366DA858E5EA49A88DD3BE76D
SHA1:	B5E346D924564E44C08683E67E2A75E1EC9465E9
SHA-256:	AF34334FB0E34EC7FB6E77CAAFD7102C403C948CE3980D38DA71ED454FD336E7
SHA-512:	70D2C4B696476C14C0220715E6EE17D23E396AFF4038E772DDB4AAECE71A6F27FDC45CAA9133F37E2DAABE148187BE0C3D875807F993B439661C33392876BA84
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx....B!.E..5..-.@.I...\..\|~h..h{[..?.s..B.q...:..^...,Z.........*]o. ..U..mG.:.gD..... \".fG0.....^..i....4.........i.UK..,.F....C ...9@..x.7..0\|&P......'.....v....?.H.h......N#@`8As.6..W..S.F.#fH..GM.%{<....>.~.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.857188755951124
Encrypted:	false
SSDEEP:	6:6v/lhPKdbhy3JRQpIBZboWLwCGj5efEYEkR6zX9+p:6v/7iPyfQ2ZbogwCGreRR
MD5:	ED1E2CBB61C9E9E0612F0C832A212FA3
SHA1:	20FB79A1C33E9C36B394F94A4A5EA47A32B77714
SHA-256:	4FCADC07D81A14C17BD65F3111650B0EDF2193EBBC68BFDC6B9E272D1C9138EA
SHA-512:	2C13C93553E5B7A5208D234E1F21542D7713327821B87451F487ACDFC1414B98B469CE731E6FC88B418B79A390B02D7CAD30C0AF9300AC4809A25A3B0EC9A593
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.S...,`..g$...Y .5.DU[...6....=.cd*..&.e.6.:>%(..K.h%<J.....V...[.........p.k..f.?.....g..x%.R...;...F..........5......Q.....x.W....;...\|~..J.W..9..-....`e....[.....`.9AsA.<.5,+_.P..5..{..,e..Ti>..].j....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.817984626524514
Encrypted:	false
SSDEEP:	6:6v/lhPKwhcIRNCFy2aICgdytw6MsnTWVa0pO3e122uKbpb1H6p:6v/7iOzUIONe8sniVaQ7uGFQ
MD5:	FB07555BEDE28697D6221FE2C0758E6A
SHA1:	96D1718C2FBE3A7561C36038A80BC7FDA872B1B4
SHA-256:	A36AD1B2194711466D5926D81AAA7AD109FCFBBD0CA4F1C8665A0FBE1A1616CD
SHA-512:	269B2DD4F398A3D2BE69B538EA4936690E06A1025892D99467F0CAFA4BACEEE1189E6D8543975EAFEC81886E35059B1844BD54F42A544644FB6C07E5ACDDA2C4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.....:..r..-..Tv.'.r.$xYx...l..R..U.B<\..,.Wp...o.'.............;."0,....<...F`._r MH...t...Q.\|&...n.p.[..$.{.....2..G\|.L..@#....*............bl4.../.....N.^..gL.9.....3......6nH+.Q....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.8236197235677984
Encrypted:	false
SSDEEP:	6:6v/lhPKVQv1y75Jqqm7J7oqk7Cvnnx+zSmh97of9KxVr/s4AUZ7Iap:6v/7iCdy2zViMY/hNd/4S7Iw
MD5:	F0409D60AC997E788E1547413B470961
SHA1:	E033BB9D2503DE14DF3E95BF7054745669B13D1C
SHA-256:	5DF7D736A5FE9A554C0631A711B22CB1A9C308086687C5E25CFA6DACD28CA711
SHA-512:	2D9C7EC31C9AAC2E0949501F15F032E463287611142D825A44FA674034B86BD1F8A3627EACDC533AFC1112C253D152989B12563545739020E66E0C36289E2DA6
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .F.S...,`...H..^..B..?......gA..g...)ps9.W...%..........0z.......5.S.........L.IN....w...CA....x...p..0..@.\<r....o.........\...&.L.U ..-..Fs..^.{7.F..p...i..i..a..D}b..{...76nxu.[....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_brown\glass_brown.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.462644713288645
Encrypted:	false
SSDEEP:	3:5gNRYKvSEB4xORRrIz4sSn:AYKfCkRRY4sS
MD5:	0AF773CB2A3997DDBF535D0E432EE0C1
SHA1:	89CAF0038CAB38342FF96B8CDC3E8ED054294055
SHA-256:	5BC97DC3385387AA7100B2DA669C22996257189D76BB46B7C0EACF62887BF4C6
SHA-512:	68CADC0DB930D603ADD3C57A5AC12B5ED8090F573A732329D60C7C1101A482A96F1E0F3E4FA600FD478DC4D9643DAFE67B3C58E8AEACEACDB410E289BCA39719
Malicious:	false
Preview:	matchBlocks=160 95..metadata=12..method=ctm..tiles=0-47

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\0.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	7.021780859879925
Encrypted:	false
SSDEEP:	6:6v/lhPKIjrjelfgoz3sHl1dY7DizugANwBIRdxo9iN+HZMdVp:6v/7iI2fLzcHl1dYviSPYIRdxkiNSZa
MD5:	975A6C8A62EB2C6ECDC273634A6D1D8C
SHA1:	DD9A1A589CBAC2F08261AF7801D7F5BA59D58994
SHA-256:	C009CAB9A7909CD3061318248E7FF5DBDF44E13270D25BE7DC16FF2F8B1CE8A2
SHA-512:	10336BCB64F6196DC27EFD901C41AEFD1B22E384389F8AF6D2C00FABD8BF2A79243F41F5070B1D84037A4829CA5BA3E415AC80002DDB46E5BFE7A27F6AD7CD94
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..M..0.F{@......Y..v.3..9.UTPc.._.....G2...N.k;...(.....9..(.<S...x.....g....W..q.M......o.[...\|.s. .QpH`7~.......@6..Y..X...P.xI(+........=....1.H....m..V.p.R....qu."...X....y`5.C..........D.d.N.\...:..s...p@...8(.>.........7!1Tl.W......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.974768342599405
Encrypted:	false
SSDEEP:	6:6v/lhPKBIcpIdf0/Kgz0YG/FbxNdRV/1tZ1XPeVSFUsg/Vp:6v/7iXpcc/KjDFxXzNL1XPeoUb
MD5:	7E21443DBE37113233A33A615E5B1135
SHA1:	2875474B4371684BCCF99EE115CB472C31DD3DFB
SHA-256:	4ECE848C2F66C7AA96CBA91720B9EAE7D8B5D293C0C222CF50FE2EFA2C7F02BF
SHA-512:	8467C1D4881843F308133B0887B15D38F255148130CF71C38C9C923B5B60A34AA3073FED6300D338FE1B212EDF480169285B99639264DD68E75989FB8D5E0B56
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.E{@.....H.#ef..z.....!@..o7...U.S.....r..Z;%.Z5.<....{..,..<K../.......................k.ko.d.\#..-.4M(..=...MA$...].m..."....T'.F.d.9".....Fr....JR...\..2.et...o....dl....FD..g. 0....0..V..S.E.3fH..'....M;J..v.wn*.L.'RBU....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.825877278477409
Encrypted:	false
SSDEEP:	6:6v/lhPKiqxFtW4fQH3jEvFpXUZWYKCoX88wV1Wt1PUQorp:6v/7ih4HXAnXUZpETwHA8F
MD5:	6FA23522599697FD045E9FB2364F57DA
SHA1:	060EECA359CDD315BAE2633548A63532E3977090
SHA-256:	96C4C0C3DB95FCF5C4C856181012548E5FB3974F4367E569C268A559D48E5741
SHA-512:	E7C388E6532C75320D5D58DF4334F63874C8338D7D2C769A38FE8B3A6215F374D26C249F58631676E4447BBB3EED8433F4F3C27503D055FDB09297C4E7A2D22A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..=..0.Fu..#.......s.....J[.H.~.o..a....m)\;......>..G....t.U.=.V.F.... \..w.F`h...:..a.'.....).p..@..P...-9 .p..;\#...!.....`.s\.M..;...>?....mV.....H......\._.....`0... ......n.* QC,U..o]=20...%....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.734999204486554
Encrypted:	false
SSDEEP:	6:6v/lhPKd+AlejLlO1zNZLSCB/sUUqFSlbmv5ocaoCOvGVp:6v/7iD3aCCU6UBRjE7
MD5:	D5727020916677D4F404313AFFDAC83D
SHA1:	ED321C08DFB2494A1816CAA5D0FEEEB36BD2CE44
SHA-256:	FC2C7CA17A111E0A4EE8DE5788A3FCECE741E1F1A54562072A80F557CB9BAF9F
SHA-512:	0B032ED7A96B6BC3C766227B4C64A842387B23941455804384F75952206677EC8B6DEBA7E994ACCE557C7EC2A4021455E2C9455E75916FCCD63306499E2B51C3
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0....{...R#........;.8....Q...)...p.J..^.Y.;...@<...^;".A."..p.@..zQ.y....@..dG.....h ...0.H..'.*.....Ax..`..#.d.9.....;.J....U.....%..+..?....\.O.@..." `8A{A..1...iH.P.v.&.....O20+^".....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.903878373601458
Encrypted:	false
SSDEEP:	6:6v/lhPKzFO2VeTB25kngUfKcUJ1IkYTd1Mjp:6v/7iVmvgUycQ1na1+
MD5:	6FD69CA891D6119036D04C4E1058CBE0
SHA1:	854DBEF674B0B1D59ED99D7C7AFFF03F41C138DF
SHA-256:	F8AF8037A9F80D34AEACAB856CDDD762638EB875F70480EB5E7C121A37291B67
SHA-512:	586D5679A18E18E499EF75AC9670AA545098FE4DFE5A294D89BB2759A3E2CBE57E7E2B2A8A8BE42969F378C818A67174BAE36F417E199FBEDD3EC85C3EF9312E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F3`.......{..^ .5.6..... ...=lY.....Q;Q.Q..-.; x....(...&p..p.Y...f.rn.K`u..#..?..............X.Wr.}W....d'\Z......$.$^R....*.l......#.....S.]u....A.....WS..O.$..mE........).-.>.(8.T..,N..`....s....`..'.`..[..H...PK..XG.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.807332729948431
Encrypted:	false
SSDEEP:	6:6v/lhPK/QvKmx+0QwXARQp1qNl5IrYq19t/Ry6THvIU4Z6gYgnq/ljp:6v/7ie/ARuEIEqjSevILZ64q/7
MD5:	A016C2325E9CECABF3053A48F99A5C16
SHA1:	DA9EF47EBA3EE623E7569E86E396B8EB7D28143D
SHA-256:	4928B88B9D62737824C118032D6666CEEF4F6E48823CFC9AE9CF82B58291B99C
SHA-512:	BAB7E2E60D030B3699CC43396B3F8381AD34CCCF11F98772DE4B9A15A54F267C243C353734C95C18710BDAC052E562FE43859A139C6B2F27E4D76F152AD506B4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.Es..#.......;...@O...R..H..=.2..#....r....:%..4.<?...l]....%p..v.W.".^.B.;".@8#....p.\|.m..k..x$...e..'PA.).d..r...W<A$........,8G..9....H...@I.....@&..].4..-0..)@.F.....(..,....4...{^..=EY.8c...p...fN.z...B.{.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.881101481427512
Encrypted:	false
SSDEEP:	6:6v/lhPKaUpaGK8Gvf53SVYw0xx3Xzj3gFk61qkS8UJrPJTh0bp:6v/7iRNKXvf53SV2xKFkuX1Ulf2
MD5:	D3C4B13D1B0AAA9FD5BEBE6D16553E11
SHA1:	4D8E636F701505FD3A773257D593A98307EF0B84
SHA-256:	9264F96592B87602720BDF3207E6F70DA742230BE93F7FC1B3ECFC1D99DC698F
SHA-512:	CAA003FC2243D78805B3461384B012D5B8BA1E5C8C837C7498FAF2A7D7913610B02F7D01B750386DF39F15235C173E3276B1B0CC84F0DA6F0BB9E430D5DDA5AF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1.. .E9`..X.<#1w..r..KT.U...f....).#......tf.I9>.)zDF..J8K.....................[..e.?i....3.....)B:.J..p....=}@#.V.p.E.9.-B...> ..8.wY........p.dx...d.....b,.....Ht.Y..lN.\..g.....*..!.9.O....:\.?D.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.85028257043095
Encrypted:	false
SSDEEP:	6:6v/lhPKdQv1m/Sm+twT9p+IP/KnyznOdlJE/E7XNsy5+5wIRNllsup:6v/7iK8tuG+IoyLyoM7Xqy5+5wglN
MD5:	901237F4F2CB755291C6DBFCF49085AB
SHA1:	8492B21A597AB840C555EC29C152A8B238DE6AAC
SHA-256:	B7624F840D6691C366897A16939FF35A8DCBD673484090EA2F540E8169F3E962
SHA-512:	8B02EF9E8A426ACBCD7950F30C7D73CA6207FC1D9C93EC72A9B9F278F166E15C4D29E2A9F23B16C5F7D1A998F876E553163D65EE64902D81722FEEDB4D370D35
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.@.0sd..:.k$..7...d..).....W.8........8.A.x..qM.<..1T6...^..k....Y......N8z......t.....l.......d.........8.5.W......f....,8F..0n.\|...>..T\|....@&.rI...?..j...(.-..^H 8.T..,N..`..t+..&..F.J..zH..E.O.WB...[.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.870778555511043
Encrypted:	false
SSDEEP:	6:6v/lhPKzK46xEY5oS++KR1TqctDnu0m9FAfAC6aKcp:6v/7ixq2+K3pu0Q6AgKO
MD5:	5381E4C01C775E5033CF44484F4F06CF
SHA1:	6644A632F201DB5CB9B04DEFE94ABBFD6C8ABE16
SHA-256:	9781A2AA63A6AB4B6EE0D7BAC198EA166A2B4ED91DDA4A550266BD7B48B39F25
SHA-512:	A7D9633FD9144275224B55D2AE1C71F826DF7F068236211342027A1F94AD534196733D54AC4C0D5B8780FA4F56D175C40A089C1875ADEB507D09CA9866CE1D22
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.Es..........;...@N...R.bK.R<h3y.X........:..%Q....,..<K`...z..E.....vD..pF.../............4.H6M..,xO..pS..,...h..x.Hf.-......Yp...rn.;.....=...>?..?.Lx.].t&.[.t.....-.>z.Qt.Y...'h.8..y.s..e....R+.Y.......A.....bC.7.z.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	275
Entropy (8bit):	6.848547861879165
Encrypted:	false
SSDEEP:	6:6v/lhPKlaUhocv6+Au8f9hhVHKI/2VkAky9pJKxxd29UrykpVdc5XH+UoVp:6v/7iJKqAhsIKFkmpJMq9C8Hm
MD5:	A79536DDBE93B9619603FEBDBD5D0EF4
SHA1:	7421693B50872640AB9C845621EFDCCE1CB4AFDF
SHA-256:	1E82BF7308D12F8AD7988FF18B069AB402E8C43E78B526D5FD98F2E550D295CB
SHA-512:	4D563B5326727AB380B3198072104AFC9DD2EB26451AB861CB03053C8D27A77FC22C9A72F60472698D13933A22DE46AB785DBBC73099C188AFD4B768164C411C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.E}....@.+1[..9g..r.&C...m.`..H.=..M.=......cr>...f.n..<{....j..?;$PA8#..p.@.$mE..\|K..)..........@...)..>.....\|".k.H.(..B....s...x.oh...n.....>.....<jBZ..9.W.?.H.h.....N$@.p...Up..#wC.\N.s;...b&....>C.&\|.Q....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264
Entropy (8bit):	6.885959873459606
Encrypted:	false
SSDEEP:	6:6v/lhPKsfzP5WP3pN/BgYucZpqcdF8kfb5xZNr1uAFi8ecp:6v/7imzU/pN5gtcmMKkfb5xb1Ni89
MD5:	50EAF54AB71B88D4430E300CA74CB031
SHA1:	886C0D6F2A920384B17BCE606794EA0737C415A8
SHA-256:	2962EA79686C32EB2C1B2359237444FCD920BC7431BFB2199A225E38652EF9E8
SHA-512:	240FE286A2936AACA43B22CB5C82208CFAED0B90CF704C3385D912A633D3C88E295B0D7E1E6411FDA743E8A31F66AEC71073B3391AA984038A6F8C1E1813CD78
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1.. .E}..#...+yFb..3..9Y.%..(`...........n.L...7.....f..vx.]o.`..U..cG....D....h.M/."W....h..lH.....*...(.n...k.....j.W..(.x.....o....(A.s.\../.&.L..@:.W........n8...........p.9.C.$....\|.....>_v.;.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	270
Entropy (8bit):	6.843320537130193
Encrypted:	false
SSDEEP:	6:6v/lhPK7Qvw8OSa0O095p/UjxFG30x/ICf/krKxwfup:6v/7i8+0/ax/x/Im4fc
MD5:	620695BA0FB142CF46F53C7C6B973E8F
SHA1:	26871C7D76DD25937CC2D05FD716A93DD2FC511E
SHA-256:	800E6CE64B0E398013B7F9BCE755605E2B86C484ACBB5C624B48C9B96C9AD601
SHA-512:	8EFC162D21095291EA506C79F8D001BC12AC467B285A8D988BC6EC7088DD81F7066248183506C5AF0C972C2D552B2BB22243D548CA3278D3D23543F484F60F83
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1.. .E9`...X.<#1g..z...d.....x..)~O.cpx..o..S\|.ar.A^.#p3....K@..i..?;$.A8#..p.@.$.E......C...%{.7...M...GgAU`.\|..%....D..p.@..'..+8k...,.1..9..%.F..zpU.,....~;.W.O.$l4.x.BB..'. p8A{.*...=wC.\N.r;v]....;.h.+x....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.8940745787005975
Encrypted:	false
SSDEEP:	6:6v/lhPKeajKu+74XAXN8zcHR0pbKU5PWEBvpY5T1qN9weBvcJ8Tp:6v/7iTKuLYHR0pHPWoRYxsLweiJ89
MD5:	052D8AE67784EEAF09AD46622AB74333
SHA1:	6D4A2122326F939BE77CD2B8561E3CB747C793EC
SHA-256:	FFF1E7D39BF2F30C72B9F3EA09B74E9E346B4E43F61502B01A563B3A7AF89731
SHA-512:	EBAAD2E96A87A2C530EE09F74DB838F8AE7E9E166464F38E320872FF58E440E4D7267F2B2B43A7F6C1E90749CFAFAC97B1CC22B201F31E0889D3A03DF2B96945
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.E9`.. ..-y..3.~M..j.....2Y~O1..t.?.I=..k...Tr....Jx..........0..........[..e.?.#H.k..x%....+... *.{r@".V.p.E.;.=B ...9...8.V..ZR..<\T.o.&.J..@9.S.........n8.......e...p[....H..K.1.1...y.$oC....o....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.79353336578125
Encrypted:	false
SSDEEP:	6:6v/lhPKVQvqx64U4fQEyMOpzVSAAUwOUFQriEyuSNVjHjQ46bp:6v/7iCSYvHE+VFwhGyuSNPM
MD5:	A3008A3912C10B869A5518554AB15B1D
SHA1:	8C4326728F55A72CBB27FB2E16DE0CBD84C61E35
SHA-256:	EE6CC32A3A5BEB5FD8A4BFA989E42550B92A628D55E7CFE244372462B9F8F1CD
SHA-512:	8D3CD519371324AA6DD9C9E3F08406FDD6105E7F02AD989A88AF0E68FD67E1D9A8C4ED66598664421F7F20F00239AC59B4DB8842029305ED5BAF1CFA6B300EF5
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..=..0.Fu..#.......{..,..J[.H.~.o..a.....R.6.<\..}T...8...~..{....^;"0@. ..p.....gu....O...%.R...;... J.[r@<.Z.w.F....C ...9....*.w.-(\|~..%...9..-....`e...g....N#.`8AsA.<.....0T@...S`...w.)2..1......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.8736691552340865
Encrypted:	false
SSDEEP:	6:6v/lhPK8Wqx91XctbIrqOkJoIpE5ykP9o2ddUJ8up:6v/7i89L1XctbuqZ3WFo6U8c
MD5:	ED1EF93E74F0ACDFB0F4FFFD131B8189
SHA1:	350B7C1E78142E4230485B36806EE63EC561B5EA
SHA-256:	51136E230086A45C11C98870BD1525BA46124FF6E45959E01AB81E4A05CEEFCF
SHA-512:	E9F871BA7545BACD50EEC4B6C40A401D1A88E4B573E863FA8D12A4CF0A072FAAE8D80294D253FE082824BE2D8A712E1E7D13384368AC2C4739A84D3EA24FEE48
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..=..0.Fu..#.......{...i.P..G..3h3~.[....\|.[-E.R.....Q%<J..ow.[...n.`........p.k..f..........I.....W...CA....x...p.@7..@.\<r....7U..ZP..>.J..Y.r&._ ..+..Fs..^.{7.F..p..4x.o.T.....5.R.h....'.2..8?.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	258
Entropy (8bit):	6.888577736964645
Encrypted:	false
SSDEEP:	6:6v/lhPK3Qvqx91XWgIrqOkJoIpE56dBaXUbISW/Vp:6v/7iNL1XWguqZ3W6WXUbkz
MD5:	30CCD48CDF799DC65D196D4CDE236BC3
SHA1:	371D34DC39C2B451B18387201DAD17C2AEEB1F06
SHA-256:	ED328E9041E004A4085225F7CBCD38D5EBD1E7409A0FCB45B879A6DC3581E94D
SHA-512:	79F57716DC171ADC6DAF4D6E94FC1421266FAC7C95BB6A3057BE4AD69A09BD6D5F1FBBF6DEC785606215F30D6B3D37BE21C9724F2B9ADF450AA4AB1B4B7644C8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..=..0.Fu..#.......{...i.P..G..3h3~.[....\|.[-E.R.....Q%<J..ow.[...n.`........p.k..f..........I.....W...CA....x...p.@7..@.\<r....7U..ZP....%...9../....`e...g....N#.`8A..4x.4\*.a..D}b..k..7'K20."D7....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.762399712432488
Encrypted:	false
SSDEEP:	6:6v/lhPKw+AlejLlNpykkVZWhu/zK4Kj0M0X578yA5y7qQLV7p:6v/7iAU6zmkzKj0M0JQb5+fD
MD5:	FA3D2F18D6E518A56352E9A6B6A25C1B
SHA1:	E5B8C02ED91F87AE9A5A9EC99384EBAE1EC5B6C7
SHA-256:	D36884E03A77A2567065F916AD5919BEA5619BAB852F489FD7E8D131E084D5AB
SHA-512:	F5FA7BA76FB64660E432A755EB2EAB1EFB1BC8C5A2BFC28293CF41D61F9B96CD3F47B41B38B1FCF41494B87ECE6FBE94DA51CDC8B7E37EB62825AC482BC016CB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0....{...R#.........;.8....Q....VSV...d.....vxe?.x.G...vD..pE.....n9.....4....~.4!.~'.@8.Da..PO.U..n.h...!...G...s..]2.w...>......S.J$.W .~..c....~.x7.E@.p...08c.N..*...8u=_..]205.e.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.926557024745785
Encrypted:	false
SSDEEP:	6:6v/lhPKiGK48IclJVskbR0uggZQk8ylYigiwiIrv/PRZIcCtjp:6v/7iiv7JB+sCylYigiw9v3RartN
MD5:	62C32036018A5D13A53743472DB85789
SHA1:	D9CC06E8D50B90BEAE755A2CCA5C858B1F0E9519
SHA-256:	D5C020E34731B6CA257B81A3B2940A21A1B8217C9CB07769E19AFE3CC4116EBF
SHA-512:	AC0E04BEFF593F4DB48803043805A3C38B290E1EB4AE292B5E1DB5A1E6C5DA7E1EFA635867A8A243B40562F71643B0F5B76883C2A499908B236E6E9F580A8BD9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.Es..........;..._.!...#...t....a+?.r...^.IU....%..,p.....W ..n.....XA."......-....."....V.<{.)..7.2..fAU`.....KNY.@4.%.;.9B.......8.......D....WU..O.&,.ce.....7.q6Z..t"...s...N.^0..5....Pg.....I...DC@9QW.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	261
Entropy (8bit):	6.816792698263988
Encrypted:	false
SSDEEP:	6:6v/lhPKOG9xlhWiPILvMvNHRbmf7rCTxJgbl3ysgup:6v/7iO0xLIYc4xCRBgc
MD5:	2E189B27A2D328339EED26920433714B
SHA1:	AE6C33081CB9C09E28D4FCADF50DBFF8EBC7C17C
SHA-256:	C4072FD920787E46E0C9A003319ECF31DA59916C094B59B05C790B1E41E0D492
SHA-512:	695C6C4453254D1CEBA8A6151223324B54767758309B089E748CB6E4AE85A20B287310960FF6922032A3D43CE59A38A4D626C4F1C066514820864D151DDAC457
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A..1.E.....MX7..5g.~...Q..>..`.^..-..r..u..-Q.....<K..o.-...W..cG...gD .........H.\#0.+94C(U.@.. ....h..y.H........,8G..9..o$.`.L.%.....K ...cZ...X... ...~D.=p.........=.b....r9...Uu...:\..d.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	247
Entropy (8bit):	6.7799534898652585
Encrypted:	false
SSDEEP:	6:6v/lhPK4Gk0OdnKEePKlWYHsGB26WYiCttKoux/ZU4PFup:6v/7i430OdKEehyl2OtJux/xm
MD5:	694AB043058D6E02017496186AE96E32
SHA1:	446F37C9CDA72D5BA45E0A552358D9F38FB8A0C9
SHA-256:	32815AFE2F0C1B9EE2C92E228399E5CC5793C07DCE8CC584577325298EA294BC
SHA-512:	1CD279E9D943D632BE6E1EC573CD0147312A2EAAB7093693AB0B758503926827840849D369F2FBC52A924F0021BD87D14103B468396BE36AF7E8481DDA58278E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..!..y..X.\#Q.4Qt..f.F).2#l."..g.Y.x..Jv.L.Y.oxa.@<...^;".@."..p.@.......\|F..O.!CH......(..........-.u.^=.Xp...Yl.'..NxO....R0...P".W.p.......>z..=p...........0..T.....T...1x.qSF....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.932877507651282
Encrypted:	false
SSDEEP:	6:6v/lhPKdrfSJz/3fZ3SlPk0UnAdJ8sCHiF2KtQEN928ZVp:6v/7iyjv9p0tQjH5KX28Z7
MD5:	0F6287AD5AEFD41D16A45A031B5280F4
SHA1:	F4E43AC52F66A9F4B5D405D2A8FD8EEE5B7FFB83
SHA-256:	798D6DAD1F5A1AC243F617293A26F33E2E99C422ED8E8BE820FE71F24EDD0C5B
SHA-512:	46E2514A53932DC977586D8754E144A3386D27885F9FF2D4518C8795F7104AFC13112F5BCC1874C0A5F1598D8D9E7BDF0ADDB186B29A26BB36705DDF3CC689B1
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.E}....@.+1[..g.......6..Q..H.=..M..[`..19....$p7..<{.......~vH..pF...*..H....3..E...%G.w...].....)...nBM.ee>..5\%P&..B....s.&.q.oh...n.....\M.Ox.5!-.....'.R6..\|x!!.S..8...`.\|.V..!G.....H....:\X)......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	274
Entropy (8bit):	6.862663723897006
Encrypted:	false
SSDEEP:	6:6v/lhPKWgrQVIFa8JE08H+L8ghfB11S7l4CzTGfrVbbzwVhJ/OVp:6v/7i8VIo8vi+L8ghf1SR4CHGDVzwc7
MD5:	AAD6543CE1EA6F476BE6DB73A9223040
SHA1:	D22A5F8359712ACEFB42A3C0BBC1F1E74531452A
SHA-256:	E51EA976E66F4BDAAD7EA08FDCCD3EB55560BCEE85957E89EDC1CB5B87ED112F
SHA-512:	8AD71694DDE9F1E41A1C62D7A7AC6C37D53F91D9DFC7BE32FA97B52ABE3502E16EDF28DCBF2483F5133DC9EFF50A44C9027E42A721033BE22E9D1CD5DCD10D9E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.E.0s...u$.H..!.d.....$...>...........T..(.{.j]....%p..t.U.<.V.B.... ...w.K`.p.\|....K.:x%...G.\|&.@.*.F.\s...W-A4....f.7..(8{.......H...@......@$...c:..-p:.S....._....4....4.......{...p..)....$.....N:..I......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	265
Entropy (8bit):	6.878631071278779
Encrypted:	false
SSDEEP:	6:6v/lhPK/bCqgOlft0aNNEERUtpp8pJQ/m42KSuTPx4DEa5xxdo/kup:6v/7i/NFlftFfEmKgJ9dKSuTPJsdo1
MD5:	BD14A74816E14099B95B8B97FBE3C169
SHA1:	B9F8F3CCDBFCCBD87550BB79C08C0A7A650A827D
SHA-256:	6731FBFF17957B4A7F485FF1D9B4F9BD81B4409EC47961C28C7007BAA1B22C32
SHA-512:	B1B91AECD7170AE7DF1E132FC9583E689749B2F170310A89A0F23ADD91C505868845A44F0FC746151F9F36EE49349114FED7A1BC1CB41A0E52A79E29D525785D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....1.E= s..Vj..RS3.-.d..B.....S........r...A...3..R..h.....^.2..+..p....... ."..p.@.l.'.9..\|F..W.#EH...4..5.4....H.U .n.hNx..`.kD.P.q.......R..y.$.^FE...o.t.....-.>...]p.....4.......5..T....g.x..n:..(.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.883332010216641
Encrypted:	false
SSDEEP:	6:6v/lhPKkWuXzPWwxU4pIQtn8sPX3TXfPCbNI7ORgxSaalcfP3lpMISUCXEopMjp:6v/7ikRz+upIQR8i3bfyqb4Clrnh
MD5:	E4A901D82EE99609BCD44693ECF43565
SHA1:	972CE72717E3E1B879AD14899A0ACBDDDC20A4A3
SHA-256:	0763CF3D92DAE82C9A776A34600DF0E508A84B9D952D0C5676991E85C02DD038
SHA-512:	BB969CEF18084129900BD9482CBCAF02902E075BB8D003DBC28E3A5E7AEAE21FA98DABEA0151071F98010C4DAC68C321F9511D2CC80EBAEF8A1D3738C2DAC687
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..;.. .@}......+yFb.3..=Y.J..R.?..!".'p..........q....;c......x....@..Z...n.(F8Y...".".............}....7...>Z......I(I.$.O$....d%<{.D....r;...T........s=......KB...9.g.O.(L4.x.B...'.@cq2....[1971..."...!?........rL..IE.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264
Entropy (8bit):	6.883822529077713
Encrypted:	false
SSDEEP:	6:6v/lhPKcxU/+WKG0zaDcD05jGosQwrH1TeFVx7FaenAAytEoK4Xjp:6v/7iygHKPKcD0dGpQsKtoK4XN
MD5:	383AE7FBA542A3C258F035F06E9884D9
SHA1:	D243291EC2E5B87A234F9446371BFA26B10B13BB
SHA-256:	16E341E66FB1DB5EF3B93203C69BA76C24D4AA086479B46130A4DF2DB1339B9E
SHA-512:	14E3202FE21F932F6796F1ED1F44FA33149DCFA36EA58A8ABFE08AF70B35E211BBD1275EADD9B7FBC45CE889D04AEF2E67789A16992F54514C686FD152EE8834
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....1.Eo@.`.+5..H..=..0.w..t...o.p..b.'^...c.kV-....e...Q...D..<.V.B...h ...w.[@@.F..Z Yp.@..d...d.{......d.Gn.v..%.$.>"P...!..g.. c;>..........z.~.D...sL3.G..........GD..7"@`8A{.4..W..!g......./..:..G.e....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.746361755894826
Encrypted:	false
SSDEEP:	6:6v/lhPKeajJz03MQ5O2fh6ljOxN6QWck47YNOqnofTp:6v/7iTOfhZxHsOqnoF
MD5:	8E571F823D8D635B76EC48C53DD013B9
SHA1:	453DB313289B5D5AB4DC3EE2AF44507A1D54C148
SHA-256:	AA8921DAEA6DAE821E5D7AA288BCDDA8AFA73F8DCA5A324999837D3A4CFE22D2
SHA-512:	E56A347199EC11FA1EFE47A6868A8046779488168FA15041E67472DE430EE25BACAF7E045A1436AA0E10C3CD79D16E33C94D54235D1D9F52ECB3E242977857AF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.E9`.. .<[..g..z.&KT5Q0\|...d.=...z<_...1.Hh.,A.[XZG3.Q.;........*..oG.:....;\#.5.^.!G........H.........Q.....'\+....4#.y.D..G.`.q..f...JP.9=\../R.r&._ ..+..Bs.K....N#.`s..4x.k..\|.C.j....\|.'d1_..:...\|o....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	250
Entropy (8bit):	6.655805120034338
Encrypted:	false
SSDEEP:	6:6v/lhPK+PF8iekAKtBa6oQitjg+jA+EW66FVnrpldp:6v/7ie81HKtgjA+G4nrplz
MD5:	B18191D8FAF3948AC21D0255563DDD15
SHA1:	90027A6B7245A3732202BC8C7D0144550BD48F45
SHA-256:	43E5B1E41576DE5B4E27AE348DEC11C1530912761890B1AECB5ADCCB762927B3
SHA-512:	ABD4AA91EC527A99E9E00CD4FE5C2F4793614F4520209D1773708656AFF91BF2B2D56ACFF99EFB21F1D64EF08FF6BAB9B7477DFC6A587CE301B4E18760548748
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1.. .E9`..X.<#1.:9Y....0...W..6."m.c_Y.x..JV...Y.oxf.@<...^;"PA."..p.@..zS.i..>"P.'Y.!..[...CA.......[.....2./..,.z.L....i%.%.I..R0<..P"..........{..=p...........p_........:..c1.9.e.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.783788962688618
Encrypted:	false
SSDEEP:	6:6v/lhPKdAsgYcl3B/E2QEjibn6nN7SHSduy8j47aHTxQp:6v/7iaOclRMfEx7By2aU
MD5:	C3AA6402A3D881AF111B39CC44433A78
SHA1:	B3534EA544123DA5DF0417B0723F4E988A7CAF34
SHA-256:	B109DA6A11B5D02E84F0912E7F34355A5092692C47DA94FF1807EE422074B0ED
SHA-512:	1C9E03C143AC01C0499258B75FFB21266FE0632FAAA8CCD741EF658AF3674E1493836A17A015B3199DFD156BBBD2F8DDD3460954A2215F15FE665A11D6B6FD09
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1.. .E9`...,.H...{....REi.`..=x.=....c{....u/......>..~....z.......-..r......3.....iB:.J..p(...+9..p..;."....C..W.......w._.4R......owM(..@8.( .Fs.....n8.......ap.4..............1........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.749688329425066
Encrypted:	false
SSDEEP:	6:6v/lhPKgy0lejLlC1tLfjJ9eYWtng1CKM8pwf1TN11Tn01gEnU1B0sGap:6v/7iwXzjJwhOCX8pAvn0O0Ub0sV
MD5:	0E492F170CC89FEB8E4E481197358038
SHA1:	10C3A7D7FED54915A67569ED65B9C9FE1236B0A1
SHA-256:	D0139124C29D96D41C002CBA4EDEB5E89A94090AAF73A005E7A2760586EC1B00
SHA-512:	1E3A6EC641BA316668E4F622404F129CA647923B4C58F7F281CCFFD2BE8DCD8CD0E83382116F6C8904DDD57F7467474E91082A523C6D8A4500F99237EDD6EC81
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0....{...R#........;.q...mf.;k%}.e.j.U.x.n%....,....-..x.....T....;."P-.^TAZ@...T.IVd...;... ....z...p.@.....\=r@:.q.w.......[\)....P"............{.,...../..3..4r.R...Z...20...5....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.783805924391902
Encrypted:	false
SSDEEP:	6:6v/lhPKVQvqx64U4fQEyMOpzVSAAUwOUFQriEyuSNVjHjYXsup:6v/7iCSYvHE+VFwhGyuSNzc
MD5:	258ACBBF9C940B2C9BF132FB2B4EA7E9
SHA1:	26F284611EFABC6EDDFFCD121928F5372C0DD5A1
SHA-256:	39BAF2A6E815FF4B7D2E69C225FCD5BF2506D51BFCA643FE2D93CF646C769799
SHA-512:	C7E02B56AA86F6DDF802281BB3396140837FAC850975099479C629A79F7788D238F2952BBE1E26685C3DE0DC42506F33FEF97E2BEB08FAC5B182AB73DC5497B4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..=..0.Fu..#.......{..,..J[.H.~.o..a.....R.6.<\..}T...8...~..{....^;"0@. ..p.....gu....O...%.R...;... J.[r@<.Z.w.F....C ...9....*.w.-(\|~..%...9..-....`e...g....N#.`8AsA.<.....0T@...S`...w..20.d.@....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.946604658793157
Encrypted:	false
SSDEEP:	6:6v/lhPKz1Pp06TPYbNMcAkdENDwEXNi78tjXDFed1V1Ucbpkbp:6v/7ixHrbcAkdbEXN1bj1
MD5:	7A9652F4DAC43D85EB14FF5465CC08D2
SHA1:	053C1B403EBF53FED7F8E4E915A63AC067EF7C7F
SHA-256:	32EAE664D17AE36E589F94EAE7F2FDBD07747E7AA91642AE4A495C567F22734A
SHA-512:	05662F7E42AEDAAC285A140CA7E09C818BD3A153F9AFB0D136F52A58CFB0A09FDF28A08E49EC8E2E7128CD0F61B5C394D6DDC4EA3D9DA278CE9BE58A7E5FA295
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1.. .Es......+yFb....@N.DJ...l....H.=ac.v{<...EQ6G.>.V.H.n.'<x.......n;$.@8#..p.@R,Z...{>..".H .G...S..... \......."..^P.....8....^p...4..w.....o. 85......",.m...\.....,4.x.AB.... .9As.,...W..r8e..x.$..;!Yc....L..N.!....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	270
Entropy (8bit):	6.844408357934336
Encrypted:	false
SSDEEP:	6:6v/lhPK7Qvq+PKMhl9v0dFleB2zn5ClYwhpSKtW8hf1hp:6v/7iX0KKIleYzglY+pHxfx
MD5:	6C41242BC103DF015496BBF5F6867C4B
SHA1:	C4D8E67946B0BA9E37ABCB5050AF089460EC8C56
SHA-256:	F16516A19DA7FC32E1E8B9544037E0360D06168DD875C7721B777A4AF9BE7EF5
SHA-512:	A326C9C1DF8EAB8C193C5CA1250406608FC4524E4F8024D05FA4437B8964DF6C4CDA6C11A528E93CAFD550D2988593668BFBD0F991B71EDD2D5E788D4327927F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....1.Eo@.`.+5..H..=..0.w. .(...p{.......r..u.-P...,..<J.......\|V....4...;.% \#_{-.,.F..G.i.P..=...MA$Yp.)..^..".[..$.z.D..#.h....Fr....JP..\\..".et..J...r.......>z....Y...'h/X..y.s.n..)Gn.....dP..<.;.CjV.b.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	255
Entropy (8bit):	6.916459881128708
Encrypted:	false
SSDEEP:	6:6v/lhPKxbNXtCOBRYwySMPB7SwrTAgFk6GzNLR+mkArHWjrD2/2up:6v/7iTr0SYBFkFRhRW67
MD5:	8EAEBBA894A1160FFA53BE4515A132B7
SHA1:	D31405B7F4045FF6C0350759EFA2338EBD96F479
SHA-256:	0E8575694C64A569959F583CDFCDF6AD460229426806103A0714C87930D9E953
SHA-512:	6DCE73B1396A0AAC18433530A05094BD9A9A0C77A0BFE18A77CFB2D9EF2FCCD56EA324A253806609392A0435FDDD879CCE1AD1805F243CB6C1ACE808BBB03B18
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..!..y`.q...#.F.N.7..I.S.;...5.[...Z......Bl...U.Sp...^.W .p.....t...@8.".-MO.!W@...t.Ivd...+... J.{r@#.V.p.E.9.-B......u..]V..*)\|...$..h.%../.......G.@..." `8A..48c.n+.!U@..........d:.5Z.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.827489693032901
Encrypted:	false
SSDEEP:	6:6v/lhPKiWaUhoc3ZVmCLQgIGcufU8vxkAMTJlDbExh/zsbp:6v/7iisKYmyIGXkAalo7s1
MD5:	14B0137DF34D0A65FFA55D1ECB2D0EAB
SHA1:	125C57B3D159DFF58D582C1F113EC213D95F4CC9
SHA-256:	068FCBC4B2F6EDAFF65FDEF375D34215A0E1B91A1198CA2777456F496794951A
SHA-512:	EA852D46A9703E304DC0AB94E23059EFA03CD8D9694A2AC12BC6AF12760974633B8457F2C58C82FE1D1523A2AD73FB78E6D3A549C98520AE22B9A5FF8DA812BC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.E}....@.+1[..9g..z.6C.&..\|...H.=..M.=.........Z% ......].r......@...x.U.U......--....K....D....KgAS`.\.....\|.o.J....C ...s.....oh...n.r..9.\M.Hx.5!M._......R6..\|x!!.S..8...`..t+.!.\N9r;...B......Cjb.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.8719081559128385
Encrypted:	false
SSDEEP:	6:6v/lhPK/QvKmx+7Iw3zQa5IrYq19t/Ry6THvIU4Z6gYHmz9p:6v/7ieW9lIEqjSevILZ6s
MD5:	46F264D10E6B7A952089B92AC79189DA
SHA1:	494C6B552BE2299D87CDEAABB14970FFA9F27E1B
SHA-256:	AFC6963506A54CFEE7A9758E5E6CF0BC36F7DF8A44345C580882319E031B1B18
SHA-512:	62DFBB764A49764CDD14B46D4D15ED8EC1254718DD4F60BC2AF739DB2BE91494869D6C9A58F6E63F60E4226795D1C371B7E4565C3EEFFB4654F3F74B83A5BC40
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.Es..#.......;...@N...R..H..=.2..#....r..Gm..gm.Z..kB.Qt..K@...x..v.W.".^.B.;".@8#....p.\|.m..k..x$...e..'PA.).d..r...W<A$........,8G..9....H...@I.....@&..].4..-0..)@.F.....(..,....4...{^..=EY.8c...p...fN....gCZ........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	258
Entropy (8bit):	6.722115643587929
Encrypted:	false
SSDEEP:	6:6v/lhPK3QvR5QOxylcMWS+Iayo6mE1f5QP10uPk9aigLza2QNqVp:6v/7igQ3Kryjzn41XMUiqa2Qk7
MD5:	4DF0A5757E3C64BC6FA51A199106F628
SHA1:	4396BD49C10D7EF01D441CF486A57754F6C7E6F4
SHA-256:	71536F92AAC16251A30D158AE12967189ECDDED127C84F470FAEB6A467EE2985
SHA-512:	207DC095C5B74C4BE437CCAB4B44768F40FCD7D76E47FA4E75726D1F3DA45DDD83A86C03325FDDC6F4CFF34AE499025ED6B8AD71EF749210CA2838D8F94EBA09
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....1.E3 s..Vj$.RS3..0.w.B.....S...)ql.\...mU....U.Sp.....+...W@.cG.:.WD .n....+..g.:.$;.t..@... J.{.F...p.@s.[.....s@.....e%.L........:jB.....?...h!..+....8...A............. Su^.;$nX@.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	269
Entropy (8bit):	6.8658318412726915
Encrypted:	false
SSDEEP:	6:6v/lhPKHaUhfkBUR+eF8LyW05kAtZnJT4v2kyvlqty2CsNkDv69289Wup:6v/7iz7sRQ6IZtk0qty2Cs2DvS2Ub
MD5:	CE7A8041672CBFEEEB194831455777C6
SHA1:	1CFADC92D615657C5B779FC5E33C6F6BF1850676
SHA-256:	2F1ECC017B24DE10B980D947D64462EA9C22CE01A31304426A74C22E735C0126
SHA-512:	5C4CE7D7CB756AED500E4CF4948D82F4FD72FC92B2FD7DF94FECA42E426C368439C5E1EF000AB75EE2081B32B3326A01E1E53C0D4C4BA2E4271F883E302883E9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.E}....@.+1#y..3..=Y..C..6.`..H.=..M.=.{`..cr..E.....vx..........@...X.U.E...r.....C...%{.7...M......>.....\|.k.J@&.b!..g.9@....oh...f....9.\U.Ox.5!-......?.R6...{!!.S..8...`.\|.V..!G.....#....:.y.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.928224610656527
Encrypted:	false
SSDEEP:	6:6v/lhPKafzvX+p9NXTOhj1SG83vXxHVJiQOHVJEaM1M3llVp:6v/7iszP+p9NO1AvXxHjiQyERMVl7
MD5:	E5D4957645C1C99D57273C1A1ADB922A
SHA1:	0DCDF4142A565AAC94956CEB208519544A03D166
SHA-256:	F435A0610129A2448EAA9F48D02F37E1DD10D2DBA1A2C6297835A9532D9A9EA9
SHA-512:	51E8D10CFE12B85287C38159964490B931215DE74126D7336ED0C28B2A5499B810A6FEA5998A714E2BDCEAB6030BD39BE37B4E1962A210447C0C4C55AA767ED7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1.. .E}..#...+yFb.3..=Y.%..`..........s]&..7.oqo..G...2....p.....4....;\#.4....\A.\|D..O.!M..... ...4.%.....p.k...^=.....l..#.i&.N......dx.5!g.....+....{...p.........#..2s...H.'v.x.k...>../;$/.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.8657520828213245
Encrypted:	false
SSDEEP:	6:6v/lhPKAGfSUhozWJXnufwG12a/KlVybvlDkVMKF2EQEfgkd9285dTp:6v/7iAcKS+z1glKLxGhH28D9
MD5:	58562F49B99FC3E94E3410AE2A90B588
SHA1:	9E2ECB9EC72AE7ADC01C080C11EB2B9EA8A41A40
SHA-256:	93662E166DCBEC15986C8ABAA44DFAF8AE4D85D481B21BCFD4445558EA283E71
SHA-512:	5BC795383FE81726636542C293A3CCF785CDE6467CF160DE55C64BC4EEA02098EA06AC040F5B8F39441B6B861547E8FE8359EBED41CBEE536ED8A535E0B608EB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.E}....@.+1[..g..z.&C.&...`.%RxO.`....k.kP<.cr...$p7....K@..i..?;$PA8#..p.@U$mE......"..........@...Y..X..7...2.J....(..b!..g.9@....oh...n....9.\M.Ox.5!-....../.R6..\|x!!.S..8...`.\|.V..!G.....H...2:..H@.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	255
Entropy (8bit):	6.746407288321967
Encrypted:	false
SSDEEP:	6:6v/lhPKxbq4wEfAeHlnnOgIzudFRqfPDAm80Re6jouJw8kiBp:6v/7is4wr0iWSPD9tRljoGwTiv
MD5:	9970DD16D3C0C787AFD69C6F19667F85
SHA1:	162031D519B396078C4BE261A772A5F8DA714D2A
SHA-256:	6E5EE49B30858E9807481FC91C9FEC01B38BD9E01BE85E8E95B411EF834F6F89
SHA-512:	C8B80CDD04C9842A221B1B7B69454F634942E6AD542FFE3ABA4E9A1D88172308459B36B467BFFDAD5D06B30622AA5AF2C19E9D99981E96117BED6D29DF0DA60A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..=..0.Fu..........{..,.RBZ.H.~.o..a..m.g+\/.<\.W....%...........0z.......5.Ss.5.'........H........(.n...k.....a....(.x.......T....A...(..WE..@:.(..Bs..~.{..F..p..4xD7l..0T@..X*....\.1..s.)....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.72014529990897
Encrypted:	false
SSDEEP:	6:6v/lhPKgPIscv+hjA/DRJPswSAr/E4EnU+ftjp:6v/7ipfKa/l/50U+VN
MD5:	7A7EC33502F20AD1D9A724D30C5BF3AD
SHA1:	26E46DB2FA4F4600C1AFA789F633FAF77F0D2F94
SHA-256:	8853C31B94F8D69CD2CBE026CEE5CDB3D1E759AF29EE8B0432F7325E92062DE2
SHA-512:	299F27C8D823E6D5417716B52BDA585A138EAAD26334A00779CC26551B0CCCA2EC464482475B2974D26E25D2BC100700AF3AE792BA84711509D9986BF021FE76
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1.. .E9`...,.H...{...d...J0...W..6."=..W^U.x...U.Cp.../....\|V@.kG...WD..n.h.C.TEZ@...4.I6d...+... ....z...p.@..W...\=r@&....~%PH..R0....D.........~...{.,...../..3.a^........z..q1..EW....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.834309643034848
Encrypted:	false
SSDEEP:	6:6v/lhPKVQvqx64UuGgHGWChb1LBwnm8cZH26tgEf2jp:6v/7iCSYvupHv21I116tgP
MD5:	B443C7F438DDB74656E3AE7C9853FA46
SHA1:	F5E25AE101BE79A99C9B56569A36729A8FB07C62
SHA-256:	2A403474F8C1EAE8E764FABF54166C1BE0A1F3322E98112DBFCB383A9B7CED5C
SHA-512:	89C958B34A49DF950B32A67587427883325FCC647D7E89AFE2A62C97463840180FCFC705B3F8959F43C248A5676ED3B3E62B73CC2CE1A3B18658D536A205AB8B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..=..0.Fu..#.......{..,..J[.H.~.m..a.0...v.RT..n.G.l.U..Nx{..*..p..........;\#04....\A.......@.0.~'.A8.DipK..'\+....t#.{.D..#..x.W\|S%.N......dx.5!g......l4.....w.i...'._.....K.4....O,U..wT.2.;.3....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.9336277865768565
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrO/WVtm8/j3wXB1p:6v/lhPKaY57wjp
MD5:	A5CE530E279745723A714EEFDDC0F3B5
SHA1:	7B006C93E7A981724413E00F397B4F3239381927
SHA-256:	00DEB4AE149A039B8D4F0484284427B422B4FEF1DBD9BB0C172FCCC5D752DDBB
SHA-512:	95A88B6D538C5885A4F5DAB017DD968E73F3D7AD98370E05A72C17E6C17FCDF1DF00794456D24A59C0F192A8C7F2571B9C1B775EF5B336FC1206B30CF3EF47D6
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz..../IDATx...!.........9hK....e..................v..E..L.\......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.936848784166205
Encrypted:	false
SSDEEP:	6:6v/lhPKkWqh6fkqvOdNjCeJniUNOL3NuTsqmICr11nQFEc4+R9bp:6v/7ikb+E/j7ntN+NIsqm1QFEc4oP
MD5:	62B19C9720A54B830A406110F5E44B13
SHA1:	459507DA22859D246478DF6612CC2FF3AF6A5C58
SHA-256:	664129D5F204DB5B710A07AD49179F7861DD46F3C54DFAF764C80E70DE712691
SHA-512:	DEFC7AF64FCD8EA3660F6790370BE649E7D9FF6264275060D5129F103150095CCB32A756981223E4EA33E3DEE87B239CAD81D0DDBA505FAD27D600ABC9AAE419
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..;.. .@9`...X.<#1w...@N.R.&..ap....18...F...=..{P..@.ii!<L....j.p......&.j..E......I{Q....B8K...I...@4\|(P.pn-.....P.xY8.H....(Jx.....G...v\|...X..-.A..\|pu.".JB......?. L4.8y!......8...Yp........E...C~......x..CCZ......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.915413440993518
Encrypted:	false
SSDEEP:	6:6v/lhPKk9Nh4y7QD4+HR55D2ucFNrdTVwms0D7bzGgZ4YLUdp:6v/7iKNhPq4+pD2XNrIm9PzvQz
MD5:	7950D8BB1EA6F2E14D29CC5CEAA29912
SHA1:	ADCE015C08D85F419BE158A37A7ADAE1E4086395
SHA-256:	CF849304A8F92049488F7C6BE71EA450200731AF7619ED553A0FD28501A9F0EF
SHA-512:	E273ACAAAFE047B70A7C0F34F6A1589E2B90A8546113D59198D88829E647FEF36F34D76110799E00BDDD3BFA8F3501FD23604680F82BA4C4F2BE6C19BB7F6A08
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..!.F9......Ig.fg...<......_K.n$....-...v.9..%P....(..<J.....V..[...vD..pF.../...%.mv.#.......&.Y.@.. .Yp.-.6^....k....<.....d<.w\|#9..g.5(\|~......z.i'.[`;.S....._....4....4.l.[~..=Ei.8b...p.\......;.P.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.981917147837804
Encrypted:	false
SSDEEP:	6:6v/lhPKdbajRyAMQ5O0P7Tfhk7UD+LPrg8Ob5HI1W2G3/Vp:6v/7i6ffhkBLsXKWJ7
MD5:	99670850138A129CA21D3AE296FF10C5
SHA1:	8E4421A60950C506D3B1C19A8374A111CA2F619F
SHA-256:	BD5710F4A349D013C3C1A065BC15E87AC692F37F6DE78BEE9BABC926D85ABBEA
SHA-512:	5B7EA626B28538DA88FD0194BFC0C0D9B8E5F6EFEF8448E16D65BCFC93B02C146877F78B3347DB9E24B39FF2C395C30BCFAF0A85D5C5CBCC24608E5EC9CEF4FD
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.E9`.. .<[..g..r.&KU%U0\|...d.=...z<_...1.Hh.,A.{XZG3.Q..........*..oG.:....;\#.5..IC. .>"..+."....4..5.4...TO.V....hFx....W.>.....o....(A...pQ2.HE..@:.W......n.{..F......i...p......!....'d)...i;....-....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.794708083266124
Encrypted:	false
SSDEEP:	6:6v/lhPKw+Alwa/6NZLS0ftKj0M0X57a2oC14Mp:6v/7iAR6a3j0M0JQh+
MD5:	E6940032541A5975AE73BCE4FA07554A
SHA1:	95AB0522CA49E8A912EEA92B70246F89325A7D60
SHA-256:	89AEB4DBB25F1E6B9321D0FE1A6E6012EC0A5419BCD96DEAAD22D313EDF98CEE
SHA-512:	82E385A60FAB7F4CE2074F29F7B9A484338B7C0CC2D70F5979D19A067614B22B6D0006369BBD557E505F1E6D272433A9B95F1A0E84B44D6CFA5AFD0DA3A57751
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0...@.....'.......!..8....Q..2}.u.9...p.J..^.Y.;...@<...^;".A."..p.@.......4....~.4!.~'.@8.Da..PO.U..n.h...!...G...s..]2.w...>?.....S.J$.*..?....\.O.@..." `8A{A..1...iH.P.v...._..2.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.88154405012715
Encrypted:	false
SSDEEP:	6:6v/lhPKLqbTWuARXWLWFRH71mvAJ8X6GIwsCp:6v/7iWbyuARPTI4C6GB/
MD5:	66E9418037AC79B9702A3567AD826599
SHA1:	2B9A79EEBEC2A8ACA8523974ABAC2CF70645CCC1
SHA-256:	B723408253D004C477862BC6D83F9987F79EACD7C5FF4C67E344C4DBECD92A6E
SHA-512:	C5931DCC32B990BE98AFD8C612AA764D91876148B9F3E0EBD23454B07D7E87A32D71F1142D6579B9208DD85CFE6882E7A0C00904118F311C5678EA03E41C7AC0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..=..0.Fu..........s....RJ[.H.~.m..a.0m..8...A...Y.ZG..(....]o.`..U..cG.&..D......M..@. .~G`.Or"M..... ...4.%.....p.k...><.....l..w\|S%.J......dx_5!g......l4.....w.i...'._......r...H.'......T72.V;v.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_cyan\glass_cyan.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.411751853774936
Encrypted:	false
SSDEEP:	3:5gNRYKvSEB4xR9mRrIz4sSn:AYKfCQRY4sS
MD5:	EC1AD8D4162E994622F4C479BC0484DD
SHA1:	7B4E2436E2BD5DAC781D076DC5E335C72306A126
SHA-256:	03AFF0A1F1CFF18A7FDABA0E7C650C54033CF3D9B2D6A304EE941634810B5A2E
SHA-512:	B1C5E7DF2443EF030A3E671121C7498758D8B611AF2B2893FE2CFEB55C88C89B965CA9B77753AB17A8EE7C97910E6125809EB137E631A11873D30E6E4B63A2B7
Malicious:	false
Preview:	matchBlocks=160 95..metadata=9..method=ctm..tiles=0-47

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_gray\0.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.940179030673062
Encrypted:	false
SSDEEP:	6:6v/lhPKjQQ5VOjus2mdZ9D+SWHxIq4JDCLOP6BjRd3d9PQnWbSAHkSpfeDcLp:6v/7iCjubmdDD+SAIxP6BjRd3fPQnW+o
MD5:	EF8D82F6F305756B054FCB384A0EA6C3
SHA1:	99A487B00FD092321026EC667222522CD3BCDAD0
SHA-256:	E5E44DE61494AA396D3ADBB69A495F06B7F04B80A9E33F067126F1BE4773195F
SHA-512:	5BF06572C2CEDBEF587C1C44B1A6276A8EE3086A6FFCD71174CB7B4818F4CCD9161703EAE9B940C180D73D71789E052808A4D1799EC73E632E9B9754B61D9DFD
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E3........!<...dMKZh..W.\|.BH8.[Q\|..R?.M.......P\|.-.iQ..<L....j.r.....&...g..7.-P.pD..._..(8$..?...S.h.T....,..\...P.xY(+.......^<....1.H....m..V.t.r....q..".y..X....y.j........<..s...8.L....T..!F$..........`...v(...cBTN_..3....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_gray\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.92974517103008
Encrypted:	false
SSDEEP:	6:6v/lhPK2WhyBtjwGxCTrg5lbWxlc4Qs+lj61y13iwxgiiotuqkoWy/ljp:6v/7i2UyBJ3xCng51Sv+F61S3iwxgJw9
MD5:	67333A3355CB95ABABC4B217D653A166
SHA1:	243BA6038A96F6D90F4E4CD817E6AF41A9C5B3B3
SHA-256:	3D7660B2657991AA2E7E2C4E82EF736EDDEC94190661B1633FE1DB6E151D7B8E
SHA-512:	8C21D3513D058B83688182AC8CE2558E73E4AB8947A0B0F5B2014CE212A7E28A60828BF62EB300F8D3902FE5C874F51391454129D7D365E81D6498559C1D1C9B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E3 st...\|Fb.f....i.VU[..o..R.Q.S0.......N5c...[@.Y4z/J@...x...}..y.....vD..pF.../...%..m.\"P.-Y%M.V.{........kv...%..*.F....C ...9@..x.7..0.'.......'....f....?.H.h......N#@`8As.4..V..S.F.#fH.....O.C:J+.v.w.l?K.8D......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_gray\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.790090959669595
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrexxuohTMjwIVCCIPSz9J7Fz8FBRhh4bfw7sYgqyG1WERK+mEz:6v/lhPKwnYVwy7FQF3mMs2/mEiMVp
MD5:	D0533341BC998611677588B4BBE085BE
SHA1:	847815B9FDEE9E382BE6222DB5AB90FBB876DEFF
SHA-256:	1B7F84FC0DE787D811D69F5F8B5E6AE39325C32CCA3BFE98042A6A600CD2EE78
SHA-512:	0586C715350D2F5AFD47F9134ADE0C5BE32C96F75A723D5E263A28CF33951BE28F8C50F197A79195B688D7F56B5569EBCCD181A27CC4C0B13E25F479F561F3BF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... ..] u....\|F..T...U.D!.....1#0.2...S...]..G..(.....o.`..U..kG.&..D......Co.@. ..F`._r"E..... ...4.%.....p.k...><.....l\|..\|S%.I....qQ2....3.g.t.Q....._....8.......i..n.Uv.P...b.z<...N2.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_gray\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	248
Entropy (8bit):	6.788517200707955
Encrypted:	false
SSDEEP:	6:6v/lhPK8hriFC/adOHXOQA40vLYgbU2Cm93u5tQuJTFjp:6v/7iizeLXU233uxb
MD5:	E979B93D199BBC2B02F4812F97601423
SHA1:	9F13B28C85323B76B3EF36806E8423351AA97603
SHA-256:	E4A3703F2733FF24F69C0681D71B57DFDEBD421D74A338263E184B069CDB5A66
SHA-512:	47560AE84CF26AA86B27500AFAADF33E7AE5F74296322AE026A084B914DAFE56D118C7D1CE8D1DFF0AE446592C6154F04D2DFE9D89E11AE8ABF756B109BE5FF6
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0..S`..+...)=Q..A.;..z..Q..Rk]2....$K...%p......>+ .#...+"........#O@.......H...O...CA.......[.....>....,.z.L>...%..$.H..3.J0..5.D..............,..........p..T.en.k.z.n.o2.''......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.815995833908545
Encrypted:	false
SSDEEP:	6:6v/lhPKAWhyAegYshZhFMNlSUjxFG30x/ICf/krXTp:6v/7iAUy7RshZhwxx/x/ImE
MD5:	EEA5F2569D0A156ED1DA36E53CFD65B4
SHA1:	B963610430294C3EB71AA1068D7A8DA05AB788A1
SHA-256:	025E1788218C5D0F5F530D0FBA1D5FFCE72CAC139B4196F4E7FC181062DA2A4E
SHA-512:	BD6815778651B866AC435A036EA5E3CAC0016A5521FEBB951E5A01E0137DDFF7E9887CAEFBA190B8311F0DB1D03B07054700B20BD181B54434611327124B9528
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.;u..s%..."3t.N.qJ.9$...6>..)~O.cp.....O.x...\...F.f.;<Z.......~vH .pF...".,HZ.......C...%{.7...M...GgAU`.\|..%....D..p.@..'..+8k...,.1..9..%.F..zpU.,....~;.W.O.$l4.x.BB..'. p8A{.*...=wC.\N.r;v]...0..Q.~.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.8703339806864285
Encrypted:	false
SSDEEP:	6:6v/lhPKdbhinvFAf/b4XAXN8zcHR0pbKU5PWEBvpY5T1qN9weBvcJs8vyp:6v/7iPinvFC/bIYHR0pHPWoRYxsLwei+
MD5:	E9694E3FEE51D645D2DCEE55A1266A7F
SHA1:	DFCE36C384B20AE9161D22ECE5472EF9F7DFCF15
SHA-256:	CDD092B4BF2887874A1CC12C52EA4FA2B6924D1572A163ED11AB37F12478335F
SHA-512:	B6E71ED7B0D15640F77F2FA33A2D71E5494E56ACA9A208F904E2A7F0C97F8FA8D357551BA6EC02BFA789C21572FB7551174878CE8D4AF4B62DB575528A68B6ED
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.;e..s%.<Dg.....%...>..9Y~O1......I=..k...Tr....Jx..........0..........[..e.?.#H.k..x%....+... .{r@".V.p.E.;.=B ...9...8.V..ZR..<\T.o.&.J..@9.S.........n8.......e...p[....H..K.1.1...y.....[.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.941044481513667
Encrypted:	false
SSDEEP:	6:6v/lhPKLxmEXaPaYFGkQtPVUiMHV5/Wf0tU4rup:6v/7idlMfNQrMHTOf7
MD5:	EF620801AC33C5244E9ED2C1653B563A
SHA1:	02370EFF17FD05BC24D0E19CDCEA374EFAEB9D60
SHA-256:	9F8C4F735490D2EA9A512037D0A77881121F49B751CAB050B73EEB754DBA4E83
SHA-512:	D1B6BCF066E658DC14C2061EFD451A2D66285B218979C7612C815CFE88C9A17ACFD725B9926905F0AA3D8842AE8AFD74E9A8D777F9CB93F5F638724C888B30F9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Sw.......):N.K(m.#}.9.f......{}-.k....X<.G..(........*..#....".......VG. ..D`._r E..... ...4.%.....p.k....=.....l\|.+...~'...qQ2...3.....O.V...\|....4....4...#..R..C.$j.=....\|.f;...\|.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	260
Entropy (8bit):	6.899822659565729
Encrypted:	false
SSDEEP:	6:6v/lhPKoxmbKhm5NnbGeDY9FJeqyu1cZN9FlXigYm6I5bp:6v/7imFONbRtr881igLT
MD5:	A990E7AC681C72C25AB4BCD1D9E0D295
SHA1:	4188C9A54470CE42A78EF0D43BF4EB3E44708A56
SHA-256:	1F19EE25F18F080469AA4E1CF63BE87FC20D5025E9A0A8D738DDE6CD112522C5
SHA-512:	F3EA020312B372A38BD0A13728980288990E9B09ED25114DC90C47606493AF550FA2A5B8BB85D9D15BF179176C73F93FBD8D1B81A826C572EC59DC48DAD732E6
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Sw.......):N..BiB....A7.....^...RT+.n.[.l.U..>.vw.U.=.V.F.... \..w.F`h6=..\A.......@.0.~%.A8.DipK..'\+....t#.{.D..#..x.{\|S%.J......dx.5!g.......l4.....w.i...'h.H.G..K.o.* QC,..........;..s....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.900029068051166
Encrypted:	false
SSDEEP:	6:6v/lhPK8WxmbKhm5A6nbGeDY9FJeqyu1cZN9241G+27tIgVUPKbp:6v/7i80FOA6bRtr8V4G+enVUPc
MD5:	CD169FE63FEC0748A8E5AB257C832AC2
SHA1:	7A91AEDF489EDDE6A955F480310187E5B5982FE8
SHA-256:	558DEA26ABC4ABA9CBDB22F3A0A0CEFED29B9084950BFDA03927568260695252
SHA-512:	D061069771347B1B4C1A9B765B980159E5CB2FBA1153EFE64308BC29A94E492084B4AD4C6A72702BB6FE214B87A3DB615DD26698D889F67F868DE05BD6948BA5
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Sw.......):N..BiB....A7....O.^...RT+.n.[.l.U..>.vw.U.=.V.F.... \..w.F`h6=..\A.......@.0.~%.A8.DipK..'\+....t#.{.D..#..x.{\|S%.J....apQ2...3....._.V6..\|....4...../H.GL.r...H.'.....z..].0........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.790450475685707
Encrypted:	false
SSDEEP:	6:6v/lhPKwhr1yq4rzmJiAdNv7o0WC7HrrQhgmwmWe0Fadp:6v/7iOQq4rw1dNv7pXVe0Fw
MD5:	2F98768E6013772922C78BFC9616F289
SHA1:	33D4BD1F46A834E35BC5F861DB08CE8044742B40
SHA-256:	FE836B4E3F3D0ACC62888458D4C871910E8614D9E3B4E317955552DDD392DEF2
SHA-512:	52AF16BEDE421883A7E56D3CFFE7A4521D29025827A75429A580C35BF83676FFDE4FBB98FDA358B47175826115581A3A7628F26959B4B40BB8ED26F33EB8C1B6
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.....D.V.H~GJOTq........~...%.Z....l5eU!..[I..+8K`.W....\|T@.kG.:.WD..n..C/.!O@.......H...w...CA.......[.....6.o..,.z..>...%.~'PI..7.J0.>5.D.....g.16......w.Y...'h/..3..9.....S....o.0.4 .....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	274
Entropy (8bit):	6.944353363219531
Encrypted:	false
SSDEEP:	6:6v/lhPKGbx3Fw7JVskbR0uggZQk8ylYigiwiIrv/PRZIcM0wp:6v/7i63sJB+sCylYigiw9v3Rav06
MD5:	7C6A8D3A6D291C92A5C1E5F2CF1AA154
SHA1:	713FEA9AEACEF04427AD603889CF1641F8A0FB39
SHA-256:	B289FBE1BF78527AEFCEBB9B2E598D00F463B56A05350046D18AE625360A79CA
SHA-512:	FFE54938FC974444A012FD1AC4257F0840072FA604EB3623F8AEE54B61ECA18C8ACF15B83CFB46FE8CBEDE0297791AF282F457F002BC1A23D1B038D11984BD1A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E..;...3..:Dg...C9......./.......r.].^.IU....%..,p.....W ..n.....XA."......-....."....V.<{.)..7.2..fAU`.....KNY.@4.%.;.9B.......8.......D....WU..O.&,.ce.....7.q6Z..t"...s...N.^0..5....Pg.....I...G.@~.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.842199448644958
Encrypted:	false
SSDEEP:	6:6v/lhPKK9xr8ApHhW/vMvNHRbmf7rCTxJgbl3POp:6v/7iwxrVJc4xCR/8
MD5:	4096A29E09C84C87073818EC27252B55
SHA1:	B147A32D7E97415F5E7D8CE6FF42E3A6662F478E
SHA-256:	762626048F01647310A768E5080D361D8E3B374A6C197B56808EEB6AA538D65A
SHA-512:	4D2FF8D6C6F4A063FBEB43365064A21E32B7B8AF3F8D55F0A0C7C296F1523B23BB801F7546BFD5F0616E9BEC0781038D571109A5EB417D6DD513E36FD0D9D2B8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A..1.E.N.....MX7.!8.w.8...Q..>..`.^..-..r..u..-Q.....<K..o.-...W..cG...gD .........H.\#0.+94C(U.@.. ....h..y.H........,8G..9..o$.`.L.%.....K ...cZ...X... ...~D.=p.........=.b....r9...Uu...\m60.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	248
Entropy (8bit):	6.878434928168963
Encrypted:	false
SSDEEP:	6:6v/lhPKM9ibiru2/v0qR4V/TLO5kx9Z8ykrHcI+rIup:6v/7ihGruEvEgM9cgIc
MD5:	28E6EFF0438F6345F8D5E203FE24723D
SHA1:	653D4D4FB9A45B77E0F1473E6A7F5E7F9E0291F5
SHA-256:	847AA5472EC52B68F0D51E218E2AA797562F46163DAD55F9417023BD46BA6824
SHA-512:	6FD5D8809AC77DF1EE226CDB3AB3EFABD68E9BCF9F5BE3D68D3FA6A35F810A661D97AC6B247287F7CB915DEE2D107570D095B5D3AF3015AF98FF52113FCF403F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A..!.E............L.)e....G....0....q....d....%...v....* .#...+"....4.?."-..g...$.2.txO..p(...+9..p..;."P...C..W....v\|.;....)\|n.+...h.%.~......q.\.W ..g..0...A......mH.....O.....x........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	268
Entropy (8bit):	6.861777276689513
Encrypted:	false
SSDEEP:	6:6v/lhPKZQ/62D6P8negj93ggIZWWXjn+xkyvTntUA430uGufSXoHl0IVp:6v/7i2FD6P8neu9VI3z4kwniA0l
MD5:	51E2A240D230DA7CA00D846F2B70284A
SHA1:	DE45A44EC9C355728FF7948A525BA76D4B31691F
SHA-256:	3BB834CCC46120E4DC8B6AD6D880D576DE03D3421997BB15BC74D93770AFA884
SHA-512:	6DA19FC4AA375ACC1567B393AF772CF1337EAA1EADF29E83FE9BD4AFDEFD098F5C5BF3BE666DB041735964B7BFD1B7D31B65376894817E7A6E806D280C31AD39
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Sv....J.-y...]2N.C.I]........{.....[`<.cr~.E.H.n..x..........@...X.U.U......G.....K....x....KgAS`.\.....\|.k.J.L.....-..M......@...d..s=.....<jBZ..:.W.O..l4...BB.... p8A{.*...#wC.\N...c......\aG.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	275
Entropy (8bit):	6.88590081045255
Encrypted:	false
SSDEEP:	6:6v/lhPKlgbApLa3uL0H+L8ghfB11S7l4CzTGfrVbbzwVhJ/tjp:6v/7i3g06+L8ghf1SR4CHGDVzwR
MD5:	98BEA2EA4E92EFCBBE8CBD2E523E2BBA
SHA1:	CAEF8DB79B36360648DC29CA5C4069A46533951E
SHA-256:	85158ACF128F1400F80234793C8A70A1EA0091F10B6064EEDFF50350192E94BB
SHA-512:	7FF60A763B9240AE5703FF1F0AB1407993B79E42351051D4CA0D07E1065B29306F99393C4B1548D3E35070F3CBA9F7A8F100ACAE959C640033AAFAF4E64FE552
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.E.);...u$.H...Y Sd.....$...>...........T..(.{.j]....%p..t.U.<.V.B.... ...w.K`.p.\|....K.:x%...G.\|&.@.*.F.\s...W-A4....f.7..(8{.......H...@......@$...c:..-p:.S....._....4....4.......{...p..)....$.....`...m.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.870435205434864
Encrypted:	false
SSDEEP:	6:6v/lhPKehMBpREg/g2Nh/6C/t1IWTxVeFmaZhKDOv4Yup:6v/7isMp37h/68nrTxVehr0SO
MD5:	A87CC9F0F88BA1A27105900460D04704
SHA1:	16692C4B9AB49D99CACF526639B8689EA7EA7934
SHA-256:	0879619CC493546674500E6A014877D223CFC8CDE341C14B06A14F570D06F1C1
SHA-512:	4995F1C1DD872ECE954B3A552F4F4986C450A866C9CFF1A623F3C81B89E757315236BDCD1D8A4250D9FB1F0C63C0EAD9946967B3D818FFDB1851CE5F753E305C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E..;u.+g$.#e.f..L.8..B....?9......qdy\/{'.`.....H.#.['+.,.......h.<*..oG...7D ...h.M.."G@...4.J6....3...F4..........=.5....,.e.....}.J..@!5...K&.K..u&.[`:.S@.........8.............5...k.eN.#.?....Z(.d....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.840237701059469
Encrypted:	false
SSDEEP:	6:6v/lhPKQnmAIvS9dOQtn8sTviDYNtBCaSr4JlksIRi/kup:6v/7igIK9IQR8uilaSEJlnIW
MD5:	3798A97F18331D21BF6FD1F51F0E4C05
SHA1:	21DE8976F08ADA4F02CDFA0144B4989FD2E29A08
SHA-256:	8097AC14F422EA971324F3869E32D33BE6A710D331FF9AE2BCAE89A79E0A6D54
SHA-512:	872F239C85DBB7B421036B389CB5D525A3A6121877BFBEF07B004D566BBE7C71226CD49478DA47CA25D03F7CA8B5CDDE724D9E02249C083A2FA2570A44B3AD5E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@.Sw....J>#1Df`.N.q.T.!).........8...q.Ll....q.....1......x....@..Z...n.(F8Y..."."...............D.......M.Y..$.$^..'........=....Q.P....m..Vxw.RP..\M.Hx..'............^H.9.D.h,N..`.\u+&.&..B.H..z.@U.K{...u....".....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	265
Entropy (8bit):	6.884636249980048
Encrypted:	false
SSDEEP:	6:6v/lhPK/r0bLRA+NfJ1kmr9PW6sjnK1r6V5a/oHyhNp:6v/7i/wbL6YfxhVsj8+VVSN
MD5:	17B2B245F3460FB5D9854D9CC273B978
SHA1:	D1EA4296AE2C0DAB518EECCD13CB7E04453E2E20
SHA-256:	36CC1698F4E2F109C2F08D0297DB5DD6288CE1CE1A619F38964712E2A54B1D14
SHA-512:	786B267959FC4E8C9D43A94A50F793082EFA5843B6135CF98C6FAAB0ECD0DEA3217A1D5E4CFBF5B07215365D18EDF25E1203AC17CFE79B884DF6E68FB752B9FD
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Sw....J.-y.f.....49.....\|0..{2..,....5..@.^...T.(..^.[@.p.....4...;.- \#_{-.,.F..W.i.P..=....H..#.@;x..D.....Fx.....G......Fr....JP.\|=\.."...9....t.^.....~.#"... 0...`...+...3.S...XS.....,La.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.757148352076214
Encrypted:	false
SSDEEP:	6:6v/lhPKdbhinvdaHZ1gVeoXrTGspc+g8hTugMxggMwI3np:6v/7iPinvQ51gBysUsTugcMv
MD5:	758FE9377A2E8A80D7E1B7EAF381178C
SHA1:	E40E3380B078747AC2306343A063F3ECBF66DC35
SHA-256:	739BF91C4695B2E34B3765A1C475946182824B8FD61D039D1C6092A537118FD3
SHA-512:	84EED3AF4A1771DFF21F1641C810E990BF3ACD115822AB642E35DB2D1847ECB4EFEE6CA99A921AA37D30EFF677118EC4F5C8C34AF294A4D2C638420AEF00C0CB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.;e..s%.<Dg.....4.DU......s...b..}..U...'.}.......Lx.../.......0..........[..e.T....=.....).t..@..P#.......[.........,.D..v...i&.N.$5...E..E+B........`c....[...g.`.9As.0x.k..\|.S.$k......./......E....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.816530652481416
Encrypted:	false
SSDEEP:	6:6v/lhPKtHeA1PFoI+QbitM0d9z6YrShts5RVwvPp:6v/7iw3E+tM0nLug5svh
MD5:	D2E5F548FF2850467CF4DC973C311109
SHA1:	77D3612786E8F9EA2B3A118FAEECAD45ABD0E0F8
SHA-256:	408B104510FC9C6CFA71DCD8C0F883C359972FC5F90DF6EC3F52D5D5498607DE
SHA-512:	AE3DEB60DF4EEAEF5DDC96BC8052AC7ADC36FC1358DD4F1D6C55F1FB0A9C2102444C60904869FC78639AF71825B46BF74F1F898A8445449D2EA47995F01E94C2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.);e..s%...)Sd...j#.\|...\|.=a.-.........d....%..gv...>+ .#...+"....T.7U....#..\|...B:.%P@8.Da..PO.U..n.(...!...G..d;>.V.[...>?.+..so.%..-.....q.\.W ..g..0...A..........;.....u..o8.)....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.836631774224909
Encrypted:	false
SSDEEP:	6:6v/lhPKdhyAe8gx5l3aw6M2JtgTGBir6WI03OFpb1OgPup:6v/7ify7xxW821ir1eo6c
MD5:	EB4502F00C13CF09F045F16B254090B5
SHA1:	CA5827DE6D0F44C11F5E2DF761F4519EED93B815
SHA-256:	3507FF7FB63E93E8D2BB28388D44F26F415F8A224D0100EC660248FEF1C34F5B
SHA-512:	32F63A80CC1244CEE9237B3135D6EC3BB4CC59A59A18F63D244B74399E5B1FCB9480C3831506BB4B82673E0E1404899C842EB7DA1956138E405678432B41E56E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.;...9..H..):N.K..U.....W...o...G.B<\..,.)8K..o.'.............;."0,....<..>#0./9.&...:...(..........-.}..=.Xp...Y\|.o\|.L..@#....*..v...?....bl4.../.....N.^..gL.9..............^2.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.841637878089229
Encrypted:	false
SSDEEP:	6:6v/lhPKjrN1yqo4NEuMgUgBF5irSf1eZzGSP3rbp:6v/7ijaqdWuMg3fDSP71
MD5:	852F8FA4AB06F14D4068F0252912639A
SHA1:	A7B770132D9FEAD82F503216A922AF09EE58356A
SHA-256:	F89FA9E4AF57965051F83D23BA704D159D04D2B284570EBB0F4983929EB2C0BD
SHA-512:	EF5389188D3E62E35DE2AFCCF375D102327DF82B97428316F69E5DB5B521882D4B38271387E6BB730A87FBF62E2CFE05840A03D1D93DA6558F45C778F70ADF0E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.....D.V.H~GJOTA9......Y.#..fF..V.:....Q....V2J............z.@.....-..r.E...4x.@..dE.....( ...0xO..'.*.....Nx..`..#....G\|...;.L.......i.%..+..?..q.\.O.@..." `8A..08c.N#.!U@..;n...e..0.]......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.954520266088877
Encrypted:	false
SSDEEP:	6:6v/lhPKLxmEXaPaYFGkQtPVUiMHV5/Wf0tU4RKCjp:6v/7idlMfNQrMHTOfa
MD5:	8E69E9259856067C903CAA205386AFC0
SHA1:	56E61FCE327B3FE9E68288F680DA385577EEDFA0
SHA-256:	A1B1B88A3D45A7384A55E6D566135531A2423D413C00F35199DF5D07D7B1DCDD
SHA-512:	650320E31D976BAC62E893AE5157EBB28CCE8E852391A4CC3F05B903BD572C0CB16BAEA5FB74B01E20AB812C1CD555EF131965F7E45465179124AC3A096B1CFB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Sw.......):N.K(m.#}.9.f......{}-.k....X<.G..(........*..#....".......VG. ..D`._r E..... ...4.%.....p.k....=.....l\|.+...~'...qQ2...3.....O.V...\|....4....4...#..R..C.$j.=....}.e..0..!.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.874480591542572
Encrypted:	false
SSDEEP:	6:6v/lhPK/Qvhy5275ooOjVKOh02RLHvZWY6nVuEVUr5AmRYdFl9TIyEqkry1/5ReT:6v/7icy5Qy5RLPZf6VXmRYh9ThEfI/S
MD5:	6E605A3E4AFD3CAFDA90A5A21BC1DADE
SHA1:	F8BAD11F4010B90F3647E53AF794B5004D3C4D80
SHA-256:	8B1BC3B98BE9C90E1A2134E4446F399D5CA3D071F87FB1854D30A512F5BDD5CB
SHA-512:	FC91FB6359455AA4C5447F1CABEBE2253E842737759E813EBD18DB33797D27E12F36899A7669FAA06EEF50FFB4EF5BD97D8532E7119A5185CA75C5658F37E1B1
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.Sw....J>#1.3.@..8M.......K..1x{>n...(....A..$p7....S@..a.....H ...k.J )..E..=..y.\$..#...)..o.D....U.Ypq.j./(eU..p.@..G../8[...L.}C}..7S......U....Z....z........R..... !.S.....`.\|.U.+gC^9...t._...........zSG.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	270
Entropy (8bit):	6.8549606343930005
Encrypted:	false
SSDEEP:	6:6v/lhPK7QvhnTZVhmtr20y3GHFiWA6wpd7bCn12vflWm/bp:6v/7i41Vh+20y3QHoRGn1CflN/1
MD5:	DDC843768EBE5EA7257A3F898305F065
SHA1:	9F19A7F4C3BF25D646DEEF27357F98F1B5E23ED3
SHA-256:	BA85AB84AEA3CAD18B0C2897C16273855C215308D55D7FDC0AB494CCF5860B20
SHA-512:	7B4DBC833CEA268C3040EA96930DD93090104988B19F3D05AB6820AB1A1F173044DB43E6AAA7986EA12D9AF9ACF4F93D9E74378E517458B74D411352654FFE4D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E..;...3..2.g`..`.Z......v\|..v~..~9].:g..(.{Q....%p.Kt...>+@.oG...gD...........H.\#..#.4C(Y.@.. .,...h.....d.-.u.^=.....4.w\|#9..{.%(\|~......2..i%.[`9.S.........{.,......,...9s7...#...S.Z2(.w....j..4w....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.892508286159203
Encrypted:	false
SSDEEP:	6:6v/lhPKVQvhmlGmmpPvC4NEzwySMPB7SwrTAgFk6GzNLR+mkAyNclAVp:6v/7iC5omGSYBFkFRhYSs
MD5:	D14F74505D96C75CD052D91A7D6726D5
SHA1:	EE5E0F05EFB11F8B4759B9D32F10F2EA9B9820CC
SHA-256:	B3A184B00326A81A48FAAF78571A3A8A8A4045507D6BB5AC0BCC3EE52339492D
SHA-512:	4C74B06E8F010857C1CFBD8798E271AFC5BF3DA6C476950A81AA4C67A792106BC13F364F1297EACCA6CFB495B8D4B14DE227B231B5F2B29C66F702B619119C60
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!...)=]...H~#QDjH/)'....N..z.._...Z......Bl...U.Sp...^.W .p.....t...@8.".-MO.!W@...t.Ivd...+... J.{r@#.V.p.E.9.-B......u..]V..*)\|...$..h.%../.......G.@..." `8A..48c.n+.!U@..........g...#F.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	274
Entropy (8bit):	6.8164505108194735
Encrypted:	false
SSDEEP:	6:6v/lhPKWhir27bUIQgIGcufU8vxkAMTJlDbEx/wp:6v/7iUiiLIGXkAale6
MD5:	2B8BBC6B777343811EC3C88D1F3DEB74
SHA1:	307E3233B7C694A76024F1EC6AEFDFFBF204D586
SHA-256:	1D9F28D0766370EDF582734486DC96ED0988A87D4BA4FF07C5235BF1E6113D5C
SHA-512:	FA68C9AF523323EEED40CB0EEA9B52F007F71C3892BB1A734FD389ACAC2CDBA86201154774585E25069FACAB73C9366FD16980282DC5CFE13B8619FE2926519F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Sw....J.-y...:E.is.k.....H.=..Mz=n........Z% ......].r......@...x.U.U......--....K....D....KgAS`.\.....\|.o.J....C ...s.....oh...n.r..9.\M.Hx.5!M._......R6..\|x!!.S..8...`..t+.!.\N9r;...B.......j6.T.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.975466405697725
Encrypted:	false
SSDEEP:	6:6v/lhPKkWlmH2XqE8L9sVotgMsU4mfbaOWhSsDHpKy7yUJuxyp:6v/7ikQSK+vf1baOw8oyUox4
MD5:	2AC40471429F92010C1D7FFA6DB8FB0C
SHA1:	1D21543EDE20841E7BA8773A35D034D0F08A061E
SHA-256:	90A05B553A5163DC0E18A97C62A0C16DD6DC6BB98A3EA3CABAA290A11F89688E
SHA-512:	2745E7DBA1C6881E8C33D6BBB9B69F15A20BCF7EE88584ADC2D15D990592F0921C203EFE806661997665E53A769DA422E2CC7F44A6B53D7AA8C5889E5B376783
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Sw..........@..8M.-.-../..A.....ok.]/.Q[..Y.....P\|.....P.....].....W....4..@8.% \#_{[ .......iB....T.n.".....m..O..,.E.:.5B ...9@..x.7..0.'P......'../g.1...........B.g/".n8..........W1GOQ...!...4......;.y.Z..k....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.817616025703884
Encrypted:	false
SSDEEP:	6:6v/lhPK8WhUp0nyLxmCgS+Iayo6mE1f5QP10uPk9aigLw1tjp:6v/7i8Uw0ny7Ayjzn41XMUiP
MD5:	739BAFB49D09FA4007AD4EBCAFE3DB94
SHA1:	931C0B46C4E50870049012428208F7AB1147E1C4
SHA-256:	5F9A51AC1AFCE9EBD2B148D66E096CEA086495A11804AF9689E100DF864E2513
SHA-512:	C63D3CABD9C864C3332102B4579F9ED57681396E276D01CFA1EE19B8766BB72E02216A21810EC818B52EA8E06283893AA6D176B279DF4CE58877A6D7323506F4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....1....=].V.H~GJ..@.TA9.}..t..^._.(ql.<...mU....U.Sp.....+...W@.cG.:.WD .n....+..g.:.$;.t..@... J.{.F...p.@s.[.....s@.....e%.L........:jB.....?...h!..+....8...A............. Su^...$..#.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	270
Entropy (8bit):	6.912472516622999
Encrypted:	false
SSDEEP:	6:6v/lhPK7Qvhir2YKLmotan3G83CUHE4v2kyvlqty2CsNkDv692lo/bp:6v/7i4iiBmow3G83TSk0qty2Cs2DvS2g
MD5:	E6D3C120AB3AB4F792EE9783492E810A
SHA1:	723B1D7C0071B53512954C1FBA047CFEDCFEDC9E
SHA-256:	7217F69AF19749AC67FC09E4A73206465A4F509CE3AA0C722C3A4C2FDDF055AF
SHA-512:	D79756FC9EC05EFC3EB88D1358E884C73A7CA40CB22DE880DC532C8096673BDCB9CD7BFFB8574AF5CA97857CDA2453AFA61C3F95A087077ED421E7F9AF0E32B7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Sw....J..<Df.....9....?...H.=..Mz?n..x&.............].2.O....!.........."i-......C...%{.7...M......>.....\|.k.J@&.b!..g.9@....oh...f....9.\U.Ox.5!-......?.R6...{!!.S..8...`.\|.V..!G.....".......N.j....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	263
Entropy (8bit):	6.9740817139825095
Encrypted:	false
SSDEEP:	6:6v/lhPK5hy3wnMrByaTOhj1SG83vXxHVJiQOHVJEaa1tlbp:6v/7iDygnMrBQ1AvXxHjiQyEfl1
MD5:	2713792FFE9EB6640E7617732F4F9C0E
SHA1:	18E89D22B54E08A819DC872B7CE4CFB945C1E4B9
SHA-256:	C927F73A932A19C384B1C4C95F5A5BC7456875454DF11B922D0D86D31CF4708D
SHA-512:	ACB4CFCC87D8B184E1CC4B5CED7CD4DDE7396DD18A660A251A89CF9E6AF9880CB07D563D70C36CFEA5C6A90B379450F33DF9398FD039CBFF325176EAED6B86F7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.Sw....J>#1Df.....DQZ..o..o....[...X&..7.oqo..G...2..*..p.....4....;\#.4....\A.\|D..O.!M..... ...4.%.....p.k...^=.....l..#.i&.N......dx.5!g.....+....{...p.........#..2s...H.'v...vjh...A.$.+......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.894454279726111
Encrypted:	false
SSDEEP:	6:6v/lhPK0621DWsOt2yaTlVybvlDkVMKF2EQEfgkd928iWbp:6v/7iS1Do2lKLxGhH28p1
MD5:	D3523F4695C271CD67ED369239C06974
SHA1:	3509A13E7AF7DFE29E385E3753536C4AD4F3F5BE
SHA-256:	E85956FAC72E0658E43AB5295681C9C3DFE20E9DC6B29BF0D75303908B378230
SHA-512:	84DF5E2F39ED3CF4020CB652835CD01326E8BC43F00A969256FB7E8A7D7634B5461CFEC82F1A3FDBF644898CD3BDA39DB21E54FF69D1CC151106C354ACE7EA24
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Sw....J.-y....:E.ir.k.?...%RxO.`.^..s.kP<.cr...$p7....K@..i..?;$PA8#..p.@U$mE......"..........@...Y..X..7...2.J....(..b!..g.9@....oh...n....9.\M.Ox.5!-....../.R6..\|x!!.S..8...`.\|.V..!G.....H..dD...lS....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	255
Entropy (8bit):	6.906622005860295
Encrypted:	false
SSDEEP:	6:6v/lhPKxbxm3/KSsZQqF+tWGVGZxbpTIVaylvvXmilobp:6v/7iTQHVGSVdGilo1
MD5:	B47C89E400614A0052293A0EE2A876C7
SHA1:	EE0343AFAB920B31817536CAADA10BB5994216DA
SHA-256:	5A42E4117595551E6182D561C1FEBAD1005F3697C9E968C6FE88426C081FC7D8
SHA-512:	272760941038C8C860000E852C977ABD5403A49DF71B9A9096636B55AC1AD883B38CFF8A6B2F249388A77DABD8E22781B091B2268EDDBB7060BE4F4E7816D069
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Sv........):N.K.i.#}.9.f.............x...Q..x.....p.....L....;\#05..Y.y.0....~..a8.J`.p(......O.V.....F......G...9..M..+...>?....}U...?.....,4.....w.i...'h.H.Gt.V..C.$j.....8..._.+.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.870578779610425
Encrypted:	false
SSDEEP:	6:6v/lhPKgHe8gx2/2VlpgAXgzB6EPbMq5HGk7jp:6v/7inxx2/ycAXMBXF5mkB
MD5:	8653E70DCCA73A9DAB765D911757F647
SHA1:	8FA3BEC3E2C37C4198828AA483A5FDC2B9AE2A71
SHA-256:	E19E99D220EF0200BDD86B695A5ECE4BA447BE92A4ADB4B8675EEE4CB98BD45F
SHA-512:	0C52C1C91A48B7EAA9414C558D68CEF3603FBB425DD1F8092B5A4D90983E84DF0F5ED99010046F86FE64BC6D610A6738649F15313F2929FBF763291EF295FF0F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.;...9..H..):N....\|...\|.=a.-.k{<{.U...k/Y%0.g....n.x.g...vD..pE.....f9.GU..4..@..dC...... ...0.L..'......Ix..`..#.d....N+.W...>_.+.....J$.,..?..q.\.w.@..." `8A..08c...*...;..7e...........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.724900998939205
Encrypted:	false
SSDEEP:	6:6v/lhPKLxmEXaP+x7MvnhOD7VroIpj7Uczi9bUSs9hqQp:6v/7idlM+dM/MD939zsbVs9hqa
MD5:	681AB5A2C8CECD4D64CB99784E13A341
SHA1:	6FEA0726AB8F1B69ED13821535A7167FDE28DFEB
SHA-256:	A4FF8ADD8835E5E5C710CFD7089BE2BDFCF0FEEE69072C9733CDA1A18AF629B5
SHA-512:	30FA3C4948796503E06E27E540BE10C44FE6D7092BA02F2625136A3F621662B353393E96AE12D6F9481978BC9903B831260720A49E8DA57CDB8D36C1BFE64BF7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Sw.......):N.K(m.#}.9.f......{}mG-E.Q..r...Q%<J..........0z.......5.C...........I.....w...CA....x...p.@7..@.\<r...q.7U...ZP....J..Y.r&.[ ..)..Fs..^.{7.F..p...i..i.TN.P....R..\|.0...Y.i....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.842187642304482
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrO/WVtmUmpfkWsboUbl/jp:6v/lhPKaYElsbXbdp
MD5:	CC23AF77F2B5E9670511D97485C535A8
SHA1:	8CAF8387D48963D1D5C352597782CFAE1F22BE6F
SHA-256:	99C9015C2B1967D17FF49A1C416A8C5E4F6A8D633D42FC7D0C2CDB8E792E33B6
SHA-512:	0C67778EEF7145DF17D597E68C22922FBFF5AFA804A484D426A391CC312007ED0BFE2CBC6D979106D5B42E69B3E7332F903328BCCC38D4763782F05EB3C91787
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz..../IDATx...!......w" 5.C.....v.................v..!%([.`{....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.8514034706957005
Encrypted:	false
SSDEEP:	6:6v/lhPKQnm/P1RP426YHtZ2ydqDOQjU7PhB1s/I75xHOdLluYp:6v/7ifD42DtZ2yd+U7njxSL3
MD5:	FD9B5A605EECCABD35417D1AFE794A6D
SHA1:	3DB08519E7180017E0C6BD79CBBAED441329E2B5
SHA-256:	8EB51270378431A32255675C45BD970E953DEF01F93A2D99D6554B4893842A70
SHA-512:	B1AE989C3F764127A2D0866DDEB4986DE0C434B88A83F44F879BAF51C50934FC1B502D9CDB5C435AC906FA6566930DA06CD179C4C2754189ED3EDCF46F1D658E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@.;u..s%..."3.@..8M+...?..CDxO.....[#bSFc...=(.. ....&..g.X..8...`\v.@5.."....T...(..oi!.%P..$..P .>.(F8..t.f..I(I.,.O$.....%.x.D....r;...T.......s>.....L%!L._.......&......s...X.L}.,..V..MLK.."...!?.{`.L....U.Zi;......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.929833604759769
Encrypted:	false
SSDEEP:	6:6v/lhPKiWhq58UbG0Hs64cyQ0LdpK5nh05g+6PSIi/ucZdp:6v/7iiU1CHSNnLW5nEguIcTz
MD5:	BD167122C3FDA3EDA9EEE0DB115EE835
SHA1:	859B089BDC368FC349AF821E49D3E13FEB341DD1
SHA-256:	31F134F7F167D6A3EE8323115A5A9D5024BB0B5896142C4875F9842C037F47C0
SHA-512:	02ACDE58A8D893F81C8DF15B0790066EDEAD6D1D51E5F8E9526A8559738636B3E3E56634B2D26F0DCB6EA09493B1F4AE334B7B4D516BCCC0F5ECDE75A6BABD2D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.F..\..l.3.C0..8...{..5..k.7......t=.T..(.G.j]....%..W.z..y....n;".A8#........6;.....t.JvI..,.L..pU..,...H..Z.hd.5...o..Qp...2..;.....3...>?..?.Hx]=...-...)@.Fs..~D..p.........-.b...4..1CJ.8jB..........B......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	268
Entropy (8bit):	6.926469737946068
Encrypted:	false
SSDEEP:	6:6v/lhPKZQvhinbWujJgD8pxYGGv6+o/4ljOxN6Rarre47YNbmTp:6v/7i25inK8JgDmeGGw/jxKcsbm9
MD5:	1005E95EEAB34B3863DA7FA897C9267F
SHA1:	1A442B724684F0E1BDCEDD0DD2CEE5F003EAF769
SHA-256:	D15DD9482B00FE4E6DE13D3E3E774F6DD51BD10985FCD319C508FA3ED9743DB1
SHA-512:	F04D189696539DE20F98DFD031D67CAA10B75473CA1CFAF0906760B59C7B702A7B5CA6B7B15C6394C897DEDE00990FDC42B655225F0510C84E0FE5B11AD1035F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.;e..s%.-y...2E.ir........s...b.....U..u$.....=,....(..^F.[...n.`..#...WD.....M..!G........H.........Q.....'\+....4#.y.D..G.`.q\|.7......sy.(.^.".L.Y ..+..Bs.K....N#.`s..4x.k..\|.C.j..{.l.......l.."..V....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.801717461211327
Encrypted:	false
SSDEEP:	6:6v/lhPKjbhrLqqDr13d0Nv7o0WCgaVuzQT835up:6v/7ijNrr13d0Nv7BmS
MD5:	8549E28E7394A89B85A2979541C42CDA
SHA1:	121850A48E0D04EA8A68123FB115553ED299FDBE
SHA-256:	3A6A13F275B0AABFF1298B187B1ED689D947727F2442D7A1EB3E696264C9F94C
SHA-512:	2A1EF36784D616AA66EAC03A417123E7E01887DF629D5DE4E7413C0C4EE4B6CC6359BE0971262EB9606169A3D0A2C99579DE3DAC061C9EF34B950C72E3F8022F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0....=...I~GJOTA9.......~...%.Z..gZ.......$K...%..+....>* .#...+"....t...!O@.......H...w...CA.......[.....6.o..,.z..>...%.~'PI..3.J0.>5.D.............,..........p..T.en........A.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.781895643611826
Encrypted:	false
SSDEEP:	6:6v/lhPKLxm3/XouTl+fkO58O9BKzAUZ7Tjp:6v/7idQA3bKES7TN
MD5:	ED7DBA352EC6176B71EDE47C4EE18D07
SHA1:	F5C0B273077ED30E98D4864A48E94087B820E334
SHA-256:	D2EF8052BDDC99B3B2E8E66ADEC6A64C13E85052409F222E4574867A55F7DB48
SHA-512:	0F8A40FB5BBA87C4435B75239A2F8A70FC95DF796EE20D437ABF837CB97D0A0780C033B88EE1595D27B674D635EB4519D58311CF3AEEF77DA8A8247391EC1C12
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Sv.......)2N.K)m.#}.9.f..........ZQ......uT...x....V...[..=vD`.pA........O.....w.&.$'...+... J.[r@<.Z.w.F`...C ...9...x.7U..zP....J..U.r&.[ ..)..Fs..^.{7.F..p...i..i.*.a..D}b..{.0I.Vys.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_orange\glass_orange.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.411751853774936
Encrypted:	false
SSDEEP:	3:5gNRYKvSEB4xm0YRrIz4sSn:AYKfC89RY4sS
MD5:	C682789701D1C21F65097EDFFFDFD206
SHA1:	C50548244C317F39ECB9A6A722CFCCFE37853723
SHA-256:	7962B8F989049E4DCFE6ADE6196E850F1CDCA79CC03D774215C843414BA42199
SHA-512:	7782AB71F36625861738F937CD28C2C75D25003A2701CFE64CA1C07A61662AAE54EAEC47B0836C7C0E0FAA9151C09494424B9F2F312D9B8EBE3765AD95786E56
Malicious:	false
Preview:	matchBlocks=160 95..metadata=1..method=ctm..tiles=0-47

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\0.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	7.020946184257155
Encrypted:	false
SSDEEP:	6:6v/lhPKIjlu55XYJ2xo7M0rpFUJDVSm5ysqS0WovUpQvIfdQvCf38dp:6v/7iIpu5t02xPVSm5/qS0WOHI1/fsz
MD5:	AED47D3D7CC98FDA9C662D77C184B68F
SHA1:	66C65158774BD958002D69158DDF8FCF6F58D780
SHA-256:	694A403A9A36A1DD95DD26D826CF6190E13AF71909D9396F671B4E0BC980D97D
SHA-512:	88D4F3A4EF671A5863C4E571867C4FF342713610E71BB2E814433551FEDA79DFA9B3D5AC2A4F246E083E50F2A7C44EAB8EAE850AE7CD3A3C7EAD5B495E3B21EE
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..[..0.E.Z70.[..@..\B6.%........+.....C2..n...U.U.U.j....P\|.M..Q..<L..O.j.r.....&...g..7.-P.pD>.._..(8$..?...C.h.P ...,.....M(i.$...x.E.Y....Qp.......6..+\|..)h.\|.......k..,k...<...!@.F.OOD..p".2.'S.X.W...9..8 .....`................?'.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.991194528208778
Encrypted:	false
SSDEEP:	6:6v/lhPKBhb+ofEAzQIuf0/Kgz0YG/FbxNdRV/1YrkO9n8Gzlz1Iup:6v/7ibiocPIuc/KjDFxXzN7O9n8Gz91h
MD5:	93DE9E046DA82E4B783F203A29430272
SHA1:	5C9FFC8DCE1EB5C18EE04050DACE6E75DDDE88A6
SHA-256:	9547ADBB9D88E69C26E066FA1C7A339E43F3261ACD6169D9CF2F5D3F624D056F
SHA-512:	EA5E64E0512019DA4D756BEBEE42A9D8816609E84ABD0D9A66B8319413405F9B68E3FB2DEDD8E1244187F588850072DE1C9EEF02DBC4F46CED520A8AAC1845E9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E;-.X9#..)CX...:..P. .(....`....q~..z.l{...g..Z.......,..<K../.......................k.ko.d.\#..-.4M(..=...MA$...].m..."....T'.F.d.9".....Fr....JR...\..2...8...o...O.26Z...FD..g. 0...`..s+..)."..3.V.........c..;7...9.H:&....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	255
Entropy (8bit):	6.871796184208387
Encrypted:	false
SSDEEP:	6:6v/lhPKxbxmlzf6qkbd7hoLQG+cZVwgsbg3rkf42yp:6v/7iTKzfabdDG+4GbyrkS
MD5:	086344496B6CA62707A137D5AFE1EEDD
SHA1:	BB5753562997B1C30AA6D4413735A917A3E97215
SHA-256:	845AC09BA68BA8BEF6868F9B76CE0C6B059383A646B166A90143252DC69A3B05
SHA-512:	63E5DDCD8AE14C8044C9D81A8A33736411ABB06B458B00E7279BB925C75F247872847EE7385C66F385873E550A673B84B3FEE0E48539029618B1228E22CC767F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F5m..>.t6x.,..:A.K.i.#}.9.f..........k....X<.G..(...=.o.`..U..kG....D......C...<A.......@.0.~'.A8.DipK..'\+....t#.{.D..#.......J..@.....E..6+B._...g.V...\|....4....4...#..R..C.$j....\|....N..$.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.842409142073804
Encrypted:	false
SSDEEP:	6:6v/lhPKwhrPCbrjEVsPmgNa38IptBtkIEDruzQ/BZlzup:6v/7iOQrZna3FpztkvB0
MD5:	9094C343280BE79296A748F78AEC884A
SHA1:	3524AB0097E7E1CCB1107C2A80AB0D46FD914512
SHA-256:	A10DBFC1B15A0E8CF45426AD844993B52741763C60EC3B0CF3437D533804BF06
SHA-512:	CAACC5523FF9A1673367BA211AD4B19321FEB9F602731EB6EF433A69151D99B298B76FF23846EB39AE767CF39A38971AFCDB0C737BE0658AF9E6D8B595C213EF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0..S-.Xy..w.TA#.t...A....~...%.Z...<eV!....,.Wp.....'........t....;.".-.^TC....#../.&........(.>........-.m..<.Xp....\|.-.K&.N....4.J0.>5.D.............,..........p..T.en.K.z......N..l....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.926598438146595
Encrypted:	false
SSDEEP:	6:6v/lhPKzIIjZUWDstf5caON4z9UZoCtXN9v+TxXChPe/Djg7lGp:6v/7iseZUEy2aON4FK9vyxSijg7lk
MD5:	39A765DE3ABE14CEE6A458439C433F49
SHA1:	AE46E58015468BF00272167BC1CB9FD8514D3815
SHA-256:	60DDF6EB9EFD8F9F4C5E2F47F49BB19BD60E3F57126EC3F8C72290F0FF55C8D2
SHA-512:	DFEAECAC19B1D521762D935E8BC7E777640F8BB198A89E25BBF8D2F6D64A21965D34A9421910D1C9C5C94FA4381C8CE02614EA4E07202F13EA7901A48A32AE3B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F3m..>.t6d....@F..M...um.}>.Bpx.[V..y.l{.N.cTAl.......kJ@.....$\k....Y.....X.p..D.O..K...E"....V..}..@........,.8.5.....h.J ..9B...:@....oW...G.@......@.S+..`[..~`6."@.D...;".N8..9..k...7u..<...0...4.V.t,.x.....YHY&....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.870551955886005
Encrypted:	false
SSDEEP:	6:6v/lhPKzlm6wlkKzR8u2bHotgMsU4mfbaOWhSsDHpKy7yUJSQCbp:6v/7iRFjKd72of1baOw8oyUMx
MD5:	70A0DE7B422AEFC749CD6ACE83FB4F61
SHA1:	9FBF513B64A5781282597754E113DE4CDC2AFAA9
SHA-256:	5EB7D1E3BFFA7C6BF26D7DED4DD0A9D59E49196E29946B453892C8CBEEC75A5C
SHA-512:	909242635150DE6A51CDF73490A8D49A194BB8D5765BDFC0EA8DC06B185B773043FF4AEF652C17AD193B75D38E239B7E42B7FA4204696F2D7C0BCCF3117D6572
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E3m..>.t6x....@G..M.-.-../..A.....ok._....N..6M-.5.x/:[.%..g...].....W....4..@8.% \#_{[ .......iB....T.n.".....m..O..,.E.:.5B ...9@..x.7..0.'P......'../g.1...........B.g/".n8..........W1GOQ...!...4.........+{.N ....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.842171210663315
Encrypted:	false
SSDEEP:	6:6v/lhPKahy45f1V9Q3NLcDternMlMOnRgFTcRMzqw3+9PrsExUlXBdp:6v/7iwyvZMlhRgFT0Fw3gPpWXBz
MD5:	72C12F19C2B135E2D77CC2552DB874C4
SHA1:	B31BB028CCA4B3AB6FF1BFB3B0738BC894C4841A
SHA-256:	A378A43BCC3271499C0462F9BC50F7F8779C822F222C6DCDDE93C1B222270698
SHA-512:	FC23CEC86D59AD01F5ABCED68C4B8C547487477E2C71C5C196094B6B31FAAB862F648703590DCEE11834D8162062A575B4E4A10352A1581CD8F7AB2FF6F2AF79
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E=m..8W...!....:A.KT.U...p.9!.S0F...wr.f......;..u....x......f.....vD..pC........O*r.4..@..dC...... .jD...>`.p.@:.#P..!..[F...q..[V......<\2.^zE.3.......,..x..hv.y..lN.\0..x....!U.XC,s:...q...SG6.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.885835383570208
Encrypted:	false
SSDEEP:	6:6v/lhPKdQv1CITin2zxkrSQKdJxMLjJuqsLgVHtGMnC/p:6v/7iKYIm2z6r26ETLgxYMnCR
MD5:	01865F9F5371E08A5BEAA6219EA26BCC
SHA1:	B99BEEEE0A5F4E02A3A0ED6159BC3E2B8F10AC78
SHA-256:	F52D75682363ECB87BD0439C73BA7B83D8DFDE26B1B8A4F2FF07759FA98B447C
SHA-512:	86CC8EF2A2E332C36F52AA6B1BADB2E95185AD5AC3DF35277AE1B8E061ADE03C600390C98325D7A99FD2FCDB75B5C86BC7AC2B71C0B432DFF0B2AFB65F7BB696
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.@=m...#Q#1.)#x....r)R$!....8q.'.....8.A.....$E=..1...i./x..5.`..,..ew.t'.z......t.....6.E...Kr.O...S..Kk.P`.\....+..T..p.@3.[.@..F..4n.\|...>..T\|....@&.pI...?..j....-..^H08.T..,N..`..t+..M..F.J.&........i..+........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.943711744229787
Encrypted:	false
SSDEEP:	6:6v/lhPKzlmCljP6IASzSupf3ez2tDnSRcx6gYJTB2yDcjp:6v/7iR10du1ZSg6tB2ZN
MD5:	47032FB8DF8F9A6DDBA9D45108D36C6A
SHA1:	BEE17FBDB25E3E5C977F6F76372801B9783B8CFA
SHA-256:	4DFF3D714AFB7763208808EC77F866E756D71C4F34BD7673A6FA838525ED9D83
SHA-512:	F020DCC922D2DA07D88F85D80D59099F5D5182E8D71EBAB4B868E7FD341CA0316EB1B113E4D76DA59C679D8EE3CFD9A6CE084F8C9C3EA1BE54046F22B85F64BC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E3m..>.t6x....@F..M -.-../...L.#....q...L.uI....K@.....E..+@.p......h ...p.K@@.F..m..k..x$...e..L..pS..,...h..x.Hf.-......Yp...rn.;.....g.%)\|~........i$.[`8.S......(..,....4...{^..=EY.8c...p........S..<.v...Q.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	275
Entropy (8bit):	6.827786022080814
Encrypted:	false
SSDEEP:	6:6v/lhPKlhiku3s/ocwQgIGcufU8vxkAgzLa7nMVly1cVyVp:6v/7iXikucopIGXkAgeoy24
MD5:	15CD468508B53D08204DDDC27D8B20F2
SHA1:	ED3AE8E60037D3D49686410D65F443E8E7A5A5FD
SHA-256:	592F0D24872EC27ABFF71C6AF2508322C75242796E597F5D5751F1674BFC59DB
SHA-512:	F078DD2F324B34D270839BEC9FAA9D3EC40B93030F2F986BB68361133B417CD5792B717C827F20385B7FB4449DEDA589E35C4EB234025597EF9C75E3FE591B77
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E=m.@>W.l.CD.!.d.N...C[..>.....{.....?.3n.bO....Z% ...\..].r......@...x.U.U......--....K....D....KgAS`.\.....\|.o.J....C ...s...x.oh...n.r...>.....<jB...9.g.?.H.h.....N%@.p...Yp..W.r9...x7.6.I...s...........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264
Entropy (8bit):	6.817118720162522
Encrypted:	false
SSDEEP:	6:6v/lhPKshy45fQD/vhVZEkDpiv5AsMbVJEfskp1tjp:6v/7iSynThVFDp2mbEUc1z
MD5:	54B365A4BFFB3E2CCEAED8D65013A668
SHA1:	87F73409B8387B92B2698676792AAC6B5951FFD3
SHA-256:	C173E8C3D044C22420D798410CB3C28ECC1C697018D153A0CE3F637A2B542100
SHA-512:	9301E76F6E6DF1CCDFBE145D340A4960F5BC1B6EF6C43F7FC396F527B13D1D0D58A9EFB0B414F26A3CE3E9D61F14D728AE192AFCEBC1AC572B93C9CEB17E0BF2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E=m..8W...!....2R'hr......6..........L...7.....f...x.]o.`..U..cG....D....h.M.TE. .>"..'.&....T...Q.........5......Qp...6^...4.~'P...2.(.^zM.._.t...+....{...p.........#..2s...H.'..x.k...>..G..........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.841318034656279
Encrypted:	false
SSDEEP:	6:6v/lhPKAWhy22B+sP8j6DnqNlwo/eoFY5kIdsBxhaaux5mnh2+f52tjp:6v/7iAUy22Bl0cn0qFkgs6xq2ge
MD5:	F10C553F6004C2034EF27291617A8503
SHA1:	54D7D94840F9B7CACA472FB2C912F0D1048F6AF2
SHA-256:	A26392BA64F2569118085F2DE3F8EE651C460FD837426A3D347354FE4E33CDFB
SHA-512:	61DB64B7A136888DC5DC583BE2FC1DC81C380F76AE59DAA97C990C699A953297B637F5C57E8D9FF08DADA100A775E6A0802DAE509671A4ACA45ED2D8858D4C3B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...X.+....QF.......rhC..m\|.%R..b...y.....x...\...F.f..<Z.......~vH .pF...".,HZ.t.\|...!..........@...*..>....\|".m.H M.....5..M......@...D....pU.,....~9.W...H.h.....N$@.p...U.[1{....v...Q..Ai......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.894074578700596
Encrypted:	false
SSDEEP:	6:6v/lhPKehixBKv4A4wCeJEqsOb18iv70w98knhaYtWEKp:6v/7isixE46sOJXfg
MD5:	8758537A8D7B3D746163A9802A5A297F
SHA1:	FB0D64F68305880C6120D4F9E32093347967F907
SHA-256:	96F232B96241E013C20963E1CDED9D9B9918523744A556499C833441682DCC04
SHA-512:	DB90D604E60173681D61961907BDD11F27765C6E33FAC6D21CE690CDCC0DDC333951635CA275149908B0AF8508B2E8E4C5923685E3961A506BFBA3FCF8F26626
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.6. .+q..!....:A.KT.U.\|..r...b.-.y{.;k....-..(.....,.7.i.{.8...`..#...."........#G......J.....W...CAT...D...p.@w.{.@.\"r...q.7.._.....y....fM..o.r.....-.>....p.............5L...!..c.clW........ 1....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.880514234926798
Encrypted:	false
SSDEEP:	6:6v/lhPKLxmlzCSOD8hMYtH0NvBXB0tUSFkllVp:6v/7idKzPvMY1MRB+sl7
MD5:	070F4174E929D70F468C068FD3D5DB3D
SHA1:	565CFB6C14B0E5DAF65C860A7B6AE69954326B22
SHA-256:	9B08A9CF65D3329017D8CB79A9FD1699F586315A09DD7B4C76581892B8531CE7
SHA-512:	9FDCA8C412E64CE5131DA54C145CA5C2FF3895B692F39BACE72E6DF4CD4CB6B3B1AB5A1D3C035DF9A6E992ABDD35CE3E15A667904EE49568147F5FC4420185A1
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F5m..>.t6x.,..2A.K)m.#}.9.f......nK..).py-..Jx...oO.[...n.`........p.k....?.#O..."0./9."....t...Q.........5......Qp...6>.;...~'...qQ2...3.....O.V...\|....4....4...#..R..C.$j........&.....@3....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	260
Entropy (8bit):	6.838134448265211
Encrypted:	false
SSDEEP:	6:6v/lhPKoxmlzfLJkSgOSTblPhb1LBwnHqyu1cZVlEROIgYm6o5p:6v/7imKzftGTbl/1IHr8IiNgLZ
MD5:	C23152DD05F464CF218D204EA2CCE78D
SHA1:	EB49B5C3E0F442B93B411C8A5B0E4B845921CC66
SHA-256:	FA8A1E56AC622C783C00885BA8AA0A56D8AA8100D49C55485C9B6B6460535883
SHA-512:	40CE475670AD0D08449EEFCBC2677E4C1EA8FCE17BAE4D336085089C580ADA88E75825EA6AF237465E18217E635E76B215FABC3E60EF9EECD9FA261937892D67
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F5m..>.t6x.,..:A..BiJ....A7.......u.k)...7..x...Q.ox.....p..........;\#04....\A.......@.0.~%.A8.DipK..'\+....t#.{.D..#..x.G\|S%.J......dx.5!g........l4.....w.i...'h.H.G..K.o.* QC,.......F...L......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.796728981475915
Encrypted:	false
SSDEEP:	6:6v/lhPK8WxmlzfLJkSoySTblPhb1LBwnHqyu1cZOWGuC7tIlKldp:6v/7i80KzftobTbl/1IHr8HWGuis+z
MD5:	15294DEF9730703EC66F395C480A2E3B
SHA1:	1E80D0AC21DD1C61F1961B8AAF77DF65D3B0AAEB
SHA-256:	6AD26181EBCA341BBFA9BC083840BA5E8BC5414FD56586D774A86F8E311F2077
SHA-512:	1D0B2C7CFD085CCCED5AF47D1973A85031705973E1D8D4EFFA32DDB5FD16A5B94089D478D96D33138775F9F2D3439F0F9842BD816365959E571ACA84A0EE63E7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F5m..>.t6x.,..:A..BiJ....A7....O...u.k)...7..x...Q.ox.....p..........;\#04....\A.......@.0.~%.A8.DipK..'\+....t#.{.D..#..x.G\|S%.J....ipQ2...3....o.V6..\|....4...../H.GL.r...H.'....z....NN.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.863193722020813
Encrypted:	false
SSDEEP:	6:6v/lhPKwhrperDEfPmgNa38IptBtkIEDruzQ/wlbp:6v/7iO9erQfna3FpztkvQ1
MD5:	550A0828E6FFCB46F9156D3C03E98A88
SHA1:	FA54717B3CE8BFCE6C73025EC7A9310CB77C0AE6
SHA-256:	816A63426C74A51D18E50EBBA87305D7395FE219BCD4125B6F8C16F4779645CB
SHA-512:	DC3FF5BD07BCD95A8C4CF79F5807465FA737BF672C65013933ED33B71B10239A0CDACF0E9C82C4B9053E3BBECD2043CB06476C178627143EFCF696A4D4C9867C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0..S-.Xy..w.TA#W.Up.A....~...%.Z....]j.B<\..,.Wp.....'........t....;.".-.^TC....#../.&........(.>........-.m..<.Xp....\|.-.K&.N....4.J0.>5.D.............,..........p..T.en....S..N..`.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.927892292059341
Encrypted:	false
SSDEEP:	6:6v/lhPKiGEY0SFhgWNJVskbR0uggZQk8ylYigiwiIrv/PRZIcIp:6v/7iiJY0MhgGJB+sCylYigiw9v3RaV
MD5:	CA1A936556D906CD2AD16CBFF79CC3F5
SHA1:	48E33490B06DAF28686C0328C93CDDE62BC79767
SHA-256:	16FABA9437D67A4A9FA37C40A1545A9B920576276599E49F916BD7D00BAEA5C5
SHA-512:	5621DF944D5AEF18961E5004BDD17C7885621F29A54C1077558A772174F998F071E6A86E2F7F3621D53AF43CD52BACC858E37093D95131BCD4BD5D3632374F50
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E3m..>.t6d....X'hzH...H..6=....a+?.r...^.IU....%..,p.....W ..n.....XA."......-....."....V.<{.)..7.2..fAU`.....KNY.@4.%.;.9B.......8.......D....WU..O.&,.ce.....7.q6Z..t"...s...N.^0..5....Pg.....I.....m.UO6....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	261
Entropy (8bit):	6.821945870554969
Encrypted:	false
SSDEEP:	6:6v/lhPKOG9xR/FpPShW8LvMvNHRbmf7rCTxJgbl3hdp:6v/7iO0xHp0Yc4xCRRz
MD5:	9A2EBDE18027E71DCBC18903856379D4
SHA1:	0FA1781F5755085930A35DAB988DA6A166A9A81F
SHA-256:	C8008A064A158352DDDD395D62BAF4D287B356E750111DD7F7992A8246EB2896
SHA-512:	52452CF719A114325F737703C2C8EDA9463ED8B3588CCA6F217DCDDED5512324CD164728F86262E0F14C6C226D535AF6A082F53CE47EA5906F627402B6ADC66D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A..1.E.^.tm.I.A<.......Q..>..`.^..-..\|..u..-Q.....<K..o.-...W..cG...gD .........H.\#0.+94C(U.@.. ....h..y.H........,8G..9..o$.`.L.%.....K ...cZ...X... ...~D.=p.........=.b....r9...Uu.."..X.2.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	248
Entropy (8bit):	6.857285281000265
Encrypted:	false
SSDEEP:	6:6v/lhPKM5suLue2vb1b1FZ+d50auYRyc7YGPvarsup:6v/7i2sBea8d508RtVAN
MD5:	CE4BEFFC0303AEF8C5A3E4E28EFB9578
SHA1:	B700A83EE782096C2C11942F29BA4A63274F598F
SHA-256:	273F76CAD7838D87764D89130E8ACF0ED26910F403246A2BE7D17D9943BCFA1D
SHA-512:	DA505DBD38A1DBBBD852E68CE52589B358FA9B38FB7024C7964B8A546918DF7BCA13944BFE81980DD9B13A82ADC1B3408AD68899A9D2460EF7AE95BFD7A65951
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A..!.E=.....Y......LgSJ[...#....0....x....d....%p......_..........p.[....?U....3..\|...B:.'PA8.Da..PO.U..n.....!...G..b;..v.{...>?.+...h.%..-.......G.@..." `8A..08c...*.w..O..[...........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.855692025765309
Encrypted:	false
SSDEEP:	6:6v/lhPKdrfSK8/+eKJHNamHiPk0mnAdJ8sCHhLR2MgDgYExp:6v/7i779Joml0TQjHdw1k
MD5:	73F0CFAC665845D1572880CCC2FE98A4
SHA1:	AFF0C23602CBE55FC18E8EA5890E92518EFF7A56
SHA-256:	F28B0B3C00062AAC48409AF29503A04C0DDDFF7A8C2739AE6842813477269BA9
SHA-512:	51663A5D4FC8C4617A8F317F85E3D9F878D3CB2C30425C58085BFB3AAED3D2F8608B8370F2F39685EFFAA840169ECC7DD861F389FAE4D59A82F22865F0B1959F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.E}.\.y..l..z.\,'h;dh....F.X"....6...[`..19?...$p7..<{.......~vH..pF...*..H....-..E...%G.w...].....)...nBM.ee>..5\%P&..B....s.&.q.oh...n.....<.....<jBZ..:.W...H.h.....N%@.p...U.[1G.....?n."..Zv..4.5.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	274
Entropy (8bit):	6.895824139188574
Encrypted:	false
SSDEEP:	6:6v/lhPKWgSXDuncytmKNAd5ycyQ0LdpK5nh05g+6PlrWiVbvelljp:6v/7iK/0mPd8NnLW5nEg9hE7
MD5:	C4A478901E73E7BA5E3B0E0F68EDC323
SHA1:	BE7C2B62CF9F9927F25736C5A86F999B221BD894
SHA-256:	B112C3C58049F7F394A893F58C77037430D052A631890F11F5F3DD7C293B8737
SHA-512:	5C675F5B69150549B8788C2A8A5179130BEA1BA64C7F55026640E206DE8A38216E5356C3FA18110D8DE7B013C3779CF16704533B2D6C7243E1D4BEB7EE42421E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.E.....#.Fb....@F...+.EI...}..!.'0.\...m.-..%P....(..<J..W.z..y....n;".A8#........6;.....t.JvI..,.L..pU..,...H..Z.hd.5...o..Qp...2..;.....3...>?..?.Hx]=.t&.[.t...).......w.i...'h.8.n..........R*.Q.rI..'F...].....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	265
Entropy (8bit):	6.851221464880251
Encrypted:	false
SSDEEP:	6:6v/lhPK/bhhssaaEhzCaNNEERUtpp8pJQ/m42KSuTPx4DEa5x7sup:6v/7i/NczTfEmKgJ9dKSuTPJ6sc
MD5:	22F4D4BD5E0E9ECACC455A7D58CCAFDA
SHA1:	628264033199D059A5D72B5232FA64882B83B2A6
SHA-256:	0433F7AF8299CF711359808FB3E7DEC4E81A36D9D77E24FBC0E9E3ABD2EBF68A
SHA-512:	4993A0CB56F84FDDE73247591D7BD425E6264021A66BE9E4B8398ABC95180E585D959C61739CA7E32DFAF80B80D42419AE67733A7624E2F9CEE6CCB85D7F67A3
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E=m..rF.9R.@......(...5...s.=EyO......A...3..R..h.....^.2..+..p....... ."..p.@.l.'.9..\|F..W.#EH...4..5.4....H.U .n.hNx..`.kD.P.q.......R..y.$.^FE...o.t.....-.>...]p.....4.......5..T....gr..r...v.0....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.847766881007202
Encrypted:	false
SSDEEP:	6:6v/lhPKkWnmvkstozQtn8sPX3TXfPCbNI7ORgxSaalcfP3lpMISUCXEopDS2bp:6v/7iktkjzQR8i3bfyqb4ClrnO1
MD5:	A1673F875DCE714621DC199F07F24E94
SHA1:	564BDE9FB6117CF9D777E400D619CE2AC4BC0642
SHA-256:	F6B3F28FEEFE5443E94526C828B6884F315C4EDBE203515697FF7F9661E51C34
SHA-512:	714A859C11718AB21262F1C46C8EFC1418C4E7775E4636F52D3DD06175A6DF62B4C9E5F16999D51B6152FABB725FBA8F425B0F379F827D901B40FD5E787A670D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@=m..8W...!....:R'hR........!".'p...........q....;c......x....@..Z...n.(F8Y...".".............}....7...>Z......I(I.$.O$....d%<{.D....r;...T........s=......KB...9.g.O.(L4.x.B...'.@cq2....[1971..."...!?..........9..#....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264
Entropy (8bit):	6.931105338037216
Encrypted:	false
SSDEEP:	6:6v/lhPKcR1N0St/eD8TSrQX/Itlld6eHKkEv+TnRPedp:6v/7i+rt/y87tkEWTnMz
MD5:	A9DE93627E7311A2420ED116C9DD979B
SHA1:	89C0F2843898039B58CA828289B2A035E8051E1E
SHA-256:	A6256A413427EB348963FA2F9B20EC97C0C106AA4C145434DAB8D61192143F85
SHA-512:	95D8F12A95DA75E4483DA9BF3096E94943E4E6C5BE28C44CE7950AD05FC90DD26EECF041D083D10EB421A6FED1B62570343A79AE4E8356F7787DF307EC5AA467
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E3m.@>W.l.C....:R'hrh.....`....d.Y...}.KV-....e...Q...D..<....;".@8#....p.\|.@.....^..B...*.7..d.-.@;xe$.$.n.....!..g....v\|.......(A...p.......f....{.2.....GD..g. 0...`.\|.W..!g......./.~..O,{.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.9396320924896315
Encrypted:	false
SSDEEP:	6:6v/lhPKelm+2E3uTn3b0p4znNtCcvINr87MpKYEktqlkup:6v/7ioqT3QpO/0hpKeQl1
MD5:	910D7E491B7A013C72B6ABE7B416CB5E
SHA1:	EBA72A1BBC26D223DB0375A7EAE7D3AAA1845420
SHA-256:	5355726A760F5E2C42DA84A6175F75DCF53E62376EAE3B91BA0BB45DA7F2F8D5
SHA-512:	DF31FC55E2D1188BD6022F7BFAEDDFC3F069D52A99892C16189ADF2FE08914EBA44AD6CB52DF536487B7242752B6A89F12C4E9F69BC772957B3E723F31F4D35F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E5m..>.\|6x....@G..M..4%..%..s2~.X.....M.j.6..?KP.....Lx.../.......0......+"....t...#....t.Jv....w...C.(.n......p.k....<.......8..M3.w.%..\..J....9..+....`e....[.....`.9AsA.<.5\f....5j.=.^.........@......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.777744447327991
Encrypted:	false
SSDEEP:	6:6v/lhPKtzIMghKlHmuNxbqoDFnVBrShts5RVwKUxabp:6v/7i9IMghKlNxb77Bug5sJxs
MD5:	CC6C5E7B54E61EE70821C7033D77D0E1
SHA1:	2CF74B4FF39249BBE7AC2888F7EE0A815617B791
SHA-256:	411039DB607D92CAE98E0D977398883D422E27F45ABC64240BA2C3AECC503682
SHA-512:	3F4FA5B05F58018469F5E48E17191B0E5858636B40C4B788867738BE119FF692761B628EB9FAE854560D0035EDD0D915CA1EE65D56EAC7F69C71F85D055C296B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.6.X.+....].#u.&.(j+.\|...\|.=a.-....VV"..{..!8K..gv...>+ .#...+"....T... -..G..$+2.txK..p(...39..p..;."P&..C..W....v..V.[...>?.+..so.%..-.....q.\.W ..g..0...A.......*.w......\...%......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.748879457296769
Encrypted:	false
SSDEEP:	6:6v/lhPKdhyZZv3lDOlEa9x4rWDLCCNbtk9reu7fvzE0up:6v/7ifyZ2lNx4rWPCCNbS9rfjNc
MD5:	326956A6FA420C5D2F567178841581AB
SHA1:	05194F9E34FEC29A490AFF540D902ED805598AA9
SHA-256:	513749AB29D5D068165DB956F132F60C48F762878C7AD27579736A8F7B720EAA
SHA-512:	BA3B5B3A9054DDDB32A0663B1B34B2316541764551699496B3CAC35C7CFB38209DCBBC471AA69A755C42C245CF8B5D875ABDB8B107CF688E8FFC141F15B8499C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...,.\|Fb.,..2A.KU.U.....W...o...^3....gI....%..7....\|U@.kG...WD..n...C.TG.........H...W...CA.._....[..........,.z.,>.;.K&.J....gp.`x.kB......?...h.._ ..g..0... ...5s.R.............A>.r....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.850516254803532
Encrypted:	false
SSDEEP:	6:6v/lhPKjrNP2lqqsr1/5mZm50VPrTrbQmggptwEAmXv/kup:6v/7ijl7509bbQuptwEAgv/kc
MD5:	E387726B130DC74476D7FFBE17D322DE
SHA1:	33D0B8DF4761AA3558183FEBE775F9A091C5626A
SHA-256:	AB7F371F0C04ACF199A33950B57E4589CA713D6117033C985B60D2DE11C852A3
SHA-512:	5B4E460622E84994ECEE8569273D5AC81EC1992E498DB502CC5108F5B5A5C14257F46946F159956690BB179797B750F60FECAB4E1599D3DF5D176C7C5611AF96
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0..S-.Xy..w.TA#.t.......Y.#..fF..V..3/[M....d.@..%..3...............p.[....H.h....>..!.~'P@8.Da..PO.U..n.(...!...G.Hg;..N#.w...>..+.....J$.W .~.....^.x..E@.p...ap.6.FnC....w.R..&{.N..2.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.903860538428743
Encrypted:	false
SSDEEP:	6:6v/lhPKLxmlzCSOD8hMYtH0NvBXB0tU8CYRsup:6v/7idKzPvMY1MRB8CYRsc
MD5:	2DBF944F7E5AA74672671AFE5E24E180
SHA1:	0287248FDDCA93BCBF5EA441DBFA373A07A5A033
SHA-256:	D920F5FD685A8F7CB89DA600666E51524CDF326D39B2E0A7DD6930D62E532EE7
SHA-512:	D2C33A1BEA9256ED35449163935BEA4C72C8A93FF07CAFDDFF53A1A0422B1F13062CA75B41E6824811C25D189E6A901E81C19CB49091E316409D309DB8F75397
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F5m..>.t6x.,..2A.K)m.#}.9.f......nK..).py-..Jx...oO.[...n.`........p.k....?.#O..."0./9."....t...Q.........5......Qp...6>.;...~'...qQ2...3.....O.V...\|....4....4...#..R..C.$j........&{.N.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.847499778252359
Encrypted:	false
SSDEEP:	6:6v/lhPKzhy/4g3nSIqNMcAkdENDwEXNi78tjXDFed1V1UcbIBp:6v/7iVy/4OSIdcAkdbEXN1bD
MD5:	FCA02424BCA10564698E153EAB7F06AC
SHA1:	8B4B345751FAAF9EB286F14EB48A8AAA0010D52F
SHA-256:	9616177646F3F2C943365B32E289A3BAF5E2D83664589CB9B2922FCB91BEE3E6
SHA-512:	3A13B4896D4B7391AB2B091D15368B04C21D93C3D9DE3A24761B785DDA4AC09B2A0141164A870363FCE785404C0E73DAE30776ED52B92AA933F6B7B017DE3A4D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E3m..8W...!PG`.....H.-..o...H.=ac...?...EQ6G.>.V.H.n.'<x.......n;$.@8#..p.@R,Z...{>..".H .G...S..... \......."..^P.....8....^p...4..w.....o. 85......",.m...\.....,4.x.AB.... .9As.,...W..r8e..x.$..;!Yc...,.K.S.=....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	270
Entropy (8bit):	6.827633080108482
Encrypted:	false
SSDEEP:	6:6v/lhPK7Qvhb+fpu2k64FleB2zn5ClYwhpSKtW8hfS6/bp:6v/7i4i42PIleYzglY+pHxfT/1
MD5:	1404FAF0A783FBE7D786B85504FACC62
SHA1:	F8C14FFECDBA7F04C3D0A8BA493EB00FF22D04F1
SHA-256:	7F4E6CC86B2B26229D2A0CA10FC6C1B742540C373D311F1CAC4F0D90FFAA2224
SHA-512:	0B646D14171D7152E999CFED30A49C48D1574B2FC11DE8FB4CD3EB5E4F35CA966F9E922A43CA2F7065273FDA20A4DC11FBB37CCD426C526C2FAC2E4689994E03
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E;-.X9#..)CX........ .(.....k.S.....\|..u.-P...,..<J.......\|V....4...;.% \#_{-.,.F..G.i.P..=...MA$Yp.)..^..".[..$.z.D..#.h....Fr....JP..\\..".et..J...r.......>z....Y...'h/X..y.s.n..)Gn....dP..<..6..O..g....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	255
Entropy (8bit):	6.865947784966997
Encrypted:	false
SSDEEP:	6:6v/lhPKxbhmlor3uQh7hkUTKVOFx7t5BPD3P/plluO+HpQr1Heup:6v/7i7oor3fthkr4x7t51D3Ph/bkpQhz
MD5:	E50690310999CDB93914AC5A3DEE26A6
SHA1:	68A22B48BABA59BDADEFCAEBF013F0ED896D69B5
SHA-256:	87C2478FF3213EEF298A2185204EE8578E943863391458EBD983846A8B82B234
SHA-512:	3511EE0C4B386127CF926A0A5739B78A70CEAF83629FD3D7803E016B57E31A754C5C399ABBE2D252B955DF26A7795F0362B4D215FA04B9DC5A79E9B34B5CCC08
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!......xG..."N)!...$.S............(..}[Y..\.%....,.....@".^.A.... \..p.E.[....\..>#..'.!.......(......[.........\#r@..q.wY......9-.....!.L..@:.[@.........8..........m...T.e......5..........`....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.880439477252079
Encrypted:	false
SSDEEP:	6:6v/lhPKiWhikunqT5c6IIpJB9ncODOJDb5mVkpVdc5XH+WY1Pjp:6v/7iiUikuqGrILBpcu2bb8HpUN
MD5:	399F40EE97842E304A157FE1B0597A62
SHA1:	6293F266898333096E64D7D89128D4B321500079
SHA-256:	EC33546A17EE06D43F83F29E6F03A4C1FD13790A53C7C2A32F2E76B4FCBB1623
SHA-512:	9A7D565856CCE3DBBAA6BBDA048EF24EC6CB481B67D01D6D72F45593B4CE79576C19B42BC5754D90C16935B9B7AE5A6F5C70A1B444C80A78D8962E920DE701AE
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E=m.@>W.l.CD.!.t.N...C..6\|0....{.....?n..'.............].2......@...X.E.U......-....K....x.........t.J./....."....../8[..R..;..9..%.N..\|p5.<.y...~9.W...H.h.....N$@.p...Up..#wC.\N.s;...b&..........B....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.962152285247416
Encrypted:	false
SSDEEP:	6:6v/lhPK/Qvlm6wlNoWd/s9sVotgMsU4mfbaOWhSsDHpKy7yUJuUdp:6v/7iYF8ooqvf1baOw8oyUoUz
MD5:	CD5864F3DC9440DF94974DCA8C13E2FE
SHA1:	201002C8A1B65631D50B7E1F6EFDAAEF514CB8EB
SHA-256:	E83893C767CE56D64AA0BA6A4F9834F696C7F510C3BE10F6F63E920E646EDA33
SHA-512:	9BC05915EA9743EAA04DA8FBF7C5FF01153D5E32DB322F51F7C9AF179EAA63EA496E8EB97F508084E02D40DA176D3AC160F5F04F8D8CC1BDE306FCA630F1E8D2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E3m..>.t6x....@F..M.-.-../..A.....ok.]..Q[..Y.....P\|.....P.....].....W....4..@8.% \#_{[ .......iB....T.n.".....m..O..,.E.:.5B ...9@..x.7..0.'P......'../g.1...........B.g/".n8..........W1GOQ...!...4......;.....X.x....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.8148523674611985
Encrypted:	false
SSDEEP:	6:6v/lhPK8WhUpgbYN7adTzZSPBpSujtEs8nl1p:6v/7i8UwrgnZKpjtsZ
MD5:	58E8637F7E47BBBC5B821BF55E86B724
SHA1:	D134C4BFD524A7240E233FBD936D3B5B428D8832
SHA-256:	304C0A856A886953E99904BFBF5AB075311D57448867B787473D739F0853AED4
SHA-512:	5CBE252B698DFB17259634062EB120B59869CCE232BC654570319B022B41B377B5BD98522D43224BF7F4B035BC0E2094D8687D2B24EB8943CF67C540BC067FB0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....1..S.5`..w...(..(.... ...{..c..Q..Jy^n.=..bq.#....,..^.W .p.....t...@8.".-E..!W@...t.Iv....3...A.......[.........\#.8..=..J..@%....U..u.....H......B.W ..g..p8A..48c.n+.!U@...3.A...um.QvfH.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	269
Entropy (8bit):	6.81800181861872
Encrypted:	false
SSDEEP:	6:6v/lhPKHhiVwnQg5PPUBkOtZPgs/4xtgqy42i0+gZ0Sp:6v/7iBiVDyUSOvgsgAqyDi/Y
MD5:	1D7628D170318C50F2B74BA2A62D0E1A
SHA1:	6FC512C2358CD7979D58F444062BFDAF9FC11805
SHA-256:	0ED1D6F79CEDAF06F133A9D04AFB7D3E027732E93EF88F23E4BEA4568798D45D
SHA-512:	BC388A46ABAD8D687CE3DE24B008D0829AE1F980E3D51009C730559E357D485F82CBE29A88DEB135AEE4CCA5076779D609F69399CF860E574028FA882664901A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E=m.@.+q..!....:R'hs.k..0....{.......x$...........p..........@...X.U.E......-.....K..o.x.........p.j....T..p.@..g../.X...,.w\|Cs..7K.N..\|pU.<..kBZ.....?..l4.x.BB.... p8A{...X"wC.\N.s;~F..o.b...i6.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.795670961980187
Encrypted:	false
SSDEEP:	6:6v/lhPKahy45UmrEZv++vMtaphn8aOcdF8kfbjeErbwr0VJEf7yzEtVp:6v/7iwyzcEZXM6ROMKkfbjzVEDygt7
MD5:	14B99875C88A5FF62EFF44E9ABF02D75
SHA1:	7AE847B2A425FBC429B420753520ACD16514BE86
SHA-256:	87268FD68D14561041EBFECCC11D2E42B435395DC50957827DB72660DA3F1878
SHA-512:	DF03444AD630F4DA2518D730BBE549CC141D454B22F3589B640788CC1D13E8A73021FA1DD7DDF9484AE4814EA55983B7CCA206A0891948854DA8B80C65493B03
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E=m..8G...!....2R&hs......6.......c}..k....].[G3.Q.'..........#...."....4..."W....h..lH........(.n...k.....j.W..(.x.....o....(A..3.(.^zM..o.t...+....{...p.........#..2s...H.'.......>/H..Q.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.851669863298139
Encrypted:	false
SSDEEP:	6:6v/lhPKAG8Ncz7Ge+Pk0kGlVybvlDkVMvd2Aqd7QEgSXoHlB1HVp:6v/7iA8R0kGlKLEPd7Gl7H7
MD5:	39D28B92E9CEB3B354DE0C4B78AE79A8
SHA1:	BF8D7D33B9DB8365BFC70700C717BA30E4FB64F1
SHA-256:	CE52187D4E73593A451153CA0029005CD7CC006FA06D08BEAE7D79C0E22DCF99
SHA-512:	50561AF268761B32DD5D314F3B9FE694BE68CFD99D532DEBF040B77A1A9B7AB6C91B08C0E4B25B752E221C6607F709387CAE3B423E81658D05C933D2FF3726D5
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E=m.@>W.l.CD...t.N...CS...0.K....&=.......'...E.H.n..<{.......~vH..pF.....H......."..........@...Y..X..7...2.J....(..b!..g.9@..x.oh...n....9.\M.Ox.5!-........l4...BB.... p8A{....#wC.\N...c...$......P....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	255
Entropy (8bit):	6.855564947002828
Encrypted:	false
SSDEEP:	6:6v/lhPKxbxmvUu0e1tWGVGZxbpTIVvvyAdQflTk0U74Mp:6v/7iTbheJVGSVvKDNg08
MD5:	C625A79C1F5B1A44B5A840B681C30BF5
SHA1:	1E27040EB86E3D851D4DF0E9C20F4E41FE732BDC
SHA-256:	D59DE8D1E9CA0DCA4623ED904272C9085A4D5FEC47EE0471357A78B0C1316579
SHA-512:	192BA11023210493BE8C04DF699B70601FAF3337F889A3CAB565A41267C87F7BF3899A7F739D3C41AB85038C9C93B5BFF1FF63CE65AAA805598C1EAB3116F028
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F5...>.t6x...:A.K.i.#}.9.f........l..E...w.j.U..6x.....p.....L....;\#05..Y.y.0....~..a8.J`.p(......O.V.....F......G...9...J..@.....E..B.....G.V...\|....4....4...#.a....5.R.x.>.....af....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.812710953758868
Encrypted:	false
SSDEEP:	6:6v/lhPKgEjHTaKiIEXwE91Fm4fHTUW9krqj1QYZ+kSDs0sup:6v/7ih7GKi/gEEW9krqWGtwhsc
MD5:	3BB15FBE2F41986ED87FC350239372CC
SHA1:	5FF649F64DA9F35B8E65533CF20EC86E6EB8DF21
SHA-256:	62EBA96E7EDB12CF874D85F4BEC55AEA24C661D4822AA0B33F30AEADBAF8A65C
SHA-512:	BC9E56B84603BFAF4BE8D64224778971BF0B3D44E8875A080FFB927C474E5FF001AD0AD829A07A835D3D041941E295AFC449C393D62EE00A54801E6D9660D10E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E...,.\|Fb...:A.%...\|...\|.=a.-...\|.....^.J`.....................p.[....?U....#..\|...B:.L..p(...39..p..;."P'..C..W....vl.V....)\|~.W....!.H.Q .......^.x..E@.p...ap.6.+.!U@..;...&...I*......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.808179252569662
Encrypted:	false
SSDEEP:	6:6v/lhPKLxmlzCSTyCx4A2Qub3Ub/czi9bUSs9Zdp:6v/7idKzPRRRksbVs9Zz
MD5:	EB35DD6E5C52DA7E996241A69E77ADBE
SHA1:	CBEA4EFF00CD1925B8F4C6FA26D633A2326DE696
SHA-256:	D7943CEEECB43375EF54080E27A749C9432E8AE4F95A084AF285C54847E8F17F
SHA-512:	510C80B72EF482B97B315206CE33AEEE53A91C54CE22F676C2B10FFC5B60E140AB919A89C138804201F606502C4079FE853149C19397A684AF9823DB152FE4BD
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F5m..>.t6x.,..2A.K)m.#}.9.f......n.UKQ....\.uT...x....V...[..=vD`.pA........Ou....O...$....;... J.[r@<.Z.w.F....C ...9...x.7U...ZP....J..Y.r&.[ ..)..Fs..^.{7.F..p...i..i.TN.P....R.....2....n....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.9143970173460865
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrO/WVtmmlpQA/ktsbuNKp:6v/lhPKaYrlCAtbFp
MD5:	A820AD818995C0A84337BD2134FE0668
SHA1:	FFB5176235D1AA394E2CC0A76B827678EF5A91B8
SHA-256:	3FC627601FC190AD9A6FC43C672DAAC593AE988675070D05CDA8FA888E04FC96
SHA-512:	FF8E478604745F6A524D2716CB9FAB3EA97F2BC5ED220F8CE354A10844D653565C661A50D6D3C8ED228BB053DE5B036AE345A8AB2B25F7F26CF743B3DB8CA98A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz..../IDATx...!......7'..I@.....f.................v...Xy(&.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.951015806901361
Encrypted:	false
SSDEEP:	6:6v/lhPKkWnmvTKpznoY7q59GkYu7DO7ORgxzBug9Lpm0xgssup:6v/7iktTPYGJ4bzBn9Lpm0xxsc
MD5:	31DFFF34C3D2A722F72EAFDAAB54A2C6
SHA1:	F45580053364E5EF2A2154A5F745C06609EE5D4E
SHA-256:	0DB260D1D88A8D268F43AB35720BAC14D68C2E90418ABF6BF2427A6D3337D656
SHA-512:	08996293CA084BFAB09FACE31F6BB7A6BEC6B2B016A6D6E544FEAAC41E7C7B070C866FAA7FADB43506F75FFD24F2CBE56CAEF722E1FF619393BAE620E36B0F61
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@=m..8W...!.......4..C......!".'p....Q..Q.b..q..:..1.......48V-..p.....$P.p..x.E.E0i+...,...../.}....w...>Z......I(I.$.O$....d%<{.D....r;...T........s>......%!N._.......&......s...X.L}.,..VL.ML..p.......=.Cf.^............IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.892902584168466
Encrypted:	false
SSDEEP:	6:6v/lhPKkhrT2VwVWejqP+HR55D2ucFNrdTVwms0D7bzGgZ44Wdp:6v/7iauWWP+pD2XNrIm9Pz4
MD5:	20F2F81DF5B443C53155801005C7D008
SHA1:	24319EF93BBFE3C2D7161FE7670971D1A57191CA
SHA-256:	67E45972C0EDB00543822FD1C2E0DB03D433429DADC2A67BB63F624CC35E4E1A
SHA-512:	2DD98FF3A56E964308A1D3C1C06A9F48FF900F3DDF54D961CFAF3B28FA1AA26C836B46BC60FD490B087D528C1890EAE112285BF48FCCE134CC8B6C59A0076E8C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.F.....&=.0.q..p$'...1j....Co$....-...z.).n%P....(..<J.....V..[...vD..pF.../...%.mv.#.......&.Y.@.. .Yp.-.6^....k....<.....d<.w\|#9..g.5(\|~......z.i'.[`;.S....._....4....4.l.[~..=Ei.8b...p.\....GX.A.z.j....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.8315736667513765
Encrypted:	false
SSDEEP:	6:6v/lhPKdblm+z3oNzst3TVOc+g8hTS5touyB+Eate66p:6v/7iLtYmHOUsTYzyB+dtm
MD5:	BD98EF402FA3C8D595874E58B0B88065
SHA1:	1B8AEA2EAAB90F70269F446F108083D1FBDBA656
SHA-256:	A080AF6DB032929B25C6F4CED757C91016A7C5D2AB105B6ECEC3F43E035207AC
SHA-512:	F5C2B33296BD8C35EEEEA78BE664C2A89ABA3604C031A6C76108A4348968178FABB35B5BA56B29EE30490D09F780FB0FF547B1C57496A968D7A0D4196B8B63F0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E5m..>.t6x....@F..M...%..%..s2~.X.....M.....:>KR..k.h&<K.....^...{....@.....-...T....=.....).t..@..P#.......[.........,.D..v..}.L..@Ij>?.......y$.*0..-..B..k.....".`s..a...p.....H..{..........A.)......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.831400366366769
Encrypted:	false
SSDEEP:	6:6v/lhPKjbhr/hxrB4vd0Nv7o0WCgaVuzQ/slOp:6v/7ijNrrB4vd0Nv7BS8
MD5:	A50EB6917AA544EB278D9D05883D3C44
SHA1:	DD2181140F9837AF9519BD2622986864EA3B9201
SHA-256:	A830A06EB6040C151E011936149A9E2A02FA28E6F9D5919DA4CA01BA80C89D12
SHA-512:	5EB50C63816F44178C8AADDD5A403228209876DE86473791A084735EA9716B65F597998D452EA14EA88A312A5D2A7BA99E2F083DD593F04A2B290918748ED5D7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0..S-.Xy..w.TA#.D........~...%.Z..g^.......$K...%..+....>* .#...+"....t...!O@.......H...w...CA.......[.....6.o..,.z..>...%.~'PI..3.J0.>5.D.............,..........p..T.en.....Sg...;e9....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.8441524529503495
Encrypted:	false
SSDEEP:	6:6v/lhPKLxmY5ouTl+fkO58O9BKzAUZ71hVbp:6v/7idtfA3bKES71hj
MD5:	4E3097B0B30CE8B100C70DBADC9216B3
SHA1:	3FAD2ED1CFF4A7564A1DBC2B4A67FE67BEAB4880
SHA-256:	453E667B7099FC862BE76E87FA79DF21B5553F38489379235A9A0F2FC932A99A
SHA-512:	8664F2F90561AFEDD04E98106515B3576E72BD614FBE149D5DC0B93BEDBE8631B73819DB62C2B7289D6D88C402902AA3910A270BF01C4814784E81ECFD07903B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F5...>.t6x.,..2A.K)m.#}.9.f..........ZQ......uT...x....V...[..=vD`.pA........O.....w.&.$'...+... J.[r@<.Z.w.F`...C ...9...x.7U..zP....J..U.r&.[ ..)..Fs..^.{7.F..p...i..i.*.a..D}b..{.............IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_pink\glass_pink.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.411751853774936
Encrypted:	false
SSDEEP:	3:5gNRYKvSEB4xm9rKRrIz4sSn:AYKfCzRY4sS
MD5:	06C3803421F26A6CFF62987131807388
SHA1:	F17C358BCE5FCD280151D4F66369B4185DF9F015
SHA-256:	9D19664AAA8A3B21FA3FE6F245B76D79D99501FEABED624EB4285CA9C58B7D60
SHA-512:	5AB81BC7C60653C9BC468CBBB1BFAFFEF9DA5964B9892A7645C822244644361AE15189D221308F145F60B40B0875E5D6422639C0ED362B2D38823B7394E4F9F3
Malicious:	false
Preview:	matchBlocks=160 95..metadata=6..method=ctm..tiles=0-47

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\0.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	7.017230914099293
Encrypted:	false
SSDEEP:	6:6v/lhPKIjlpXcJ0+eptNFgpuhQTs3ozehZyhQ3jKgeQ1KNYbp:6v/7iIppMJ0TceozIX3jK69
MD5:	E6EDF9E5B65E30DBF40921F01239F71B
SHA1:	EB45E4CE9469D19FB0CB40A8D9267A7D30E9BE2B
SHA-256:	E4CE293BFD4D7B05DDADA49D053DAD791774CA65E541ED372D5A5A0BD0BC9B8C
SHA-512:	32485DD04CAA9E722E02BE676B8D56473F5A5C9C67A071E13D49F1060C68B548BC922E72A62F620DA9BCD9B434321EA9ED229EF1D6CF566A7D790629BA77441A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..[..0.E.3w...\|...."..!.......;.\|...r..t..]N.vT.TQV..m.s@.Q4y.F. .0.;<....... ..v#.-...@1.....~A.....n.$g.....C.l....+...7...PV$....d%<{.D..c..r;^..4.............D.S..+......j.......>=..s...8.L.`.\u*f..#......pP.}.40JKc;..o..li.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.90123788683396
Encrypted:	false
SSDEEP:	6:6v/lhPKUlmH8SXrWa3nRoPj4E2DQniRWJvBQZEGrtz3tVp:6v/7iOS8SXD3nRe2yiiiDrtR
MD5:	FA8D6EB08AB2F2C37EA6E5CFD30E17D6
SHA1:	A2DDAD993ABA5DA154CEE3FCED4E9A329EC5904D
SHA-256:	EB54D7D290D029AC29DE264005368D2C294C1CF94D2CE4F69825BA529D35871C
SHA-512:	1517CC6AC271C5D0BC2A0BCDBD8AFA90D62B2EEF662D6263069324D5B28D3A50544B83662B4379FF00BEA17CA9A4B31FF809C200C622BEFA26F623B8F5047EFF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y...........Y .5-m)m.%})>.r.y.X......vJ..jjy>......{Y.*x...^..{.(... ..#...3"............,.F..[.i.Pf.{.....Hf.-.@.x..D2.n..Nx...sD..s9...........9...d...8.#.....?...h!......"@`8As.ap....(..g.Z.N.`...v.6.......\|.P.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	255
Entropy (8bit):	6.795870731663485
Encrypted:	false
SSDEEP:	6:6v/lhPKxbxmIx2DMPam74MQjrmYtH0NvB8k86+wuVkYH+Wup:6v/7iT5x2gPUMOmY1M2xiVE+Wc
MD5:	FE73746465E1D3235BB388B714D98D36
SHA1:	EAC54DAF46858AE499CA2FF94DC01E093FF5E235
SHA-256:	84ECEE9355FCF84C8F327124C7BA3B4538F7FFC64D44A86D1C3A13B11C421D36
SHA-512:	D3E21996C7C7C80225116C5B805A3794657694A9759DE6918F0562B1F6C2529DEE214CF5182DEBF98C0F1CD7DD5DA84DBF2004FCB27FC5AAD6B79519BD56C688
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Y.........2Y.K(m.#}.9.f.........S..r,..Jx...oO.[...n.`........p.k....?.#O..."0./9."....t...Q.........5......Qp...6>...T...hA...(..fE..o.t...+...>...]p...........p....5.R.x....b0...N....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.874073162631204
Encrypted:	false
SSDEEP:	6:6v/lhPKwhrO+hhrCHRahPGGP93HiuzQ/9Tyfleup:6v/7iOy+hhrCHvGRuhmlec
MD5:	EFF88C9FE3F3F4BFABCF2A225FE52E04
SHA1:	75050B40C24B21C47A0C02C2731D23BDDFDCB9D2
SHA-256:	FE13C02C83FFD5E8207EB93919C096040C122A26DF0BC644769197A61B4D839B
SHA-512:	75C5E931F7FA355E6DCF26D07509333BCC206FD0B258DB1A7E11E8ED44A11454D1D0DE86CFFA41DC99C34FB757691EA49B58405E1E54E0EBF9FD4B42D0ABD3B1
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0....uC.V.H~GJ/.@e.......~...%.Z..g.2....$K...%..+....>* .#...+"....t...'....t.Kv....;... ....z...p.@..7...\=r@............\%.^..P".............,..........p..T.en.k.z.~...b0=i.:....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.865280272222454
Encrypted:	false
SSDEEP:	6:6v/lhPKzv/CrjjLCB25kngUfKcUJ1IkYTd15tjp:6v/7iTC3QvgUycQ1na1zN
MD5:	C4F33492151EB4715CD64CEF11A29362
SHA1:	4303BC7F45E58EF8CF941EC9BB77957F221F6452
SHA-256:	F90A6DE891C9318AB2B25AAC2E86DE0E40E9BEDDDE0C4886D09F814410DBCA45
SHA-512:	44D3EE362B10C5D919AD5FCC87248402F4F605FAAE9F3159EC0E4E206B341D1A039FB2A768D168E2B244E3CF843D9016BE03CEC6C6AB52A154B0D6C27032AEAC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Y..........^ .5.6..... ...=lY.....Q;Q.Q..-.; x....(...&p..p.Y...f.rn.K`u..#..?..............X.Wr.}W....d'\Z......$.$^R....*.l......#.....S.]u....A.....WS..O.$..mE........).-.>.(8.T..,N..`....s....`..'.`..[..H....{...;....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.883162793725928
Encrypted:	false
SSDEEP:	6:6v/lhPK/QvlmH8SsnC3qPQhpvARQp1qNl5IrYq19t/Ry6THvIU4Z6gYec8up:6v/7iYS8SsnC31hpvARuEIEqjSevILZM
MD5:	6E342F6C74AEBCDBC47110C6EAE36BDC
SHA1:	A1D703793EE33F37B0D4D0E22E1C681686E877C8
SHA-256:	7F2B335F3E1E4C032F28C896E0BB2A0A76A09B8DD054CFB92EEF1F117B72E44F
SHA-512:	F023A28B6FAEB51F3820C0F97234E019C57834870E2FD2A4A3868C14DE475A2027528C4542B25DC5B37BAD2BC259D891979E8344DCA1229B9319FBCC99171CA4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y...........Y..5....8..d..9..#....z....:%..4.<?...l]....%p..v.W.".^.B.;".@8#....p.\|.m..k..x$...e..'PA.).d..r...W<A$........,8G..9....H...@I.....@&..].4..-0..)@.F.....(..,....4...{^..=EY.8c...p...fN.z...r..p6z....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.817631288743961
Encrypted:	false
SSDEEP:	6:6v/lhPKalmJwnAqzzI5lvwtHFHxX8OLmF6Eumnax5I7GSHxj/xp:6v/7i0pA4z7FQYmFCmAI7Nxf
MD5:	1429772F14378F9AB35316FD7010908B
SHA1:	A1906E7AD3D4FA53E9620288A3EC2E86646536AA
SHA-256:	8FD322DECDFC53B2297F0347F5DC45B0375A6F25C779FDF759807232A2FBA8F4
SHA-512:	641368969B3A0D4125BC0A94452547CC4572CF38FB69C6E742457E19FA8F36F7693A12D9C970FD361B23FDBC7D2D335428843FE8666AA6AF76609DD38A4C2786
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y.............%.....\|.9..G,..o.}..3.L...H.#2ZWV.Y.ox.].....W@...t...@8.".-..IC.........H...W...C.(..........-...o..,.F..q....J..@%5....$...%..-.....c...G.@..." `s..48.5.V..T.e....x*/k.j\.../....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.903371137347595
Encrypted:	false
SSDEEP:	6:6v/lhPKz1m+aFk+pdNvDN0taZutP5ti9tIqwjfxmt8gH7+xup:6v/7iI+aFkmvR0oQbtItIqwj5S7h
MD5:	A24D7288D9E207159585DCAFDD7AEBE3
SHA1:	C16A6D706D2AC99676F7AC1360DB3785906DCC82
SHA-256:	B48114A6176A2D943F7D59090C3340872EF022422E957C5589054D53F784A00F
SHA-512:	237F08297DEB2B9DB82CBDD2F0D6D7C1489D0351471EA7C140B9B249077E98ADFA4FEE8148CD266C0A944CEF3CF8AE82FA1B7469B6023603524D21253BD509ED
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.@.,.d..:.k$..."y.L.K."...(\|..=...r.....$.G9...3..Ce#<M....f...........G ....IG...?.F.H.;.I...@6\|*.pi-......P.xU9.J ...hFx...cD...v....x..-.I......d.+.....s......2.".....N%......V.M.b.nb.l...0.....X$..c.r../......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.852251820704889
Encrypted:	false
SSDEEP:	6:6v/lhPKzlmH8SXrWvWRWcM/xyDS++KR1TqctDnu0m9FAfAC6a7eup:6v/7iRS8SXnRWcMgJ+K3pu0Q6AgSc
MD5:	D0C9BB7B53610F2ED5B4DC87E8569427
SHA1:	A7ADA7191808DE03636AD7D9D9ABDCE4F958820B
SHA-256:	E106697CD937D7B080F192C047829D6C6F32C593960B35B942E05EBF04C8C113
SHA-512:	3AE5468E0CEFC67393EB01B4638934E3D3AD9805359AB33A7488FDF3D8BD897DA606B08B52DECF44E8EC1ADF0A753A16144C0E54C3DA5AD3BA6671C6096BD47D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y...........] .5........t3y.X........:..%Q....,..<K`...z..E.....vD..pF.../............4.H6M..,xO..pS..,...h..x.Hf.-......Yp...rn.;.....=...>?..?.Lx.].t&.[.t.....-.>z.Qt.Y...'h.8..y.s..e....R+.Y.......A....p.s...v....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	275
Entropy (8bit):	6.832124995212417
Encrypted:	false
SSDEEP:	6:6v/lhPKlhir8SMwNvBIaPWn37HuUKkh5n783udTidgc7Lyxs6NB2up:6v/7iXiPHNPmx57RKLyxs6NB7
MD5:	383B0EE7D48BE7F37BEFE63A4C005557
SHA1:	A7618F2AF883693E2B9389E896FF6DEF5C1A7A5C
SHA-256:	172ABF415ED826FCA21261B728BC8FEC9994B1FBD3BD935FE44C401B3E84A684
SHA-512:	DFA3D11B25DF22FF2FB82048A422CF4B8E670BAB25BFC2BCC70C629EDBA7FC6CE6DC61A3AD138DA8875F7C33113332E0BC0BEA3BDB42D3B444C1343DB4428441
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y.....J.-y.lP).d.&.....9p...S ...y.q..=9&.3(J`..&p..w..... .C...3"`...TA.V.?......./9z.+......>;......M(i.,.'.......^,...l1.HY........ ;...)...&....x5.C...f..^H..D...'h/X.W.9r7...=..].. fr./m.s.r.p.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	265
Entropy (8bit):	6.922817886163859
Encrypted:	false
SSDEEP:	6:6v/lhPK/blmBD33qRr3yBtq3PkqD0p92FvXxHVJi0LTVp3dhUEXXyp:6v/7i/JI33IOB/qQ2vXxHji0/V9bJo
MD5:	8A94AA315D3D487661AE0296C6863DC3
SHA1:	8F4D459DAE0E871A2328ECB0FB49C550E1DBEFC8
SHA-256:	4011CD73473ED9E65BF31CA069B3F1C83B9FAF8E245024CF9EFFCAEAC459C349
SHA-512:	687BB8AA731E6A3E82BBA67F6B50F4D5BFA1758CDA1E0B6781E9AF838EFA25F0828579BB5C8988710AAB0D70868E19E5E2CE655E721D9C19CF11823188186142
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y...........] .5......n..a._......2.V..\...:......et.U.=.V.F...h \..w.F.i6...\A.\|D..O.!M..... ...4.%.....p.k...^=.....l..#.i&.N....ipQ2....3....._.V6.......4...../H.GL.e.4....O...1.SC.\|..Uk.i..s....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.88617867526889
Encrypted:	false
SSDEEP:	6:6v/lhPKAWhybE4gMD8ibJRROMfK3C/W84xiJRESVHkoD7ihp:6v/7iAUyhgi1RIn3C+IiP
MD5:	A28ADC39B8EFFAE0CDE00F04E9126B03
SHA1:	17D99FFB3EA37B7544E7FD3D5607E74C50CA65B6
SHA-256:	604F55B0F2DD5ADB755A7971817391040727B330698B1281CDEA978162527A5B
SHA-512:	4AB7867E419BF33F7A94894FCBF541E8230311A6B97C733C76CB0532BB92A44B73A97ED182E043464CEBEF49D2EE92A066044688835E515D15E33623197103F5
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E..t..s%...".T.....C...o./....;.....-.t.O0L.%.K`.n&..u.H.>-@.g..2.gD@......H..o..>$.._..~S....H \|t.T.V...P.xQ.O$.....Ix.........r.....(.Y.h4\|..WU...{MH...x5.$@.F.w/$..p"........O..s7d..-.c....K.k.x.:.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.96355888939414
Encrypted:	false
SSDEEP:	6:6v/lhPKelmBD33q3bMwJLeWkh63o7wl906FcjqEIBs0mCyMmO0up:6v/7ioI338bMwJK3VwFFcjUK0RTmO0c
MD5:	DDF836807787C06C87CD53C124FD9EE3
SHA1:	927182323DC29CB773F87EC375FE1C1FAB9212BC
SHA-256:	5153DCAE96630106C373E2D1D072A26097581FB08FA9748D88B4675894622417
SHA-512:	7320C8EA63A6607EBD616836BE7C643D2D6585989CAAA4AA1843EF914C79951D2517B8F1ADA4BB3E65D12B02DC08037788DCEBA63721213F8512106919CDBF93
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y.............%....$....{..7...O..]St\|....x..V....].....W........@8."0,.....A.\#0.+9.&L._.t...Q.........-......Yp...v.....~%.....bx.5!W.....ll.....pt.Y...'h.(.g.....0U@..X...].....s.."g.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\20.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.953001357429097
Encrypted:	false
SSDEEP:	6:6v/lhPKLxmIx2DzamDOGkkQtPVUiMHV5/Wf0tU4rbp:6v/7id5x2XzO6QrMHTOfS
MD5:	155C71D52C839B571009CBE8F73FDE38
SHA1:	6FD0379ED7AE7FA1A1735D14393AF73A873E1673
SHA-256:	B287D86DDF69F9BF0A0BCF901D957C383FC4AA330C32CFF4AB73300E8F9E1D85
SHA-512:	969AECB355452CA180C88F84B46091B58DDD569D25B43D50975BA26F3F6612336EB8F756390E39B443DAD28E7690896B6F1277BEE75BD0915AFDD16C2A42D3E6
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Y..........2Y.K(m.#}.9.f.......z/.k....X<.G..(........*..#....".......VG. ..D`._r E..... ...4.%.....p.k....=.....l\|.+...~'...qQ2...3.....O.V...\|....4....4...#..R..C.$j.=....\|. .b...<>....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\21.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	260
Entropy (8bit):	6.8738423230189465
Encrypted:	false
SSDEEP:	6:6v/lhPKoxmI3KEsfnbGeDY9FJeqyu1cZN9FlXigYm6ajp:6v/7im53VYbRtr881igL5N
MD5:	5AD9F30C5553E5ED57FE5AD2BC67E647
SHA1:	D3CE4C26766EC2AD5F374526A59D14DDAEA912F2
SHA-256:	2457411C66C3AEC41C5C72D6636B6567647416704787596F1B79DA5F54741F25
SHA-512:	144963C5581F12296C0713EB09206BDE580D039EB19F5A70F5FE8FE04C4853E68E2755D26686E44C3455116CE88BC21EACF50FDC4AC3FE2D46E2A1DC3C05B6E8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Y..........2Y..BiB....A7.........RT+.n.[.l.U..>.vw.U.=.V.F.... \..w.F`h6=..\A.......@.0.~%.A8.DipK..'\+....t#.{.D..#..x.{\|S%.J......dx.5!g.......l4.....w.i...'h.H.G..K.o.* QC,........Tb..I......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\22.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.916494946454603
Encrypted:	false
SSDEEP:	6:6v/lhPK8WxmI3KEsPnbGeDY9FJeqyu1cZN9241G+27tI3Q6lljp:6v/7i8053VIbRtr8V4G+ewvN
MD5:	85B1563430CD66BCD553311456C86B93
SHA1:	00ABDBF371EE46C5CF85F257AA150820F65D9059
SHA-256:	69BFAA0660ACD041094E159CB25A1E4C0EFE31E997FD56D197CD822D30F96139
SHA-512:	11F1C4661BA9944448841FD0F7D2AA50F360AFCFB3E5B18A35EA109DA5E160F85A06BD7AD62CD59CFD279C8BBA7183D2DBC758F5E5C8245929AC2BB7C757A6B9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Y..........2Y..BiB....A7....O.....RT+.n.[.l.U..>.vw.U.=.V.F.... \..w.F`h6=..\A.......@.0.~%.A8.DipK..'\+....t#.{.D..#..x.{\|S%.J....apQ2...3....._.V6..\|....4...../H.GL.r...H.'.....z...b02.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\23.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.803797345390939
Encrypted:	false
SSDEEP:	6:6v/lhPKwhrO+bhrMJiAdNv7o0WC7HrrQhgmwmW+7bp:6v/7iOy+Nr21dNv7pXV+71
MD5:	2533E825BABDE11B4961B249930A83A7
SHA1:	2A1659FAB8811248B04D551D0533CA9C4CA1D32C
SHA-256:	F16362BDFE0B2552EBCD659D2837BDA44EF10D5CD505EA28D6575F11A0B87C12
SHA-512:	857867D3AA971BBAE03579582E71A9D211A7413AFD7F0DE52A72F66B0DD9B3B17D55034C39041FCF28A7B0CD0AD9B308BF71CD5C194A2B161ACE0F091133C199
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0....uC.V.H~GJ/.p........~...%.Z..g.n5eU!..[I..+8K`.W....\|T@.kG.:.WD..n..C/.!O@.......H...w...CA.......[.....6.o..,.z..>...%.~'PI..7.J0.>5.D.....g.16......w.Y...'h/..3..9.....S...M.b0.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\24.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.911234441760509
Encrypted:	false
SSDEEP:	6:6v/lhPKiGE58SXrjnhkjxdqA4/PTj3MAq2oWcdVZDzLxrL+Vp:6v/7iiJ58SX3nONdP4/PkArM59c
MD5:	FAA36C81CC2700DF8E453AB1F82AD3D3
SHA1:	D81F279F7D8F8C74355B11247EEC607F4DFBFAB2
SHA-256:	0530D9FEBBCA7D074F82E503519AFB259791C53A6C1D7B80FF7F411ADC212C63
SHA-512:	ED67E0EF5AE1BD1027BB9DA977F17FFA6399845437AE44B251B591FF8657BD66E5480F7E6AAE8704A3E4A5BBD9B5A63A6D42D3A2F5C7FA002C17DE460ED54E37
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y............!...#.....K ....H..r/{]'UY........i.Oxb_......<vH`...D._........7...n.X.O......... ..U.Qps.z./9e]..p.@.....\#r@:..o(.Px...)\|>.\U.&<.........F.....h...H...% `8A{.(x.T.3wC....?n.&....s@^~......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	261
Entropy (8bit):	6.839273763336683
Encrypted:	false
SSDEEP:	6:6v/lhPKOG9xpUrvnK8pINIxklWjouvO+KGscC20H57/Vp:6v/7iO0xQvmqipu2LGC20H5/
MD5:	8918E9E4DB9F65D52303BD341A560D25
SHA1:	DB6AECD072BDBC520768B84B310AED0F34404DCF
SHA-256:	D9EF55E70D864FA6700460480B45E14DD448E3F5FFD072EA9CA3947582237DF1
SHA-512:	3575BA0BE1E36A79E62773D57C401DA4B0C774F250BFB187E6A44EF1D01117786B8CEC1E5DC1EE6A0E0777DC5A546828198F573AA500052680E2E00EFD8BD8A4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A..1.E.f.....MX7.!....s\h........R.o....m.sUm....U...Y..x.n.E.....;"0@8#....p.\|..@.....^..B....:.7..T.-.@;x..DR...t'.G.d.9"...W\|#9..g.-)\|..._...v...J...r.....-.~.#.....N.^.....s.n..)..v..;.0j\K.`+....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\26.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	248
Entropy (8bit):	6.867326510821531
Encrypted:	false
SSDEEP:	6:6v/lhPKM3uPjiBw62/v0qR4V/TLO5kx9Z8ykrHcAey2up:6v/7iItG6EvEgM9cfey2c
MD5:	1DFDEBA12870E5ABF437AECEA6E59F13
SHA1:	C5D733C468C89C4A85CE7B0CC52D3BF2012B6F52
SHA-256:	3A66415B0E897610273CDD604F0EB57955CE86B5BA2CD9B2DA9773E516313A83
SHA-512:	0C101643B610DB1D1F06CBB9BCD35B81871CE9425F5557D755F159184E67F3D3FDF10934729D6BF601F64D9683598963C6204256294907CC8CE35CD5B8A418C8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A..!.E............N.)e....G....0....x....d....%...v....* .#...+"....4.?."-..g...$.2.txO..p(...+9..p..;."P...C..W....v\|.;....)\|n.+...h.%.~......q.\.W ..g..0...A......mH.....O..U.ax.-.0....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\27.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	268
Entropy (8bit):	6.97860579931678
Encrypted:	false
SSDEEP:	6:6v/lhPKZQ/fShyvYOCitU1Y03+6eH2I/HQHBaDE9dgBQ/4wil4sSxTF8N5p:6v/7i2vQOCiW1Y0u6ZH6EwBA4wRLxT+N
MD5:	9F93136F9D1A0D738597DC3CF8CB03DF
SHA1:	7A2588A79132A0FC35A610A069CD60E32C72E5AC
SHA-256:	1B8B572227BF1D409C75C211F38BF703C96122ACD7A8D9097B25A0CC073E2D02
SHA-512:	BE8A199278E7370C53671D0D62913989EF550D94DA3B172F08B594FEADDC40617C870362CA7B3E21F77F4AA21FCF624183F5D973E3E3C11E9112D1295478086C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1..0.E}...@.+1[.!z.J._.!CR...0...)..@.I..y..=9&.wP....&..g....\|Z.....T...5\%P.I[Q~<..@.H........7.+P@.t.4.V..M.i.........$.X.x..b..d9.......-Av.>..)...&....x5.$@.F.../$d.p*........O.9r7....q;....T.j\.(o.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\28.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	274
Entropy (8bit):	6.82593099949154
Encrypted:	false
SSDEEP:	6:6v/lhPKWNN+3fyJ5YeEzQWqiH0dBbtAuoL9DuBX30LStOh05QEfup:6v/7i0oqJ5YbB2BbaBCBX3H6BEk
MD5:	322587322334D5CF16CF1691834A30DB
SHA1:	0482601500FE0345B7CAF25B03D88150A4E33218
SHA-256:	BA73B5226BB9BC38C61FDE5B0E001A6AD3F4CB76046498FEA891171CCF125C62
SHA-512:	85E8C5D388EC983D54AA518398DC2B2B907AD519BBAB03CEAE7A9BD02DE84B5393933BDDB96F55700DA80D48CE787B8AA6F10DE9AC6A6EB64B1B81EA4B3DFAEC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A..!.E.Yo3....Y.....z...3....M..";.=4~M.^n....z.@..V..D.(..^..........@....._...K....F.\"..+.%M8..3...UA4...[ m.j......4#.y.D..#..x...Fr....jP..<\..".u....o.....l4...GD.... 0....4..W..S.F.#fH..GM.%y<.A.j.R.f.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\29.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	265
Entropy (8bit):	6.890779301274529
Encrypted:	false
SSDEEP:	6:6v/lhPK/blmBD3pU7ATSHr3kCiVCi1BFk6vYi3431F+agDt5tmJrdlmVp:6v/7i/JI3pvSHj5iVC0Fk7io32d537
MD5:	07DC6127CB754A85A2E4BFEB1D82DD60
SHA1:	731565D68CD6ACCA1F99A335E9F85E324B534E3D
SHA-256:	3A3FE36A3BCFFFF675B9F0F9D9E6AE544351AE033C838F10E6D8303659AB654F
SHA-512:	210795A323162283DCE7156158D72DC7872E75B9E53ACDBE948096ED95A8B749FDD01F4C941689170BE65BC8CA2A4E2B75D6F24CABE7F9F07B525936145210EF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y...........Y..5.......?'...e...r...9..D..FJ=..u....x...z..F.....vD.......-...4..h....^..!.~&.@8....>P#.V.p.E.9.-B....}@...n..~&PH....dx...f.....j,.....ht.Y..lN.\..g.....PYC,s:....lj.}.z....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.978015613518536
Encrypted:	false
SSDEEP:	6:6v/lhPKkWnmrgBGA2lZqenuFwnBVZ0JCrg7p9q8enGdchCnn02RIM/Vp:6v/7ikrnHBnBz0JCk91iGbn02Is7
MD5:	3170D2C0B611A671A1F76ACF868A437D
SHA1:	8D92A232ABB239B1180D2401B07C1D669ADE0FD5
SHA-256:	A68A396E0C5C50E490D90312C24D7A2C707A538C66191798F23BC852F0F8FB0E
SHA-512:	A1A420147CAB0FBA300DC10AC385F9864316BE7D748CA6634CBA17651149429DAA09F0643DC3C697389DB97B7933C93BCEA310CBF57A125E4E643BB0862224B1
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@.Y.....J>#1D6...:Y.J=$...pp...=.c0<nO.......{P.......&p...X..:...h\v.@1.."...........o..>$P..d...@4.)....ZP....NBI.%.\|".o.H +..C .N.u....-.:`.7. .....U....^..D..q<.~.@a.y....tN8....../..W...aX...PP...`e...o..\|.r2(!....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\30.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	265
Entropy (8bit):	6.848994708405599
Encrypted:	false
SSDEEP:	6:6v/lhPK/r0QKpyvYPc6wnSDweb2MrBmMSg9aoXXQ+BXjlbp:6v/7i/wQKZZwnwweb24BdSxow+hjl1
MD5:	1565C47E6F9CB1D9DF84746E68BCA1F3
SHA1:	2A79BBDF8FD52A6F78343D68F8AB3EEAA7386969
SHA-256:	5089CB2CC57CBF2A5C4975E9AEF61F755F6886CEA60C33AFE3D19A44E2C81853
SHA-512:	8261E337C04EF361AF0192550BF86EC9F25B9EEE820B4A1F9E6412F22487C9A5F41007FB1BB00322FE000BC30D0967AE708E8C3819C87F92D0F4FCC63BD6B71D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y.....J.-y.6...:Y.C.(......8.'...r...k].j...(K@.....%.......z.@.........5....k..x%.f.%.... \|(.$.>r...W,A$Y...j.W..(8{.....o$.`xO.......K .^.c..?.L...hp.\.g?"............-.b...9s9...5.\|...j..o2.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\31.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.866042970043769
Encrypted:	false
SSDEEP:	6:6v/lhPKelmBD3lL3Vqwf3cizcKjx5UD+L+xP5HI1WV0jp:6v/7ioI3lJqwf3pzcK9LAKWVW
MD5:	CD662908C9DFDE2690C0F763ED3E9F88
SHA1:	B9D964289A134F285188D4E04CF679F27E02E5E1
SHA-256:	37914CC137FEFE4651EEE5FFFF72936B2D51E6B168BDAD48A897682786703C5F
SHA-512:	C702E5CD6D5D7B07A860F02722B93607D51A329ED4E327C15E02E14ABCCD3AE186F91630DB1F8E6A58F33311DF058946F66E554697676A660971557DFF31D0D1
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y...........Y..5..........=bYF.\|.W!/c...Y.R....f..vx.]o.`..U....t.^..w.F.k6.HC. .>"..+."....4..5.4...TO.V....hFx....W.>...8.7......sz.(.^.".L..@:.W......n.{..F......i...p......!v...N.b...j.?l.~....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\32.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.765316497213394
Encrypted:	false
SSDEEP:	6:6v/lhPKtpXoy2d+QbitM0d9z6YrShts5RVwWgXsup:6v/7i4D+tM0nLug5sWgsc
MD5:	E8EDB705FE22EC4F823684A451F315E3
SHA1:	7EE22D84B1A237D9CE0AAE181E416B742AF4A496
SHA-256:	D5A29AED0F444176FB081112E472F6619A39993F12D489FE1EC948DD5F80D3E3
SHA-512:	E82EE517FFF453341B13E8F8EB706EF14FAC4AD7CE59F0E6FA3BB9BB40209A7F134401BA853D7E9DD967BEC85309EE19517352C610AE477F7036B7226CCF8711
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.,.d..s%...%#d...j#.\|...\|.=a.-.c;......d....%..gv...>+ .#...+"....T.7U....#..\|...B:.%P@8.Da..PO.U..n.(...!...G..d;>.V.[...>?.+..so.%..-.....q.\.W ..g..0...A..........;....V.a..EP....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\33.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	251
Entropy (8bit):	6.836631774224909
Encrypted:	false
SSDEEP:	6:6v/lhPKdhyZxbRrJH3aw6M2JtgTGBir6WI03OFpb1Eap:6v/7ify/rK821ir1eT
MD5:	D746F65373EDB9036CA4D35412A8296F
SHA1:	404C46E1490E19419AE9921AB366A79AFF02994C
SHA-256:	0EE47BB939472872853820FAAA173022D66915992B229F103EFAE51FF98C346A
SHA-512:	EFB4664B321F325A35BF5CD8D943A43E211CD53A82CD1025CD549A2B8FAF7321BF846BEC3CD3317C300524C8DACB991E3717A907554937D73DFADB5D6DDD9B37
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E....9..H...:Y.K..U.....W...o.l.g.B<\..,.)8K..o.'.............;."0,....<..>#0./9.&...:...(..........-.}..=.Xp...Y\|.o\|.L..@#....*..v...?....bl4.../.....N.^..gL.9....._......a..%BQ....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\34.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.8318971925291105
Encrypted:	false
SSDEEP:	6:6v/lhPKjrNO+hDNEuMgUgBF5irSf1eZzGSPBiUAp:6v/7ijI+hDWuMg3fDSPrK
MD5:	75C311CCF749A4A11C9966D8D47D88FE
SHA1:	706062504164A24C499E10B16CEDB65DFA634BC6
SHA-256:	555A04E90E917CEB2A429F3F777856A9858F815694D80EBDDFBC487531F6AB9F
SHA-512:	41599ACD754615167E9F854915E9834BBF4E029CA8E08CDA30CB42F8AD5295E4752940F5A01DCE9E3A8C6167E10ED58D09A007FD6B0852326184A246A1E6D8D0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0....uC.V.H~GJ/.@e......Y.#..fF..V..Y..Q....V2J............z.@.....-..r.E...4x.@..dE.....( ...0xO..'.*.....Nx..`..#....G\|...;.L.......i.%..+..?..q.\.O.@..." `8A..08c.N#.!U@..;n... .b0.Q......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\35.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.931562544182689
Encrypted:	false
SSDEEP:	6:6v/lhPKLxmIx2DzamDOGkkQtPVUiMHV5/Wf0tU4+p:6v/7id5x2XzO6QrMHTOfT
MD5:	4FBE74B7BBD7BD52B43F43F4788F9EAD
SHA1:	1B0D3DEEB8A490E01F773FC8359262AE9A9069F8
SHA-256:	A67AA04708B123D089284B914DE630A80CFA5B37BD80AC5F0166FA4A86F8FCDE
SHA-512:	EEC52F11D007F44306B42C471063625C73529E27EC34BD855675740F156D2F4AE58F0BB93E560F354211B4313F4D6F1AF111F4ACFB41B68EF6EA80A852D669F6
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Y..........2Y.K(m.#}.9.f.......z/.k....X<.G..(........*..#....".......VG. ..D`._r E..... ...4.%.....p.k....=.....l\|.+...~'...qQ2...3.....O.V...\|....4....4...#..R..C.$j.=....}. .b0.n.o....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\36.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.8937705994295255
Encrypted:	false
SSDEEP:	6:6v/lhPKzhy58/uu8P/FAByj0YMd+UoAN7TopEeMvgJIhsl/Vp:6v/7iVy58/u3NABWMd5oOreMvgJye
MD5:	2FDFA005F6F110FF045BF066F914C004
SHA1:	9F934D9130B910B62C6A2E27F8087D335AE667DD
SHA-256:	7A74708C9E5D835602F23A853FF02D2C0B3853798011FCC0E38DB46680C148DB
SHA-512:	16EC371B23566D7294B699BE1624D9CC2ED7A7D844A53F1F9F0F998DF4C7AC0709FB95DAE1D46F2E04EB352EC3D6FF2559BC6DA66EC9A02C327015B911F3A44E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.Y.....J>#1..Tb.L.DJ.m).\|...D........Y../..9....J@.w.8..;.d... p.!..........b.Z.?..)...E..<.......@...^P.........RV%`.W..Ax.....E...t..7..Px3....\|_\U.Ox..a.l....:.... e.Y....2.8.......f..^.r6..){N..%.........:\|...0i....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\37.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	270
Entropy (8bit):	6.886550727033669
Encrypted:	false
SSDEEP:	6:6v/lhPK7QvBBHX9JmCoecez+lGgtFcydGX/It1lC1rqHtk0bOsXQPCuldp:6v/7iMX1LP8m1r8k0q+vqz
MD5:	047C0450944F8BF2F956B57FBC129E99
SHA1:	2420B0E0F994C83EE0FCA4656396AEEA13337568
SHA-256:	37FC608AF931246180F3A810F740FCD240D10371BDFEC38932F78EB24802426C
SHA-512:	58DA14AF3A0701652E06AFF80F7452B1B3FCDFE012E75209E08728B6DA18884605BC3DBF12645A8D9D53D1E43907DF9820CFF71AAD7B7B16DA66E983B80BA77A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..A..1.E.f........=Dn x.O....J..'.".y.I..l.....9..@....T.(..^.[@..Y.B.;".@8#....p.\|.@........B...*.7..d.-.@;xe&.$.n.....!..g....v........(A..sq......uL+......d.4...ED..g. 0...`.\|.U..!g........A.....Dsj..`.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\38.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	255
Entropy (8bit):	6.817459439960722
Encrypted:	false
SSDEEP:	6:6v/lhPKxblmvgoR68TwzV2690DsvvA6FwxTxtsNqGVsCD+pL/bp:6v/7i//8Tn69csv466xDsNxVR+l/1
MD5:	3E0B3AB7A0B34AAFDD26771F465746F8
SHA1:	3AAACC8128563FB669F45950E928084ABE011DFC
SHA-256:	1E4354D372BB7D9865B70E84DD290FFB42D97F9BDEC90EBF959396D396D4F622
SHA-512:	BC170961493B7259E3435B026F414B618C73FDBEAE127E30A94A2A0A6C48FB9927501DB7918DBE39B9443DEF541C21FE036BEECE03D2B6F1C33D40C78B4905F0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....1...Y........."..._...r...j....W..o.me.bs..............{..=vD..pE.....nizR....\|F..O.#CH._.4...Q.........-...o..,.F.8.c...~%PI.sX\%.^GC(....t.....-.>z..=p...........p[............T.7..j..^n....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\39.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.948458079393195
Encrypted:	false
SSDEEP:	6:6v/lhPKiWhir8SMwNvRpge6MfaG5Agh4kD5CXdUA9lYvPy6kW3v2Xsup:6v/7iiUiPHQe6RGVh4K5mOQln8Dc
MD5:	9332373585F45EB8DACC16C4482A6382
SHA1:	0B9199BD0123A2E1B6489597695D5C7C3737338B
SHA-256:	8A16A477137D7AAA435E563D13C5EF6A2387F657679D964966553A60E9283059
SHA-512:	897EC9FFBD44468F288F8000096577C9671EDA550E430D48E58AD8B236E0EB3A66C8A1EB0D5EDC43B1DC9CA8A388E7FEA0B0B7F68DE28632DA51B5BCED1D1A47
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y.....J.-y.lP).t.6....6..>p...S ...y_.{.L..U..x.....% ..Y.....T...7\%P.I[Q.<..B.H.......@4.+P@.t.4.f..M.i..........^<....1..X........ ..........Q..D..8.... e.y....rn8.......f.M.b^.....#..... $9^o..sjO.;L....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.9180767729648025
Encrypted:	false
SSDEEP:	6:6v/lhPK/QvlmH8SsnC3qNR3ghpvFy8Qa5IrYq19t/Ry6THvIU4Z6gYrXlbp:6v/7iYS8SsnC34RghpvFPIEqjSevILZ8
MD5:	B26226C547FDC9B5EE036E24685CD640
SHA1:	9534191958479696ED6998599249C98FD841C7E8
SHA-256:	D7B6D7996DC439E117AB336E0B3B270D6B6C8DC2F36682902730C81598B6C98C
SHA-512:	80DC057B6D2335FF7CF6D7ECC95A2EA22862DA23A87EE82696009300CC61BA7124097546409EBCBE3544731F6CAAC7EA34D248120E15A151645CE894547FD1EC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y...........Y .5....8..d..9..#....z..Gm..gm.Z..kB.Qt..K@...x..v.W.".^.B.;".@8#....p.\|.m..k..x$...e..'PA.).d..r...W<A$........,8G..9....H...@I.....@&..].4..-0..)@.F.....(..,....4...{^..=EY.8c...p...fN...#sZ........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\40.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.832233634323427
Encrypted:	false
SSDEEP:	6:6v/lhPK8WhUp83DsUA1NM30iR/HlsROtlEZJABwsqqgYeFp:6v/7i8Uw8vAg30UVYFsqqgYu
MD5:	E6F5D2C514BC2272DF6E5B31AA91BF96
SHA1:	B93F2BE9F4B188278F86CA8D61A508280F46D0B4
SHA-256:	D5CF31C25A02AAC59FD6E8BF39F677E2BCA7249C567CAACE38C493DBBA9CCD04
SHA-512:	B81685F4026E9B56BA1088EBDE1466C7A31FDFF4FABC49B3E55BF4431F64BA09133EC6FF9981DB48A1ED53A52DFE205D443F12F00503E47A11A7CA2EE299AC24
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....1.....\.V.H~GJ.t.D.T...!@...u......V..r...V.....Y%0.g.......{..=vD..pE.....n).'....\|F..O.#MH...4....4.g.h$.....4'.E....1..y...]V...i..,.....&.L..@:.S@........n8...........p[.......?...2U..o{k$........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\41.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	270
Entropy (8bit):	6.845846337998571
Encrypted:	false
SSDEEP:	6:6v/lhPK7Qvhir8SMwBjY92mDGZfYyW8QnHWfTwUKEt/g1b/jp:6v/7i4iPzm2megrNUr/gx/N
MD5:	AEFC0CDF1DCC3CE1E4709AE3B5ACEDE3
SHA1:	F65084CFC436F5BAAF449EAAEBCD85B12353C76C
SHA-256:	1965BB8C47C9FBBFE4946CBA55A0EEDE2058210479A96ED8BAC56D38A90D2605
SHA-512:	11D483AEDF3C931C6A7038B9731F154429B6EEA3EF03BCE101AFC793E67A4A67939D647EDB991B3426E329DBA0D55BED219D311D0864ACF02F2231062813007F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y.....J..<D6...:Y.C.M....9p...S ...y..WrL..(........% ........( ...k.J.(..B..o).>$P._..~S......>:......M.i........d....^p...4Y.......o. ;....U....^..B..8^... e.Y....2n8.......V..n....r.r...;r=...pj.t..e....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\42.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	263
Entropy (8bit):	6.940413451730518
Encrypted:	false
SSDEEP:	6:6v/lhPK5lmBD33q0yEIpwcm9knZrdpJB8O7tzvrygZ62M5p:6v/7iHI336Dw1knVlBd7RGg6J
MD5:	0BD5098BFE5F209BF75BDA18A532E66F
SHA1:	153821FC4635F4EE42626675FCDC2D47DCF15A91
SHA-256:	80AF23E5DBEF29F2B04F980397B6D61C016473E90A577222919070D222F6BE92
SHA-512:	C42317BCE0C515933775F4E625F9FE4F804AB87972EE6545951933AAEE40F93181729A094309F6756DDBA1686BF5E73054B51C74DB0D32985B03B6DD55124EDD
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y...........]..........n..a._...m.Xo..\..u4..%....z..{.....;".@. ..p.@.l..r.a....>.4a8.N..p(......O.V.....Fx.....G...:.....;...>?..............l4.x...w.i...'._.......i. Q..].e..SC.\|.B.k$p.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\43.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	271
Entropy (8bit):	6.843361280911176
Encrypted:	false
SSDEEP:	6:6v/lhPKAG68SMwvQRmyu7MnWkfxFxvRTS5Ebq7t/g1/4p:6v/7iAlSAyLnXv1S5VZ/gFS
MD5:	7ADA39896699E457E4A5969E74521AF3
SHA1:	9891B440D82BBEB2D25BC41A42A6E64FB61C9BA9
SHA-256:	E7FA61B9B69E655067EFE4D334DAD68AAD9511FFDAD6A3565A175B1F487EB4BA
SHA-512:	D1ADFD69FA949F38AF59E9DB5D0D7E11968D766192DA74CD263B21CC0DFE0BD744D291F43641B488A39AA7F8C518964E56E7AA3C50C31C79810DBDAA508AA90C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y.....J.-y.nP..t.&....6..Q.\"....6.vy.....39&.-(J@.w.....d... .C...3"`.W.TE.V....)...../9z.+.........M.Upq.j./+....*.2./..^p...4Y........ ;.........Q..B..8^... e.Y....2n8.......V..n....r.r.........j.Rqb.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\44.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	255
Entropy (8bit):	6.8703666627315245
Encrypted:	false
SSDEEP:	6:6v/lhPKxbxmqkr2EU/9WEFc+tWGVGZxbpTIVaylvvXm7RTp:6v/7iTVihmt5VGSVdGr
MD5:	C607289A10E1A0CD450D572BEC75F9DD
SHA1:	4A4EB0C5D6D1D35BFD0ED88B4AE29CFCBF248959
SHA-256:	0D59D7965C90FFEFEA3256774F4BEBFB08425123A821CA49206D9457AC38FF95
SHA-512:	8D81A5D6BB7725AF384F93DFCCB6E57295B32540A0320D4047588E84D00850562DCB81DA64BFF26E218A7A90A6373036EE5FF63AE616689B7D4DFB040D3DAA2E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Y..........:Y.K.i.#}.9.f......c{.......x...Q..x.....p.....L....;\#05..Y.y.0....~..a8.J`.p(......O.V.....F......G...9..M..+...>?....}U...?.....,4.....w.i...'h.H.Gt.V..C.$j......a.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\45.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.833237868760357
Encrypted:	false
SSDEEP:	6:6v/lhPKgKxb53n5pgAXgzB6EPbMq5HGexamjp:6v/7iLN3nAAXMBXF5mexamN
MD5:	F228F9389D7D98F8C0FC3D17D3CC0940
SHA1:	CAC7F69E101652687AA8F2943F7AE4D92392899E
SHA-256:	FBA86BE953A9BB48CA967162CD216AD92E46ED11D9BFBAD9EF98CF57ACEF5A6F
SHA-512:	44ABE0D670A60F7C45DFFAE7B507D38299A5941FCB0017438536611DE84B1D54CEF34F47A845B05870B8EB5887794ED1D2D0A06ED4D9E80189EB44A27438403E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E....9..H...:Y....\|...\|.=a.-..x.z.U...k/Y%0.g....n.x.g...vD..pE.....f9.GU..4..@..dC...... ...0.L..'......Ix..`..#.d....N+.W...>_.+.....J$.,..?..q.\.w.@..." `8A..08c...*...;..7 -a.?L)@....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\46.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.741984109933616
Encrypted:	false
SSDEEP:	6:6v/lhPKLxmIx2Dz1ax7MvnhOD7VroIpj7Uczi9bUSs9Hap:6v/7id5x2X4dM/MD939zsbVs9Hw
MD5:	5657EF808F50C85FB1DC4C5879669328
SHA1:	0E9F3FDE0B5BEA1D877C13E84E10900C3C6A4B31
SHA-256:	9AB88BEAEE3C48380BD560818C6D302BAAD74190379F4939A71949B374FDB337
SHA-512:	E0868DCE0C7C65AA2F1A0A3B6D3EF78B09C04FEF33C61E95B5296FC5C1D3121A1FD13EA4AF3CFBB553B67AF8BA3D8E4602043662C8D2D6D44AC66F48F764569C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Y..........2Y.K(m.#}.9.f.......zoG-E.Q..r...Q%<J..........0z.......5.C...........I.....w...CA....x...p.@7..@.\<r...q.7U...ZP....J..Y.r&.[ ..)..Fs..^.{7.F..p...i..i.TN.P....R..\|..@b...._....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\47.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.8686769452099
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrO/WVtmsc03Jfl/1p:6v/lhPKaY33Jrp
MD5:	BA712FE71DE3C0461ACA72E7BB824794
SHA1:	24531E7C3020FCC52A3BDE28638A6A8C418CB295
SHA-256:	535ADCCB0A27C470B8E8FFA6B8B75C345D1EFFBC4203F05CFA0AF9D5EAB8506C
SHA-512:	FBA3676F29F39BE26A9C0F16B0B23FC10D763E940AC8DC5EE8E44C6CF9E859A4EC1D648A9313EE54411F4BF7968CB2FF0F181D401107B616EFECCA6D76B78DD8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz..../IDATx...!......7#..HH....e..................v.....L.*......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	283
Entropy (8bit):	6.886384502538723
Encrypted:	false
SSDEEP:	6:6v/lhPKkWnmgFEPhgMnww5ShjGJm4whm6XLeJllbp:6v/7ikuU3najGJm4KmJlz
MD5:	1755D50BE250A65598A96B8CA817D42C
SHA1:	DC37E5C2DF472F79430121689BFD1E5252B17493
SHA-256:	BE6CE8C3277FB76C8A0BB18ACA5214B00BCE3D19D0FC99A8FB030395458CF22A
SHA-512:	1FAB85A4483F05CCC16557A98F383D7737A155AB63C487B6F23F2937E5C6E5B4A9FC1919450ACAAFBA66C699516876F919E6A8563763AE7229373EE5610954A7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@..t..s%...".Tb.L.R.M(...9D......q{6"6e4F..x....bLK..a.oxf.U...\-..e7.T#.-..p.@.L.......Y...KR.....C.b.skAW`.........D..p.@Q..@..=..(..[.Mu...nA.*>.+...T..D..8.....a.y....8'.H........n............#..v.....sZ........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\6.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.977643592139144
Encrypted:	false
SSDEEP:	6:6v/lhPKiWh9lJ3LuUEvkdS3H98EIvx9Ph7Yi8UzO+nchv/Gk/Xjp:6v/7iiU97absiI59PHdn8v/3l
MD5:	FFFC0BD4BE6EBB35205F05FA1C142B7B
SHA1:	6CDA5FF7B9988C9E2B39930AE6322D0DC3F06D30
SHA-256:	463A8CA3FED6B9C28D95751227F49F4EE1DBB927225192A011AAB5599C57EB64
SHA-512:	E824FA0754EDD5CE468F9B635312862E7FCE82D1C3D7FAF3CE5CB3E347318384761E31B083AC51BA50CA0AEA39EB86F97A0E80553D7905752AC19E027022E921
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....!.F..m\..l.3.C....8....Q.m...z#y/P>h......Iu/..\|...E...Q.Ox.......*@.#...3"........o.#.Yp.@..d.4......W...kn...%.F.\#...!..g.. .q......>..A...p......sL;.......l4...GD.... 0...`...+f.)J#..3.T..&.=.?.Afk.vI.=....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\7.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.94486631974969
Encrypted:	false
SSDEEP:	6:6v/lhPKdblmBD3hCQxHM72yVKjxR2fM08DYn05ZCSws2kbp:6v/7iLI3kQxHZyVKz106E03Xf
MD5:	1357CACB491EA794CF98BB7DA4F43E48
SHA1:	31EE70B7336DDB39E9206EA7C02B546F2A77DFEF
SHA-256:	828835A720C9CD6C89AE73442BD2F418CBB2FEBC75ABC4B82E1A36DF1E202ED8
SHA-512:	5DA7338925FCC3AF24D7B9491746573188601B7133F00763EDAA41837C37949A8B08BF915BF30BFC68D35E87B77190178F332DF2265DCF8F2A29B672111F985C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Y...........Y .5...........=bYF.\|.W!/c...Y.R....f...x.]o.`..U....t.^..w.F.k6....A.\|D..W.#E....h .jDipK...p..;\#...!....}....m.4.~'P.....dx...3.g.t...+........8............2.5...QC.!..N.R....k...{a....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\8.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.839700229884991
Encrypted:	false
SSDEEP:	6:6v/lhPKjbhr1RU4ruid0Nv7o0WCgaVuzQTUV8p:6v/7ijNU4rHd0Nv7BAu
MD5:	BF2BE5D91F9AFD5CFC826FF91022ED5B
SHA1:	833B1A8530BD634DDDDE6E254E0CEDC4D38774B2
SHA-256:	76DC8CD308D49740B8A1B4959C941425047564769B870FCF830887C86910D312
SHA-512:	CD765481C2603F7977248BEE1F1931E6916E81A48C0C79494494EB6124F22C2103025E597E503DECF9035196CAA9BCD3447A5BF7309399DC6F0FBE05DEFD675D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0........I~GJ/.@e.......~...%.Z..iY.......$K...%..+....>* .#...+"....t...!O@.......H...w...CA.......[.....6.o..,.z..>...%.~'PI..3.J0.>5.D.............,..........p..T.en.....Mub.`3m.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\9.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	257
Entropy (8bit):	6.8111165580255495
Encrypted:	false
SSDEEP:	6:6v/lhPKLxmqkr2DLylHHTl+fkO58O9BKzAUZ7K9Jp:6v/7idViVpA3bKES7a
MD5:	A0C9516560FDF80E6F3849DBB8E269A1
SHA1:	535EED4FFE8910318BA551BA2DB628C45B607743
SHA-256:	5EE145BFD4F6B403762B43DEC11D09633014928A99B466C0706BD509B1CDE30E
SHA-512:	0FFC9F2021A151E13BE67DF3B209328D0C362E0AC3C872DFE27BCCB53BD74B537ED509084E37BBABD010E70BCB453E95D24626421A8763411CF5671B608B0CDE
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Y.........2Y.K)m.#}.9.f......c..ZQ......uT...x....V...[..=vD`.pA........O.....w.&.$'...+... J.[r@<.Z.w.F`...C ...9...x.7U..zP....J..U.r&.[ ..)..Fs..^.{7.F..p...i..i.*.a..D}b..{...b..X.&....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_purple\glass_purple.properties

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.412555849612946
Encrypted:	false
SSDEEP:	3:5gNRYKvSEB4xMy9mRrIz4sSn:AYKfCmy0RY4sS
MD5:	C3ABD30367E67BAD11FD1099BD630081
SHA1:	F08BBBDCF42270EED715C46F74E54ED22779BCFA
SHA-256:	97316CDB884818415DA47C989DC93039CDA1BDBF52AB3E7140EE66E80F90E860
SHA-512:	E2CCE81A89C747D5C3643FF89FFFD920BC481CD026974E2D81C429A105F849F773F2DB0C50DDDDDE272EB017A9E5B1AFB1482E76E61EEEEC7D77D0422CCE1996
Malicious:	false
Preview:	matchBlocks=160 95..metadata=10..method=ctm..tiles=0-47

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\0.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	7.042060692904094
Encrypted:	false
SSDEEP:	6:6v/lhPKIjlTPnCgg3fCoZJCPtv8VmNWKuNyBFfrIB6pzSlxzeoJ8Jl/Vp:6v/7iIpjCgqqoueuW7NyPI8sxfO9
MD5:	2AA16F73E11DB48FDF3F1CFA32BA96FF
SHA1:	DD91068BBCF1FFCD3A198C290C309C1AC00FFE73
SHA-256:	E58A59BE5CB3EEEED84C921B64D1F9B3DC2C03A4FF88846FFF0E8C91EB29DC95
SHA-512:	603157CB6A108A9DF47E705CFED1C45E3CD38C1CF1146605F1DA81A3ADB1CF0B51CEC8B0E67F102E92AEF579ACB31FCBFCB12AA22182095145CCD5062692D4E0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Sv.....l.g...<Y......?..!$...(......*Pm{^\....35J.......\|V-@.p.....$p..l..........?.."......'9{.(....d#...].Up..%....".o.H +..C ...s......9`... .....WW ..zMX.e.....V.?.H.h.....N$@..d....S1;.....D8X....C..QZ..x~.$i.N......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.961734158826685
Encrypted:	false
SSDEEP:	6:6v/lhPKBhcbJ2VWMcNCiotg70GGwVmfbaux8awDfxqkKy7+UJ0zWw0Vpp:6v/7ibMJ20ozpbaB1wJo+UJ0zWPR
MD5:	863DE41DF96851A2333EBDCD0298B9AD
SHA1:	6A429610FE94CCE638F9940FA9B832D2C0D50BF7
SHA-256:	A9E5CDE2303976E6916640C762623E2258A7663E1501D73FE5920BBEF7FFDB3D
SHA-512:	CA6CEA8F43B3B1A41C1E756E9C77258362AE52046D8FDD0EAFD7DD2AA77845F7371D38E31268A4DFB6A60DECE437DDC469221816484D560FEBBE1D270146C2A9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Swb.+...)g...t2.........,.P.=5.O.\.u?j.8k...\|.$..Eg.e...Y.wx......W....4..@8.% \#_{K .....n.iB....T.n.".....m..O..,.E.:.5B ...9@..x.7..0.'P......'../g.1...........B.g7".n8..........[1GOQ...!...4.>.v.(m..U..-f...M.T....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\10.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.850194388114453
Encrypted:	false
SSDEEP:	6:6v/lhPKjbnj0NPYGf6e6VU4b5BIGasuQplrZQKPp:6v/7ijMNPYGiJosRlQy
MD5:	B49E938101F13E140E63F35E4358896C
SHA1:	A18588E6BD736F6C92960814FA199B48C7ADEC40
SHA-256:	DAAE0D1E27814E23D55D469C45E676ADC0B8EFCDD0BC7BF269B6F307990D9B2F
SHA-512:	686114FA54D8ACD20F100300D7563887BB8594DD1476CC653D7FC5B57868BE656BD4D22DAD695A9490074FA770E3A3D9296A311A29CE274E494A987E37680C5B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0....=...\|...Ce.^....~..r.2..y..,k..(.p....Jx..........*..#....".......VG. ..F`._r E..... ...4.%.....p.k....=.....l\|.#....$....(..fE..@:.,..Bs..~.{..F..p..4xD7\+.a..D..T=..`u..."......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\11.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	250
Entropy (8bit):	6.776771419715082
Encrypted:	false
SSDEEP:	6:6v/lhPKuhbGJq1Q09nSCvgyLXW5gYtkIAax91uzQaL9twnTp:6v/7i873zLG5ttkOL9
MD5:	F1F3D9010DBA4CE3C86C000BE44D64F5
SHA1:	F427D28AA82B3D2FE4A5D08DB2F6DD3039EA910E
SHA-256:	58572F01BD9C2BB9BA1D2453D13FB224AF28E112D28A7F36C8C1151F09CC5CA5
SHA-512:	D0A1F2D0166FCE002ABE8AD5810BA9475FEA6B007B26462515CF80BEB27BE0657A36AFD40B831DC783FB7501C0E74FD9111253FD3D90506851F3E4980D46BD8E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0...SzJ.....w.Ie..DQ.../.......Q.eY3....OI..+8K....'........t....;.".-....<...F.._.#MH.......(.>........-.m..<.Xp....\|.3.K&\|$PI..3.J0.>5.D..............,..........p..T.en.{.z.....'_.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\12.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	289
Entropy (8bit):	6.971251842015177
Encrypted:	false
SSDEEP:	6:6v/lhPKX8lTPnCgutk/iXEfdp/Y5l2ahuNjVETxv82VaAdWiFAbL1oV3LlvohhTp:6v/7iXwjCgutR0frYv2ahUjVETxv82V6
MD5:	A2C29C8E4AAA8FA92FA7B24630634AC5
SHA1:	5B42B284E9663D0BDEF7177312B44EDA1C936EBD
SHA-256:	D27619D2E634119F2D90C77A9DE5D7D34B1277B936BB2E0DBB99510B81A7733A
SHA-512:	50BDF910E8CE2102BA09B84CA86D2AA66BDC7452F4359B8A2513097AA86C0E45C4E3C13A77FBD4DAE927DDE205639705D5222ABB2BCDF2200F08A1B6CE245E63
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.F.Sv.....l.9g...2YSH.i][.........i...8.v.....X... .....(...&..'.Z........v...G ...(N.D>.y_$.(.H`s^...].4.+..pi-h....P.xI).........#.Pp...d<.w.v../.{..T\|..\M.$<..........f.o..L....#...S...8..YpSW..C.J..#.X.A.lEN.".'.....V.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\13.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	281
Entropy (8bit):	6.860171971911944
Encrypted:	false
SSDEEP:	6:6v/lhPKzlmH2vdYbHR1TqctDnucJ+qF8lJ8up:6v/7iRSAd2H3puzW8lSc
MD5:	5AE6DD546EE0EA06132A22F57761E631
SHA1:	57ED09CD0A61A618F7F412561D695B5A90124173
SHA-256:	3497C9EB08E697AE38455825266432BE40523861D9DBC980DFCC2015841BFDA6
SHA-512:	D38A8E4707BBA95A02D4CB5A90A581040DA994E2960F4D62EE24762E744288F4347ED12C3EBE8988E13A0D149D7748FEEBB2AB288E942599DE87A04AA2E26CAD
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Sv.....l.g..:YSHKi.-.K.A...=b..Zn.z?j.8k..r~l..G.h]....%....z..E.....vD..pF.../............4.H6M..,xO..pS..,...h..x.Hf.-......Yp...rn.;.....=...>?..?.Lx.].t%.[.r.....-.>z.Qt.Y...'h....y.s..e....R+.I..9.....C..a.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\14.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	261
Entropy (8bit):	6.922299635263891
Encrypted:	false
SSDEEP:	6:6v/lhPKOWjxZsUbiD8JbKK8cToV8NtPo+d6mnk16y9uv8slbp:6v/7iOKsW/tTo2NtPDEmsJNsz
MD5:	7C8954C2425EB2108289A24645C4A367
SHA1:	F9DBEEF0D33DC35A372B57C3EC789ADDC0F3E1E9
SHA-256:	83E6582E313147DD6967D30C0BE2BF97257942116E14CB6C3BB71D153F85004B
SHA-512:	81C22C308F60D07ED6D52A368F148B53BCCDB882A22287BF3778EAB91A8731275AAF383F5878DD81071E662E1E169044ABA9A3315E80511943C91FAEDB0E4CE3
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..1.. .E.S..X\.3.s.!.k.TQ[...o....1ryl.1..c&.......++.,.7....H..+ .oG.:.WD .n..M..!G@...t.Jv....;...F.......[.........\#..8....J..@%5....$...%..-.......B.[ ..g...9AsA.....+_C....X.t<...J.>.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\15.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	279
Entropy (8bit):	6.82462781031781
Encrypted:	false
SSDEEP:	6:6v/lhPKJbMfkmoDp6+IPBAnyznOdlJE/E7XNsy5+5wIerp:6v/7iWMZDp6+IJ2yLyoM7Xqy5+5w9F
MD5:	0A6B7C2C39FC3B179CDC4C922B1ECAA2
SHA1:	8D3E20AE3B0B928A24111D12E6609BCB09D8D49C
SHA-256:	941FAE9AAA6A977BE88AE86DF32A39C18C653895DC33DCAE8687C5C7AF7FB2D6
SHA-512:	67911E5643B1B0F933045878E0654E50783A5594A82DD36B657DE3ACE386840C1B75F2B18301ECC9959913F1D023E8B776D2753B28401AEA16699BD4F0648331
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .@..;e.....:.g...,N.".A.(..y.@.....8.A.x..qK....1T6...^..k....Y......N8z......t.....l.......d.........8.5.W......f....,8F..0n.\|...>..T\|....@&.rI...?..j...(.-..^H 8.T..,N..`..t+..&..F.J..zH..E.O..."20 ....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\16.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.901191085035673
Encrypted:	false
SSDEEP:	6:6v/lhPKdQvhil2kNur5wVHwEYDc3uvWAMhezrChI5mGzlI/Inp:6v/7iK5ilZNY+VrYo3ueCrCh3GzwC
MD5:	D36B822C3856C0D4A1E3E56A87991FB4
SHA1:	4E7BC41810DBB2FA20619D9C43F9134227989B06
SHA-256:	980CE900BAD102016B014F99589A20AB8080D1DB7683055943561CEACBE30C0A
SHA-512:	E8108AB2EC9D1FC679CD394C4131CE2DD632F1CEA2D920FC0C623F8C37123A74E02BF1024C41FF67DCB0809FD44FEB274F9D298C2B6D50783E0ADD1CCDA3993D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E.Sv....p..s....2Y.)...........o......mRmK...E.uY.x.../..^...{....@....._...5..2...h..l.&.Y.@.. .Yp.).6^....[...^#........w\|#9..{.%)\|~......2...J.....O.26Z.\|.".....N.\p.....)."..3.V..&.C`;%.%.R}......Fz....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\17.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	274
Entropy (8bit):	6.8482599541948534
Encrypted:	false
SSDEEP:	6:6v/lhPKWUAuM1n37AVHk05gIZUiignAdJ8sCH929Ur8hugY1lUbp:6v/7iU13EMI2iUQjHs91IU1
MD5:	11A43F2A6CEBC6B9F2143AA9B69987AE
SHA1:	1F91830F4FD2B6C6E1E3157D48BF5F08B0304F6B
SHA-256:	0EF9EFAD8B13A8D312055E408420340E7CEE61A3E79E7BE3F1E0410EBA35BD71
SHA-512:	6D0A9A6DCB483D700A19FF4337B80364EB0A19B8C1AB188D4E41A1709AF623C33F9C60106DB705D64D7332EC34BB60A3916E767CA767DC6F13A1829AA209327A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.....0.E..w..........x.8..$... .....`$.s..+.Aq$..\|.E.H.n.ox..........@...X.U.U......=..E...%G.w...].....)...nBM.ee>..5\%P&..B....s.&.q.oh...n.....>.....<jBZ..9.W.?.H.h.....N%@.p...U.[1G......v\|L.>.I....v...pq.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\18.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	263
Entropy (8bit):	6.86556995562878
Encrypted:	false
SSDEEP:	6:6v/lhPK5AW8KHT8lSIZEkDp5I5amCosMbVJEAnQFIFYVp:6v/7iWyTOSIFDp5IbbEAn5u7
MD5:	C2D1E9FFF62B40F1230DCB67F52305B3
SHA1:	DE93AF9010B6E4F4C05E7CA7320A8DA64485EFAB
SHA-256:	EB5D95876FFDA199D36B9619ACE9B5575810862E32BA262F2C482DB91426C4DF
SHA-512:	2E4EDA976BEC96B1400638A63A6A869923C9B6A6469F7367D8E612E7D33CC4C703972171DD7263E19CEA9ACA9FFD24878B768875EB87DF905A0F501F21EAC2A3
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E.Sv.....F.N}3....&:]N...p.xO`..m...N...7.....f..Nx.]o.`..U..cG....D....h.M.TE. .>"..'.&..?.T...Q.........5......Qp...6^...4..$P...6.(.^zM.._.t...+....{...p.........#..:s...H.'..x....}>y.b...l....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\mcpatcher\ctm\glass_stained\glass_red\19.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	269
Entropy (8bit):	6.8325534974818956
Encrypted:	false
SSDEEP:	6:6v/lhPKHUu40IAqYnZ+81w89WYhCVNXHMeIgKc9p:6v/7ibtnQ8h9WYhIN3ygBT
MD5:	1FC98417E10BD3B68C661F38AA05F2B4
SHA1:	063CCEB851174FA974786094E4AE9DA732BC9560
SHA-256:	F81416B63C1034AFB9A159749172960733F6F7EDF471EF903525C18EE3B4598D
SHA-512:	1413344E45E6F32C87AFB43E75236E62D1746AEE2681D657920356A55E90B9BD5283B01A77AD9D93FC8043109FC9BD784415273DB2165BECDB1C9C12F767156D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx..... .E......TsG..3x.L.R.H...%T....Y.@..Y...W0L.5.K`.n&..'....\|Y.........6\$P.I[.o....>%P._r.~W..... \|v.4.v...P.xI.O$.....Ex.........r\|.74.Px...h...\M.Kx.5!m....._.$l4...BB..'. p8A{.....=wC.\N.r;v]._.V..."[.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_fern_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	378
Entropy (8bit):	7.03528681960143
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6TPuIhnouNDD7iouYt20VvT1rFHvSozkNDrPAW3kZcLVgtEeK88ln:6v/78/W/6TNpo+D7iouMVF5hUDrB3kZO
MD5:	38D1C89E86F587F5AC5BA53DF9009055
SHA1:	4B0AF255A8992ADA72783C3F5F768B405E06687B
SHA-256:	75E4578CD0858CDBDFF05C3042703C4475275F8475E4BA06FDD1F9EE0B6D7BE4
SHA-512:	EC83C475EDDD474475E7EFB1EAF577960956C711E5E216B06164DEB562FA084ACE23365EBCE0D5A5BF1381CA907794C8A8A3F2C7259B450A6E9BFE71B726B946
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8O.1..@.EG.;$`c%).4...F.B..b..x....;$...&.....7..D"z..3......D.(c.\<f.....B.E..[m..$..n....s..Kw%..0...w...>V.lDr..X..r....Y..S..A8.......?T2&..e@..j@e..!&..=.T'G..i.!o..k...,...#...}... .H...Fx_o.E...\.i..t...oj..n...x.$..L..l..1.#.... ......N.....b@..."O...x......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_grass_bottom.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.509255925932709
Encrypted:	false
SSDEEP:	12:6v/78f0/6TNzHAFtLrbwUt0I78l0itnk8suiZJ9vXoSewrNlrZ6OMwOLkkHOWZTU:Z0/6ZcLrcUiI70/tk8Lij9vXFtNRcVtU
MD5:	A81C9A883A49679138BC13D197F19481
SHA1:	D36FB0FA0DBB28CC8CAD1595CD22A66ABE5E4814
SHA-256:	C30A31906625A48F8B20F0A36C558167069FC0AB34E29E0F53C481C2CEBF7159
SHA-512:	77869DD0FCE9015118C085CB907D9D8B2B8FE8C8AA7561347774BEC724D9E642F6B6FAC204F69CD0FD796A18FD001A00104A5DDEBED05A801A9BA174DCAE37C0
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........bKGD.=.a..U..E....pHYs.................tIME........s....KIDAT8.e..KTQ..?w.:...K..i...iUPA."..hS....i.]..\.C`C....i.jhJ...X.....z.7..7.Gy[..gs9.\.....{.@.Z5[[[..9+.#C...c..:.....W.n..5J)...l....r.a.".d\|.2+.c.4....#.c\...u]..tG..T...WoN0.O...Zk...c<.CJI.X$I...R...iJ.$.^......}...5.N.N.X..I...l2.a.=.6.n.s}`...r.D..h.E.X./!....A..Bk-.[..{}.Z-.{.....`....&RJ.#Cd.....>S1;;;..5.]...(.LOO.53.P....8.....)%..sv............U.a..n....N..}....a..$.A....<.F)e."......I;..x.....5...l....c...p..J)._.gM..b.&{....,@..@k-..(....I..{^8.....<.xj.(bvvVtK..,--.(...j.d.{}........ I....}... ..1.e...G..,......\|.......J)..t...:...v[T.......i7.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_grass_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	717
Entropy (8bit):	7.4705661744575425
Encrypted:	false
SSDEEP:	12:6v/78f0/6TNqWudNsAvuNpj9rMwoDVw/g47V81qJWlP6uO7meuXaLmZks9:Z0/6ZocN/rM7D0g4x2qQliu3eOaib
MD5:	9502D8033D794C30685F3FFDB7CB314F
SHA1:	392F4ECF58438D84549FA120E3E29CE27C6AA544
SHA-256:	3CACF7EAB99272CA578422450C55BF076C534AC5F75442547FBFE8F07A7A1E26
SHA-512:	BBA3B7FFC1DBEE2D48D8C1C133D208E6438F818CD573E95D6F953A8043FE3020778211748860852E7AEE9D6AAD0A5836554D56AC1AE4AE4BDE14C1935BEDD689
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........bKGD.=.a..U..E....pHYs.................tIME.........@....MIDAT8.}.Oh.A...[.l%&..A...)A..P.=.M.!.S.PD.". ^..-x.Z..../..B.El).F.T.5'!4l..l.\V.:]...v.....o..}o...T9.........N...i..,.?sy....S.C.W^..Uo.r..a5;$2q......b..P..0..&...,.N+.'.V.).j..8Y ?>.... .....:B....xt...PU........L....4M..6..~r.....nW...<..m.i......x<..X,..........4.F......8N...@.P.u]../....8....]PJ'...->..s..._gg..T.%`.y..HD&2q.f....J..#.}B.....}&?9..f.!...J...i...Ld.=..QL.T...B.@H_...@,.....?^.n.=..../.a.B....O..,v.n...B...@....*777....l\|[A...M?L.Tl...2paoo.!...........}.B..Uo..p../.i..8..HD..A2...&.L...P....0.X.d2)....J...~.........N./...."X...k...m.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_paeonia_bottom.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	518
Entropy (8bit):	7.2927744557939205
Encrypted:	false
SSDEEP:	12:6v/78/W/6TZkdV4YxhJDE0nkACW7idrccSE6h++z:U/6dgNxXnkAkdJAJz
MD5:	AA7286BBDFCF0C8C4A4A079D003F2F00
SHA1:	0333813322A0B130F6E07D156775777119F94B22
SHA-256:	F1ED627AE70731E7160D835A267653CA7F213E9567B36502247DC7D8435ACCEC
SHA-512:	12E63577BDA5B5E84FD23F6B22052F5DFE33B084F1EAB18EE764EA2B85C2BA9A3D9E1ABC4F021D190ADC8EE55E36335758C7EF1CE4075143B24A4419CD518FEE
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8OuS=K.Q..K.b0.F,$.....I..kIkc..V"..........@.......b.....xFb.......w........s(..f.$Q.^Q*.zsHy.~V........Q.k.........\|...@U..^.T.3.+...^....pu.\..........A01.$.g.S.-..\3..Vl...!....".q..,.X...4...D.e..N....3.<.#q...q.!....8../R.i.0..`M-hR.;Dd.......2^..0a..w.w..........\..qu...z& .<..0..Z.G....>.=.\.-.q.....km...+7e.H..:..g........ ....m..oO....k....&C.U...?a."..p.!..a.H......DD......).....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_paeonia_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.281863644141965
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6T1qyhaHv0Y+XjEwxPY41yAEJlm8PnFpWIxJm/T09HMgTXcy5hDCS:6v/78/W/6T1/k1+s48fFp9N9Hb31Fn
MD5:	CBB8FE44EA2A3369F657AE3CF9D9F62B
SHA1:	FD28A5360BF03BDD18A6DA9CF71BFE01D7179DCD
SHA-256:	E42F6ECD7F997AD1CDD6C7195069DE8DAA550113E88D2C8714E7AF3657E4B95A
SHA-512:	84E1C80A30439275CFCF4A33C4FEA9BCE0F206A231CA185081E3CD75E28B2EC1BF422537D3C5D0A43ED37223622A5C41C4938AF9C6F3A415883C70CB81794BF8
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs................UIDAT8O.R=K.A.}....B....F.P.1............B[.;..... Q...`...p..&7.....\|....}3.......f.....^:.K.^/...+3U......jJ....{#I....-kz..&Wj...6......H`.e.%\|\...,........h....I....o...;.?e.>^...&/..'<x..1.oT.7.k.,.....^...uO.@@P3-...>.....rL...$.....A"..wc.Z...x.x,4u...ZID...P..(q'..M.~.n..%I.p...{+>...B.....S..jW..+~...+...Ft&....7..i.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_rose_bottom.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	628
Entropy (8bit):	7.508560910353657
Encrypted:	false
SSDEEP:	12:6v/78/W/6T9FReuwwSS7kMnCJSJlrI8Va0oXJnzTHPpl/Xzh2A/UcN:U/6DRhw5S7p5bI8ViXdfvp5V2AMO
MD5:	354340E27188D3D79B20C3F4C9FC03D8
SHA1:	EBB7F4DDB91045D7F2C95DB1F77A7989692AA0CB
SHA-256:	2C5051D3AF22E3DA97D9123CAC4732F2F225644BC82ACA8DBE2C08BE5D13C328
SHA-512:	2DE7ABBC2FD80BF6287C4269070EA5B7F79ADDBE51FCAE75B7468E1CD163BB234424DBBE726FFDEE6273F45FD4F8B9506035B69FA1A1FB20B905FE9158DFAFAE
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oe.Ah.Q..gwMZ.&.....b...^.... .[..=7.........Bo..=.BA.z."bcI.6.Q...h..d.~..u...7........q7..CW...L....~.o.0.......@../.\|.4J-..r..\|...>(... '.#.C...2.J{O.7....V..\.9..C^}T.L....E.,.lF.'.*4_...@..5...6...kP.U....y........p.0'..;m..j..+...\N.n.-C.6dJ....u.0...OM.]..w.......\jc......O,...P. ...=.g...g.};..A..m....M.........;5..N.....VZ..}.:.._qG..mi.......&...Ii.=yV.$.eO.9'....f0..C....pg.u.<............x.?5K=...a. !jb..K.N.Q..+o.....#R.O.N.u...Me....5"..".H.F....nz...>.....2 O.....c..E.Wq....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_rose_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.229524410115517
Encrypted:	false
SSDEEP:	12:6v/78/W/6TCyKsXhx5gJxBFuxheu/9ra0djDc:U/6myKsXVmO7eSVa01g
MD5:	6AB4648CA146FB03B6BC94CD59B377FE
SHA1:	0BA12A1F04BDBF60ADF3939174BD99CD158C6803
SHA-256:	96C40AACADCA8B32B9C89C6842ADF73699F76A974A5A073028644290078A6DA7
SHA-512:	C00C7F6AA66339AED92A029A276D70FB274FB9E073DE4D48E11C19AAE691354FF85251C41D6301D63EFE46A2C25654AF4F180E2A33E709FFD4E724F5B845A4C8
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs................PIDAT8O..KJ.@..+....ct.&...D........gp.........t+x..uD'GP\|.2....6....B'.U.}]..W]..)..,.Y..p... y....J.J...&..j...31.<.jG..S_c.k.t;.y..8.X>.)....l......Y..Hj.". [.0.*Eg.....y$:..L9gH,..}.L....H7)...k..&.g.n.T........;.....K......v..((..q<..Q...g^$.Tj.5.7a.{\.8C+.\|.....R...._4...?.r..%X......P...u........O...5a.....b../.-.L.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_sunflower_back.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	253
Entropy (8bit):	6.429058308855928
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6TNMS0wtZuHykI8NpcVkR3mRnk7p:6v/78/W/6TNMsatI8NpcOR3mda
MD5:	FC0E75DEEAA7F5AC6B3D1039030FF13B
SHA1:	9CA01444D497FC801DF4D9B4D0DE897177FCFC88
SHA-256:	E25C1EB586AA7CE82EA8A50F6DFCD93C6C70E7FE484C633E4932C1B17E8D1C10
SHA-512:	EAA1C3727F608F27DB1059A907D22E9D23998A125B28D08FB11D498C9E8641FA33896BE18BF24620B817920192E53F8E3496FBD977C59B4614811D5B04E51F6B
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oc....P...%...2.....X.2Ai....Q.>..9'...3...n .`...l,...,...[....e.V.X.i.5........l`C........L.4...V.......o0....! 1l.k."....4.?W....G.(``..u.9%..6....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_sunflower_bottom.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.53858220861758
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6TgStpQewmxH12HP8kBd4O7HuHj/o+xzuFD8uGEk1eq0+o3p:6v/78/W/6TgStTwm112HEGh7HuHsOCxZ
MD5:	277C0D4C7DF98868581CCF9D1C670AAF
SHA1:	41D722E138CD4C815B6A54CC0FC413DC27D49F2A
SHA-256:	CB7C4BF0033752D1C9F9BF7C09E6D56E04E4775C9AE9DAFC881407A6342A1CE3
SHA-512:	76BD41AE209EA0AA1EECAD43C22E37E78BEBA2BD287C93F21ABA673FB929E4B9A151D853008A05574A29CEEA5C4A5A0E2A1E40E641A3B0752F57A87BD72A2088
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Ocd..BW........._...o`U...1.W....,`....8-b....f#.v\|......"..r....l..5,..\...A.x..9...".G...g.....^..eX...4.l....P)8.i...(...M#..4... C...N... ...`.....@!....4ca..(v.a.H.(.@!OH3.`...0.! .2P-Y..7p... ..WL.....y..h...f......x`.^.ad....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_sunflower_front.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	289
Entropy (8bit):	6.420211863953934
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6TCUbxo4jru91yhfsKCRaMmIQzlDjp:6v/78/W/6TlfjrG1yhVCRpmIc
MD5:	667429751510DC32A0740010BC211B0D
SHA1:	6E29D259BFB04967736B4794232753D3E9F373CE
SHA-256:	976F2B40B336F5386E16EC06FF4370876D26276D973A83F997F5C3EA6ABB8BF4
SHA-512:	CE8C1A671A27D1AE0E8C13410112690061594DAAF21AEFD63931E22BC713E2CE1C092F19C660AC6A0B5391921A86D86639065DF0C8BD39DB06B10C6AA0E9899B
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oc....P..\|....H...v.....M.j..4.....?................SA6.4\|......`1.Y&.! 1t.`...lF11..G.x....f..`^B...t6..z..ALX.......@... g..33.)\|..A.&....,(.@6...l3..q..X...X`......0...._.I.Zj70....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_sunflower_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	250
Entropy (8bit):	6.225556370090335
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6TNChEL372a+UL2x7mudP1P3olsG37gep:6v/78/W/6Tfr7gUpuNP3asmV
MD5:	60AB668463E51F479D865F652B5F8E6D
SHA1:	43296033DE903A26007257B1E4F36C3C4F0364AF
SHA-256:	6E52CA512746FD25E1DDCBB9ECBEAD9BE73647657AFA752CC82C6C23776DD62E
SHA-512:	6010731A7E08A7C049D4A99347F3ECEB522087EB6483B75D415ABD5FD6706DF5B50CD79B52E0308A0B4BFE6207DB0962227A6681C4265D59A119B3BA2CBD4290
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oc.....%...a(.+`..X.G..P.n...ca....5....l.>.......x....0.._.?...?..b8...../[.0.......s./..F.f..pi.......`....\...A...@6.B.........u.$$...\|.2.^.G.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_syringa_bottom.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	454
Entropy (8bit):	6.959715324247184
Encrypted:	false
SSDEEP:	12:6v/78/W/6T1HCBR4vViJFKE1wlmfLIWH4NwL/Rrw6iLThx:U/6sR4af1wFWH4CLpElFx
MD5:	CAB15F1FF0172352363D3ED2D604E519
SHA1:	64EA47A5316D987266021013CC8054793A8E4D65
SHA-256:	25C307F16B6241257991F68055DAF9E6ABD05CE7A7C18B00F6418F765003AFEB
SHA-512:	AE57CE7BA83B6EE346A2736BB38582AEBF1F4E203D3839925FEF43E05457817EAA356FC82EA960A64FD35E0F30E95AE36BFC781B82A0CBF4EB4943512D369047
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs................[IDAT8Ocd@..7...Udx..>..T?F.....rZ........A@.A.,...!..?../......5.~\|..f.K....-,....(.....J.T......>..`,..p..........'b....7\..o...^...A\|..`.4..4..A^......T..`....4....@..\..Ab...... .......b.d.(...}.;.@.,_..m..eX..A... .a...9......f.n6x:...`.A..r".6....`...K....d..A....(.A......v...\|X...... .....a... .@^..T.....=J,...T.........f(.+........]..c.<....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\double_plant_syringa_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	378
Entropy (8bit):	6.921246556135673
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6TLmZIxvsg1Ya02HVkOGxwAl5CSj9Sz/wd10s1SbZ6JEfc8v/ul50:6v/78/W/6TLmZmBea01Rx4jossbE4lxc
MD5:	C03FDFE9D15489DB5D5217D7A0C4A951
SHA1:	F08466CE9D5D7A2F1649317521FF30DF899ED849
SHA-256:	D522A7915BD2FC377C6CB4E5F2233B1C02EED93469F164C1E966E4B6E3B6C056
SHA-512:	31932626A071A8FF70F5B0605F1951A3F145F3A2E80951C0113035238118753AEFB82F24917A21E093462B561825FDD52A5DF436E05F296E3CC72E111D67E9C4
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oc.<.r....&....b..7....r...J3<~}....G`EP!..2\VT..........-,.f.K..b..P.. . uPa0....J.../..e.....@.H..f. h.....`W.\...7l...&.....q:...f....C/..\...=8.u.t.zaQ..E0o.\.R.+....$.c....F..=f..."...b...a..Cv)J4&.Odl.:.a.^'...t.s..*....COL8....].. ;..`.....@^..&......x.3rA.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\dragon_egg.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	192
Entropy (8bit):	6.574572733686938
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lZkxbhsursgMpSrft8XDTwNOTgq/JvvlQPXqdXlZr4rdx1p:6v/lhPppu4BSrftx1qtyvoHCp
MD5:	6064BCB1F588737AC4B9ACAC854EBD74
SHA1:	D178808CDFF9E9B33506D8211BC6B576A387A888
SHA-256:	EF79961BABA088EAD8624E00A647A959A8B8C32D18CD8232163FBCD396495F13
SHA-512:	297F0AF3B3A47DE2D53AEF1E93FCD47460A2FB6B927CC266001641CA14F767D397E8617F0C3552B1B325091C849B3223D43E7040819BEEBF3FCA1708F226D033
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.S1..0..[..~.......w....J..R.q.N.9.{...]2T.\.... ."H.y)....H.....).T...\|S..@.....,Q.50.+..:p.T.......'U.j.J......0."0.F.9.<..$...y.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\dropper_front_horizontal.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	313
Entropy (8bit):	6.9747533440558245
Encrypted:	false
SSDEEP:	6:6v/lhPWdsrUojl29TCMRxNIVO2WZZtSH2AcWpHyzShH9LuMqcwMA5Si16qeWA2Aw:6v/7ysrxjl29TXRxm82WZTM2AcWpHy+C
MD5:	4C2F19B63A133351512C396C26F07739
SHA1:	6B47D9FF0B446B67EDAD0B8340731E187D58119C
SHA-256:	56FEAF5B2023D7D82AE3CACA2927FD816611E262A145F79D82C1E005C562564C
SHA-512:	C4BA02A40D36BB204036B4BE9BC84F05A00200F71FA1589A17BE2D7AA526D1714EC03A14D3C70490B4EEF29DEBB0A86EE19925AE38AC62A4886E3856627DEDD4
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.....@.E........l@I...@O...E.Nz...)>....l'W....x...,..\|.....0...8.;.s......eY.. .!.w!......(P...S.....{...............v..q.".....y...crb.v.q.s]....E...q....%X./....K..l.4g].........v\|Erq......6>.i.......K.0..,wcq.c.n3..sW.r........I....W..9.s...myry/.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\dropper_front_vertical.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	278
Entropy (8bit):	6.974121901623556
Encrypted:	false
SSDEEP:	6:6v/lhPxhX7GwGYWPDQEoei/5FuuPQu+CjOgOm5eM2NLEjp:6v/7vX7ZIDQvT/5FuAQuONmw3m
MD5:	DB7B2F67C78F2C44926E7A42F49CF5C1
SHA1:	E99D204B5875E0E185EEB4E2949C0E57EB3AEFFB
SHA-256:	4E9CFDC4FE027A143B5413EDAFF4FA69305E2A0663ECE801E29D7B28C13D1D50
SHA-512:	55A5E4A175F0482B7BA1AA2F60AFD24F349A239EF596E525425A7AA9C2568B01A2CE58C2509AB113BDD23F911398797C5632172D0375C772D159D0F7C907021A
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8..... .DS.-..l......( .g5H.......?.'6..<_..8.3.3.M.}]o........g...r>.....+".#.....`..t.v.t...t..>l.._lZ\.....1...^....O....*.D9..R. ..]. ........U...G.$.s..h....t...:.z....."m!.=.N..&1.....\...v.Y>...s..?%."._.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\emerald_block.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	390
Entropy (8bit):	6.848381675187041
Encrypted:	false
SSDEEP:	6:6v/lhPkR/CnFeoQJExHldFtkqRhlSaV361GGNFCc7PnV+ti2GSN0eACXBv7bGY3p:6v/78/kFeiHltkqFSaKYKTV+7lACxTl
MD5:	F0C73EF577DFABAE02EF09ABA81B0E74
SHA1:	2B5190FEE4299514A07E7E4ADDF6613FB655BC0B
SHA-256:	AD8F52DE7C1BF711C18B63A3EC6294C12462015073180559BBF41F7AA18893E0
SHA-512:	326502B21E6E8AA38D38094525CEF368A14B68212E96A0E0953C1F32DCD9F2869747470767F73E481586678343E5B73F49295B58895FB80A7E72571B5BCCE506
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J.....IDAT8Oc4.........{(.......B.......,......,P6.....7w,C..I`6:H.d.s.8...p...4.4.M...............P...&(........ .3...[.2......`6.h.7..H.H3..}0..p.`..f..f... .7.. .....`5..@.....W\.A...0.....{...j...A..!p.@.`4....A6....A~.%.\|..l......@. C.]$.".....X3...r]..k.5.\..dJ..+~.1....P.$.00.............IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\emerald_ore.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	472
Entropy (8bit):	7.276301319632105
Encrypted:	false
SSDEEP:	12:6v/78/6E7fLN4rGBKhymbP5rJGh0v5KFb1:3fSNhBP5rbv5KFb1
MD5:	9901DFF63DFCD550C1EEE1D4ABB55B7C
SHA1:	C5DB392EF46AC56A0C6867E81820AC8F572991EA
SHA-256:	BA7931A8D562FDB3D64B68DE7559DF29C0F8D5A5C0D09F0AFB5A6FA4052CD623
SHA-512:	FA040F77B696667000E73E4BF14F3240102AB0D5705AC278A48161D240C7783E3D470F2D442EA613A9F032CB801C2255D848A1B987863704C7AEB9963A3670F6
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.........8.S$...mIDAT8O.S;N.@...d.1..@....TH..t4. .A.4H)8......... ..T...r.8d.=...H...7ow...,..5..~..C...'....g ."{gYf.....0.../.Td.$.....G.[..(....f{.ijA.\|.v...[.(...j.."..8Gs6.l6..7..& ..$..yn..86.D.8..&}.\.m..\..(!.$W.4Mc!>a...K..C.....;...ol...A..q.9.....r3lEp..).*..~)...\t7...H......l4..........h....$2!.,....eU`...q\|..e..(...!t\|........m"....~eB{.q._H..ul......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\enchanting_table_bottom.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	353
Entropy (8bit):	6.880715447821738
Encrypted:	false
SSDEEP:	6:6v/lhPmNpswMR/C+q9Zg7OWcgbVc+BZssy6B7yDTPDFZAn2/oR2Ri3GgOnJL/jp:6v/7uNpsb/aczhJSslODLDFZA2eGgOJZ
MD5:	63565FAAC324AF20DC55BE98B33C920E
SHA1:	E2C62B7A2A41704D6462067DE91CE07115BEAA83
SHA-256:	4E7F772205DB184DD3B0EEBF082FDCBF27242EF026245C107E98FAF48AB7B24F
SHA-512:	751EDAF591D35293B4BC7BD3E06EB326AC225FFD721B19095942F2FC96820C0557429134BD1A3CDBB5FF19301D5DF46B828101DA468F7244BE9C08127DC65710
Malicious:	false
Preview:	.PNG........IHDR...............h6....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.1.6.N......IDAT8Oe....0...q.".@MC....s.km.:%..[_....o...<.A...H...^.N........z>..(..&{o...Iya....Y...dP...j.).....q..._..HX..y..GF.'$...w..v......g.yR.#8.......]l....@S...>.e.\|}...W....2.#...4.>.)....7(.gM..>..4....G....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\enchanting_table_side.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	476
Entropy (8bit):	7.314062211806183
Encrypted:	false
SSDEEP:	12:6v/78/jtS4idAXPUS6vi368m1BY2WSX6yizg39KEdra6tpQO/IdON:uLdAD4kSqyizmZLpz/rN
MD5:	E3F94CF314F8E805191831A48AB75C3F
SHA1:	AE0C170A1E8261A0ACAFDEF77F085A3188C7E351
SHA-256:	03A49D89B2381EE0E64F85D53EA3016D4C52E17B89DC1993D313295B853114BC
SHA-512:	0BE1745E09FD75F2E620434844E38015E4C77870B2C8EFABA6AC0D6A25FC8F2ED3249D6174E9F9304810136C900DAB71792C92E23470AC118CBF3832A17E4EEC
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs...........k....qIDAT8O.;K.`...W...R/I.Z..V:....w..../p.7..........V.uH!i...b!.y..4.......9o...RJ........Q........=]....'............e...........l.k..Z.F.5..-R8.....~PC....Q.p..7k...P..q.q.Ry.'u..e:..^v.H,..V...{@.N..7..a.........3.<.I.`rd...Z.......3Hd..T..>.%N%S\.O....M.*....&...j..)s.S.Z.".H.!..i+.....mTx.J.T: .K....;.V..34..y.u. ...........k...".;H.{6D..%..);.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\enchanting_table_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.616602770147437
Encrypted:	false
SSDEEP:	6:6v/lhPkR/CnFDi9Pdex3w7G9lR7J6MwWkYYM/oZ7bmY/EhiCvhEZmzdp:6v/78/kF4P/GfR7jlRYM/u7qSE75wG
MD5:	256A72EEC8DD672862E01298A3959C4D
SHA1:	CD59DA77F499FA1D9622A2D8A1D93514504EAC02
SHA-256:	8A973B223E1737E9C6088DFE1979A04206E0FEBF70D54823C17B60A2B33BA340
SHA-512:	F2BA2FB071567E1A95561F0497343D1A55AB3703CD3D5249D46C5B54783ED884B57471FE512D6965128A3A1688D1D57C25B8CA1EA5656C369B1A79992FFEDB3A
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J.....IDAT8Oc.....wO.1....N^..f...Z^...j`..4...H.L`.u....O.1(Kk....$.R...T....D'......... ...:..A6.....y..}....FK..."..`..B..7....0.R.,.. 5`/.$.i......`.1...f..&.b...\|.]...b.._.......b...&.6../....=.a.)OHG.......n`...`.. .1H(S#/P.....\|.3........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\end_stone.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	275
Entropy (8bit):	6.922628194268127
Encrypted:	false
SSDEEP:	6:6v/lhPoEZ1xsllSrJSvWexzsT4Z7nI9HdzAVuUujIQCh1cArtVp:6v/7wsgUJyWeKMZjI9HdzEgIJhGmt7
MD5:	21ED2B9673269D6C932EDEAB6056BF4F
SHA1:	A1FAB8A1472904CB628E554BDE30445B57474C20
SHA-256:	B6EB23531B079E2DCA779675C09B6DDB2A7A5977D9512257CB6D37D2299F584D
SHA-512:	44F8A2E01AC4612752F79CEFC97D38B659A4548F65883FDBDBAF5AE32741B1F8AE5DE5FD082A672CA8367DE804727F776BF262E4EDB4142F387F9419374ACBBD
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.u.!.B1.Ds.,G..Xp.........-.:...@.n7.&...[..~..7#r^^......z..,...........9'..$W.f..........9....V'..8...].".\@.(m...l.KO..x....,..GZ..g..hO.....yO..a...}......l.]. 8.W'.a.7.J.w.~.roo..7..H..G......l..'\|...Z.. f.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\endframe_eye.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	183
Entropy (8bit):	6.154091298131576
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lckxfiSIkoYndMMPYx5uGxXQwQWf1nCtobq8HF2ol5nym1l09:6v/lhPMkFySn+oc53xxQ81nCaeC2oyXV
MD5:	8F847C70E68797015631EA102E60D546
SHA1:	9E7FCCFAC432778C57D3DC8A746D3E77EEFD6F03
SHA-256:	3EF140CE4E76B6698CCF29535E3A90CDB09295D7D72F2CC13F3B24446D3F17B3
SHA-512:	726CEA89ED92DF6D901B513B9103B4276C0E1C1AB2EFFC0532D93F309F85396A617813F5A47793361F3B9E70852E14E5C14B6B6427655A742211F38CB59014D6
Malicious:	false
Preview:	.PNG........IHDR................a...~IDAT8.c`@.2..%L,.X34..a\|...A.R.d..fR....b.Ea.S....2...Al.!....u.-`.V.......]B...B..3.M./.-.....b 9...i"....@..9.d/P...'.............IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\endframe_side.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.941082024854924
Encrypted:	false
SSDEEP:	6:6v/lhP1+AZP1tSEghygucXi41DpGfQ2z+YfCyuap:6v/79LYEghygbXZ1DCjz+YfCvw
MD5:	6594E840D9741261057DA2253DEA74C9
SHA1:	4D3A3596EE11BB6A89B0AEBE41ED3A227F4BE79D
SHA-256:	01708E4DA0EE04F883B0FC9F3D757B2404DD702365C87139F17BE68035A9F986
SHA-512:	4388F8C4088AED882921C03F734044E99C7B23DC75167278EDB138D9556CC60EE23E3EEAC27FFD22FEFCD227AAF357ABCF9BC28473562BFBA65D4C4603913249
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O.!..Q.D{....Ep....!9..G. ...$X...8$..D"W`Jf...!@.b...v..........X....q..V.k..WP.8.....oW.P."I@.%..i..XE.Sm...N../s.....^<v..Bz.w8&..T_!_\>.1R\.'`.4..=....c.(.@....w..D.KB(.c..L.....B=....4A.....S.T, ..yWDb....2....s....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\endframe_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	269
Entropy (8bit):	6.586805217663405
Encrypted:	false
SSDEEP:	6:6v/lhPKIFG0vJ9fR+VV0aLW52NnKAFCm34j8Ty1E5RyUjfDs89RElobp:6v/7dvvp+03EZCY+1E/yOL93
MD5:	AC74D596577312B028330BD26B5C30FE
SHA1:	314C992450239AD9DAD446A905899EB1937E7727
SHA-256:	00D71DA8EC37FD32AE9AD83B9EEE708A11073BAFF75345379B6EEA0BD93ED141
SHA-512:	957751416083DEC67516A31BEE44007B1C3480FDF769F09A329B797CE48CC41C9C8C289C9CC9AE8EAD1BF9338F7028AC2DB1483BF1EA27095BF060FE5DE4AFC8
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.cp*N.O.f..3.M...l.. ....`.~............. . . 6L.gk..@b0y..@.o?..k...S.. 1..H......m0M0/...b.,.0..4.. 6...V.R.R.R.b.(@`..$@..$E00H.f.J .....8]...$.@........\...0.....F#...K.D%$lI....t.&eP. ...Td....@.....4:...M....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\farmland.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.071932590220747
Encrypted:	false
SSDEEP:	6:6v/lhPWBvTBIYDitMf5fwJLRkHWefhDUdPTqAhAWoktPUm0MHHoj0p:6v/7btMf5f89k2SDUdkVME2
MD5:	3B4144E8D0B474C0C5643D5790DED6A7
SHA1:	5FDE6B0EC7781A0E9D6008B6790A0046CE5B5B13
SHA-256:	124D58E0B7ED05B0C8E4F21E85F4AB4A479454554CB7C0414764A6A1EEBD3A73
SHA-512:	E518DD8A7367FCA65EA7CB3FFB3AE18068959C95080F2957DF5370BEE0E8EF95A34CB645E0551DE2360197A0FF6E6B3268279FA1A2B93B6C197525E7ED02BD49
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.u.AN.@.E....6.1...qc..0q.Y.<s....(..L..p...&..z...tU.....b.{............z.B..."K...`.Zh1......(..HP6.K..q"....l.YA..D..k.y..x..?..$....^.,.`.-..&.&....x.M...k!$.N.."K...t.........B%.+K&.^.ng.....RD6......".\|q.x3MA.%N..3Ma....a...+.~6.\..i&.D..,....WK}.#3..J....!..1....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\farmland_dry.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	243
Entropy (8bit):	6.708775273792872
Encrypted:	false
SSDEEP:	6:6v/lhP4kqG8E1q+Ks9t3LxSzVIWinZwtTp:6v/74G8E1fKZV4nZwt9
MD5:	EEF69A7BB749A7A35BA538583DD692BA
SHA1:	18075E41CF3850EB4EB1C904479DDC9E87A4C315
SHA-256:	ED094BDDFAC0F6DEF533096ACFCF836FD667B6F14C90B571BC676A3BF58B54D8
SHA-512:	529E4D12AEB5323F52F5AACB650082A546FC24509959F09C680A7AA089F0C1F7CFFA5D13B4192358D8A16296FFDE52DF013C2D204C9A923A424438B5F6E3BEBD
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.S...1..:...........}....0.!W..J....G....u..[...e...:...... ..&....(PwP..J.\..$.b.0&.H..J..C...P..Ck.j$I.}Y+..(....;Tc.....1.k.4..1...AB`.dW.O.x.3..1W..e...Yg>....P...?...W.;...@R....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\farmland_moist.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	344
Entropy (8bit):	7.107520919985297
Encrypted:	false
SSDEEP:	6:6v/lhPWza1eu+zfOTQmrRAjE8TolErypR7KXrtIXxDmdAvm9z2vcPCpdusbp:6v/7sM+zfOjRUT4ErOKb+n+9avr1
MD5:	3F8699692F7DBA5A27A7BF529CB1434A
SHA1:	A771B33D54F01C55B96B5751F968E50DFB220F3E
SHA-256:	7586B54FC096814D44C8F4E8A444A1016A5B411A52DABDB1D9B40A2F813BC9E5
SHA-512:	81CF7C4BB5E324CC3F8418093DF45A2383B766F8813D6912E29935CFB228462C07FA49EF55184D60959529ACA3DD20730ED6AEEC4F6DBC9C9EC7A100F6B3385B
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.uS1N.0........d...\s%.5..=O..W.kx.Dr.+.)...h.......gg.7.Ow...C.x..mj.@..@..n.....P...-d..mSc<_...0...0e.>.D.....E..1#Q.\|.....&..D.b.W..-0.O.gM,M.Lt.$wYL../.Y.%qjA......gf,...\|..3..D...L.....E9.r.....C...............oR..8k2...H..<J1L.P.~.......4Y..*..`...o.]...M&...}..gD8.i....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\farmland_wet.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	244
Entropy (8bit):	6.792369676288184
Encrypted:	false
SSDEEP:	6:6v/lhPq8BtM8q6kYyDvR+qpWarrpz1a+w0kDOZrlsup:6v/7Sx8q6+GarZ1askDOZxsc
MD5:	B8EAECF4AE881010BB7591CC02BFC0F5
SHA1:	9D8BF842A08394525F24E3CFCDBF98E4F7F89B1E
SHA-256:	5A00CCAC1D2E35EC72E4EF31FC0E7126464A5DDE6DF64C6701849E8F7E92EF75
SHA-512:	BDA60070F47E97A7100AA75F7530B4254437C0E78778B38945EAF302369C8026FB1DDA3C1C5CDA39E03997E3A924BB99E00E045230C235AEDF747765EFB233F1
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.S1..0...r..#....xE.A.?q$.O&5.!...;...k.X.q..C.=.W.>.S... ....".<...'0..L....$.f. .........X....\.......F....1...r.>6..+....6>5.....W..E.8Z.vv...w%J....e..fYg..W...B.U......\.....8....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\fern.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	460
Entropy (8bit):	7.293951262685706
Encrypted:	false
SSDEEP:	12:6v/78/SBiBshb0kYbyQ52TKBsyfQgnFHOmMjSkQ89luFNYz:GhIkYbV5xsJg1OmMPQ8yN6
MD5:	6FD7EA6B469E5519088DD44B5CA313CF
SHA1:	128466150BAD94254F061A958231F35B914B29E0
SHA-256:	E6CBA46AFFE2FD353BD7FB27BFB5C5AC8F9BDD2486EA9AC9431E8817768963ED
SHA-512:	17839C29BE22A661679CE31B4C37E6B3FFE3696F91ED8CF5479A99689C5E8FAE371E6C479C6435140DC797A204A12626E56D1C9A74F7910F1A0351C65E6535D7
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...aIDAT8O...j.A..gmb..C..Ise.. >..!/ ..T...M..@.."")..W.`.0..,R.j.7.".^.......oO....nl....~=./c[.*..[^.^.._...\|.!`.<P..G.q.C.......T/.2z.I..,....{0.dK..wL.L.......bwq.dP.k.t]....D.h.....2..C..Y....\ ......#.}.$(...........].....M...S.h..7MC..?.....Yj....P.a...0\|..$.l....qI.4UM..#Q.Q..!3FFC.@2M...U.{63F...".@.>$;x.2.@S.d....}.x..........7...B.;.@O.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\fire_layer_0.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2246
Entropy (8bit):	5.932247015148578
Encrypted:	false
SSDEEP:	48:hTvx0Ma5sWMQdFuRl34kvruJKeTlXEh/5:Jx0hsQ2bokvrl5
MD5:	F8B30975AB5DB8229609FCAEDF547FFC
SHA1:	31DD6C657A3B066512EC318AD0E0D854E6372CB3
SHA-256:	678290F721761ECCA5FDD38928C5200C5C2C565B57FFE7D4179D9594D7392C82
SHA-512:	BC87CEE537AF98B5A0F7D8E29AFE8A8DDE0E6850E025FB386AC3B4E08F5678FE8CF005456DD8F56C74877464E851868C70A8C44F9ECB855F4B3E03409A99D45E
Malicious:	false
Preview:	.PNG........IHDR................\|....sRGB.........gAMA......a.....PLTE....+..7..;..<..C..I..K..M..S..T..U..W..Y..[..^..^..b..d..e..f..i..m..p..s..v..z..}..~............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................J5....tRNS......................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\fire_layer_0.png.mcmeta

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	195
Entropy (8bit):	2.7070919506605966
Encrypted:	false
SSDEEP:	3:ozzfkHFhUIA6FOFFF/IF/FhSFn8N/vFFF/iFNxFQMF/d//FmVPFYXlF/miA:o/WIOD0Z7/IsF/LA
MD5:	057C4AF367326C1A904389D041A25FED
SHA1:	20A4664CEEFD2D5DA18F9C35B7710B9EAC67F77B
SHA-256:	EC672569EB2782A3D8C25B7F9F2194343EAED7923F793A91C076CD192EA761EC
SHA-512:	41AF6D767DA0ACC76644C1736FF5FDA122CE98449E3DFCAA2AE598239A12144380BBF02F1DE6CA294CA18B99CA6B9FC0EFDA15294478B3C82E3D41340F288083
Malicious:	false
Preview:	{. "animation": {. "frames": [. 0,. 1,. 2,. 3,. 4,. 5,. 6,. 7,. 8,. 9,. 10,. 11,. 12,. 13,. 14,. 15. ]. }.}

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\fire_layer_1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2246
Entropy (8bit):	5.932247015148578
Encrypted:	false
SSDEEP:	48:hTvx0Ma5sWMQdFuRl34kvruJKeTlXEh/5:Jx0hsQ2bokvrl5
MD5:	F8B30975AB5DB8229609FCAEDF547FFC
SHA1:	31DD6C657A3B066512EC318AD0E0D854E6372CB3
SHA-256:	678290F721761ECCA5FDD38928C5200C5C2C565B57FFE7D4179D9594D7392C82
SHA-512:	BC87CEE537AF98B5A0F7D8E29AFE8A8DDE0E6850E025FB386AC3B4E08F5678FE8CF005456DD8F56C74877464E851868C70A8C44F9ECB855F4B3E03409A99D45E
Malicious:	false
Preview:	.PNG........IHDR................\|....sRGB.........gAMA......a.....PLTE....+..7..;..<..C..I..K..M..S..T..U..W..Y..[..^..^..b..d..e..f..i..m..p..s..v..z..}..~............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................J5....tRNS......................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\fire_layer_1.png.mcmeta

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	195
Entropy (8bit):	2.7070919506605966
Encrypted:	false
SSDEEP:	3:ozzfkHFhUIA6FOFFF/IF/FhSFn8N/vFFF/iFNxFQMF/d//FmVPFYXlF/miA:o/WIOD0Z7/IsF/LA
MD5:	057C4AF367326C1A904389D041A25FED
SHA1:	20A4664CEEFD2D5DA18F9C35B7710B9EAC67F77B
SHA-256:	EC672569EB2782A3D8C25B7F9F2194343EAED7923F793A91C076CD192EA761EC
SHA-512:	41AF6D767DA0ACC76644C1736FF5FDA122CE98449E3DFCAA2AE598239A12144380BBF02F1DE6CA294CA18B99CA6B9FC0EFDA15294478B3C82E3D41340F288083
Malicious:	false
Preview:	{. "animation": {. "frames": [. 0,. 1,. 2,. 3,. 4,. 5,. 6,. 7,. 8,. 9,. 10,. 11,. 12,. 13,. 14,. 15. ]. }.}

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_allium.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	412
Entropy (8bit):	6.937667379943387
Encrypted:	false
SSDEEP:	12:6v/78/W/6TuZ8yn1gtqJzZG6xq+MN4oBpoQYg1uMc:U/6yZPHzZGD+MNVBpJYYc
MD5:	DF7040657E602DC0910647CAD50BF883
SHA1:	8D516BDBAB9174F0C8EDC38013CE3A78A31ADAC1
SHA-256:	B83A0EB1F5FED14BE08FBF0829B489803C509EACB941D6BF7400FEE1A9EDD17D
SHA-512:	2B8C0809A1D3BA94240BF14596A228530E688C74D271741E7094F00C794778EA54733438195176E058C5B7591C58603B6CD328FB609F46854559D18C5020F859
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs................1IDAT8Oc.p...Q...........w.w.04.I1..21..g..@.&(....!..49...8...x.B.-..M3.`..x....... ....0.j....JP... g.4.h....x.........c.i.9... C......._.10...b\.b..$qk.f..a.w......>KY..E.b...T...........Yz.A.....{./T..`...0..g...g....p..hD.._12..d..0.^...gd.%.... .PM{.hW3(...5..._.....Kw...`....}{...........L.jm........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_blue_orchid.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	311
Entropy (8bit):	6.581596804726764
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6T2w+ufKgLrYfmtitcke9jmrogSVLhSbp:6v/78/W/6T2gKurVtitVepcec1
MD5:	EBC8B04BCE9BE04C1A338BA039B21BFD
SHA1:	FB0ECA203C7FFEC696E6FAA5D432ADCF3DAD6143
SHA-256:	11021F4541C4D03557D6AC6641975D4E6E91BEE9B3574CBB8D7BD2D879113A4E
SHA-512:	F6A1A1783E2F260D977867534AF4B47D23C1F2274507B8C403595A8AA1365AF7C7A3B2D0EF3F013D0F58F63EB9C91434019C64B3E6BEDB993FE05EDC441993B9
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oc................LP........G.....3.L..a.H...n..\|.\|.A.......T..@...8.`..j..p.F..-..g...P.....Q.q..~..sCW................o ?.l.i..A....8X.^.l;.F.fP........r.(..?_..$O...C..5,........@.e.... ............Y\|:<.t....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_dandelion.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	260
Entropy (8bit):	6.299535168705166
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+aAQbrxCjq6vIJX6W0K4rOjFKyDN7txhRntljp:6v/78/2grvyX6W0K4rS1NRntlN
MD5:	BB83BE03C4C99E504D38BF7897A84EA2
SHA1:	39EE38B136959055ADA271369E430C3EA2C57B91
SHA-256:	86C170B7EE66572035E1B17F2B95C641D5D98386E98A0280BA76BBB1EC4A1075
SHA-512:	6CBE41DC5BEB6C08A48069D5418A074C6D39EEC59FBA5D6A37F1179E5FF8B99F2FDB0FC8948C7B79313A75C96EEB6313BA86DB7FE8C570D2BF30DF2EDF92582F
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8Oc...........\...Jc...W..>m..fC.1.V.@.@.........2..K0.H..,....Y...N ^.....\...J...&ca..n.V..O~3l+..U......b...6.........z...S..K3..4..`...........O.I5......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_houstonia.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	378
Entropy (8bit):	6.848678096824951
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6TT79KSH+LrJwdJTJPtkuddpOHw939INzuSmi/qlYRTp:6v/78/W/6TtKudDVdvOHw9CES5eYH
MD5:	9F5A218FBAEE3CE1BB29180A8A4C550C
SHA1:	4A2F164D6C3ED967C03A15E5C86E4B0C0F0AB0E4
SHA-256:	4C6F61BC33375A6F95992A06AAD685CF0D5DE78AF78F8FCA646E6BA62A5C7F54
SHA-512:	F591A91C96F0132604FF639016F6D096B96BAE9B0CF23772113CFB227234A8DB2826F28B836FEE099485F70A840F177006655F309F4F26CB75B6A322C8476382
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oc....0Bi8.Z..a..........o..1q1...b.........bX.*........e...........k/^.?..44.7..P.x..... MA.........p...0.%...p...>....b.0. ....7.).q...W..X..P.k.J0.J .l....[....{F.Y)y....._.v..d8....F......@.a6.\............#C.aW.......X.2Ai.....%!....... .......78..\,....t...3.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_oxeye_daisy.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	440
Entropy (8bit):	6.972015738071038
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6TVb7kXrpW5Qr9tWWXVDFDbdbGfziBrUq806LLqSkb8Hd40bSE/Vp:6v/78/W/6TVElGYHHFtMzHq80i3RbSc7
MD5:	C5DAB39CCA12E42AA42EE4C3420F11EC
SHA1:	6865FE36AC9BBC4345E6D3990E20E2DF36C2E45F
SHA-256:	0610D8E4874E0BC1CF3692A764C7CF7D007D28BDBDF0659EB05C24CF32E02B26
SHA-512:	01D95C0C0089888503C5CAC88F990127CBC3D1F2ADC43E1A6B343B2B1B9CA8998CACE8CDA84EA301BD2B0051656A33C4E7FEEEEDA2660B7E381C60F75AE4D457
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs................MIDAT8Oc.\|.........f..........x._}.o.8Q .._..&....3.*M..4~....5K0...\.U....4..4.h..N..bb....``........P....`.c..?~d......W...<.............?..... .@....7..w...b..O .B.\|.o.f.......5...=.G..0.oz.U...a...g...3\|\|...Y.?......c....8.........95...o......@...e.9..@.............d...<8\|.....JU.qu.9..:.j...(8,....c.x....-.P.6...............IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_paeonia.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	503
Entropy (8bit):	7.270399268622415
Encrypted:	false
SSDEEP:	12:6v/78j/6TOfECQvhzpBzzCVB+8lpA4et2FocEUc/J1eM/LG+e1:9/6KknBKkUo0tGLGn
MD5:	BE1BF1CFB4B17986F26384E5B878CB15
SHA1:	3072B32B06BB28C9AB207EF2ECFCEA5ACE88BD7F
SHA-256:	2B56DD06FC8D9CCE02F4F72BBCF03B8BBBC573CBB930D77A22CD6FB00C62C475
SHA-512:	A0BEF33979489F9C031E7809B0C56C720C81258CDE58F127F14A8F57DC080632D5661596A7996D790DCEA4964D21C36D027977BBA85A70AEB8C848A6E9689562
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........pHYs.................tIME.....5-..-....IDAT8...J.A...5g.KbTD.`P..".)T..(X...6....`e#X.[.)b!....E.#.I..#...].b...%Z8...~.....W....l......4M..(..+b).r.' ...3......"...R....b....[6....v..\|..P...r0.N.^o.b.c..v...`$.>U.t.A7...F{.....H.....J8.6.. .6.S........7.J.)...4w.7.m........zB...S.........j,mMJ-..F.q.:....2..<....n........W. ......S..".=.p.........q!t.....V.....o<.^$..9.'.G...wr......c.e.\..x.O/E~...#.........T....{.J..}.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_pot.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	149
Entropy (8bit):	5.757791706796977
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lyhqgRkyt2BpaRuXh+ltXbavuZ6BGZmnswJQp1Ko1DZc1p:6v/lhPiq8kB0RuXhat+86UZmnwvZYp
MD5:	E859C5AFAAB5BE7E7BD42BAC0E0A824F
SHA1:	A94AAB811A33AC2CB58286DDB83E2CDE3E163BA3
SHA-256:	7C72119FC47918EDEEDB19D83E52AB3EB73953AF03868780B02AE1249236F60D
SHA-512:	7CA08435BEFE19684BC7E6F804D4FABD366F9CD7A1D800E2E591C575E135F8022EF616D8D9C6F3F0C4998B34104165831CF6773CFA045918AE9E87FD53A1FF03
Malicious:	false
Preview:	.PNG........IHDR................a...\IDAT8.c`.......;}...........tK..D.....2d.........$..4.h...i.a...r.,.A4..........2.f3..2..bUa.aYm+....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_rose.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	303
Entropy (8bit):	6.580962263119154
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6THfaD07HUjY66FAM25mWv7uE6YMX0Ev1GWnblqUOTTp:6v/78/W/6THfRT66Fh25ZqPR8WnblqXZ
MD5:	BD9E386012B0A244E8F5EE4985AFAE0E
SHA1:	91730294C67ED028EF7F4618BD6CA8A76C61D5DB
SHA-256:	B516A81A6F1C1864920D3D984E4E6E8EF5FD0FF818231525421547B4E31B8A60
SHA-512:	CCBF380FB19D0CB31233D8CE0EE97CCA4F9892A4E964B8AEEFC30F30040B228A946DE217BC55B20010F82042E55C4A525647931C1A436BEA667FEE282FF5BE19
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oc..t.o.t..V....b.F(..@./}..p..G. >!..[...F._.* ..J.....n1.0..@..k.......e...O..R.=..Z.`.....7..jQ.8...X......3~s..b.....p. ..e@.:.h.....f..@....% >..... C...0.e....`.-.jq..H.H3...H``...sJY..2.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_tulip_orange.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	350
Entropy (8bit):	6.711233339851442
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6TNhtmMF7PMIxLHKKYQQmTDL5IUfFhOkCat14bbpKY5zeJJk7Tp:6v/78/W/6TPtmMB0yOQQmLbfFhOkrz4T
MD5:	7F006D601C9A8B88AAB50094B63125A7
SHA1:	C671EAF342109DBB812E2B609C431FBC59C872A9
SHA-256:	6DF7CC7AE5BC0FDDEF198E6DD94357FEFC96180AEB732CBA50EC7F5E1AF2A237
SHA-512:	37BBDAE6A85D42F9AB8A2AB81893723328415529B3E1DD889948E1C18CC1CF5C6CF920D12DE5B8C39CB4EE23622307E6EADDFBA4AAC9F8CA50A21C88B9BF4753
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oc...2......K.i....2...J..n>0e......^.U......V.8.O1.9..........VC%.......%.o2.4.7\`,.e..`...4..gP-...%.../..wu.C.0.V.^.y.?m.%.].....w.ll....2...?2...00.........,<xm.....}..v.1...?.... /............'...8.......NSp..U.x....-.P.6......M-`.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_tulip_pink.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	308
Entropy (8bit):	6.644430971014235
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6TkVSVflXyemnkGTYi6Wqdkrvox0v7S0ZlrL6Ncp:6v/78/W/6TQeXynuWqyv80ZRL6A
MD5:	68716299E829F4F42ED0E503D31356FC
SHA1:	79096806D46B45290F5D1360E9AA93E3A47CE366
SHA-256:	A1FBC392858967333C13C95FDD82E32E65F1F10C9B47A638424F20385086D013
SHA-512:	14ADA01188EF8319582B7836E017B5286DCEA6E471C780914D78D86295BAF39A805BBAE5CD65F0C5BB021BD54698E38C6A769CE3D2C1489A9A4F794EC60A0423
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oc........K3.>..?T.4...2...LP...\|......`...i..c.`.....BX.V...5.Kf.f0>+..'n.....V..eX...x...6...w8.......3...0\|g..p....(&.i...4r......#....\|...?.......!...q.!..@...x..e...Q.3.@....o.e..a!.......K.P..y....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_tulip_red.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	327
Entropy (8bit):	6.677752182314925
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6Tvj92BDCvqn/8NWiMb9zdtiTy4zb+SSQ0xp:6v/78/W/6TvMB2qepMdtSymI
MD5:	A6F2EBCD2DBC20A7FEC235F7FC2E9E32
SHA1:	97B33E7F19E9FA4EEB646DE141AA8B2C843373B9
SHA-256:	9BA5D86550B573D423AAEC60BF3F90A9C3B4ADB65FB2898412E18F92C7BAB493
SHA-512:	15AF28669060FF6F184CA8399AF4124BDF6E0C548916720E509306537B42C4920060A8A8BB73BC90E555C08DCA4ECFF995668734EE89963634165AA2EBF32CAE
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oc........`.*..0Ai...O......<.....`.A..~.p..G.8....A...3.\b\...C.g.Pa..........3D.s..^!....0.X.v.l..... ..yM...#@.z.....2.`..H...^.....V...W....x....+@....... ....0.......`5.d... ..q...x]..D..(...By.....!.Tb..@\|....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\flower_tulip_white.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	316
Entropy (8bit):	6.688129758704445
Encrypted:	false
SSDEEP:	6:6v/lhPkR/W/6TDG/tVNlgc09MHRgqH3E0wQXAp:6v/78/W/6TMtnlvHRTH3EP
MD5:	762FE3E85D49C32FA5161F2B9DAFC3CD
SHA1:	32356CF5D42E6903BF8A4262F492231311B0EE4A
SHA-256:	8DB83251C51B911DCC165EA38AC13C6D9DB60C03731A559E08EE665FB227D921
SHA-512:	28EE5CFA1A302B0291FDFD2DFEDF4346F98CC8C6BA7142B68B3DF8D31F509EC509B18C094483724A85D46DD7636C6CA3358CB42A3B8A4A0E39B2EB4A207DC47A
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8Oc.........K3\{..?T.4.2.......1..c......p..U...`..o..{......./^.B.W@.n.{....?t..V.pz..........a..`...0.",.....B.......\.+@..k`..`....o0.4K.n....-..:..m.7.A......../.....0...e2.}{... .3..]...."@8.00..Ts^..>......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\furnace_front_off.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	374
Entropy (8bit):	6.945083879172609
Encrypted:	false
SSDEEP:	6:6v/lhPmNpswMR/C+q9Zg7O2ndcOc/409uN655eYDmAPpwTgusbK/CXzz7Vljp:6v/7uNpsb/ac9cD/4YiAeYaWCsu/C37N
MD5:	4541FC2E775A15191762FE2D1067F2E1
SHA1:	4B9F34E141102CAF03E4D1D6DADF722BBCE0264B
SHA-256:	CDE4CA793B68C6AAD05E2CFE8EBF4CA8E170B2F6B67318BC4871F1E38556DAD0
SHA-512:	F348A44420526FB4D6C03886E3D85F3CAEF372BC32EEF2CD804D47396C8D706AA030DF628163B8CC8EF8A9D017DA3F3C7B40874AB1F7885DFF79CCF40DAFA971
Malicious:	false
Preview:	.PNG........IHDR...............h6....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.1.6.N......IDAT8O}....0.Di.%P.SC.{.;.P..p..s....W(.....H+....6.q....N..M..xv......H..k....1`t.f.@. ...$$.....t.B.....$..S.;.J..\..!.:...XKP.._....5:.....1..u..z]W^....@E......$wk.ZB...........4...0<k.!...8.<x..d.Q....X..@H.\|......!.:...V...f.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\furnace_front_on.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	398
Entropy (8bit):	6.952790757092678
Encrypted:	false
SSDEEP:	12:6v/7uNpsb/ac4155EC8zPKWyOAnzSSXVwwlQFzqI2PD:nToKn+PKWuNlwNk
MD5:	87B704941EE6485712FBC62B2AB57408
SHA1:	0A09864CAA99ECBC09D97AF299727425963CDE88
SHA-256:	975E459B22C15A58E57A97CF3C63B88DD16DA66462856902023BDC0DEC03202C
SHA-512:	CF16F73596D3EBEAB0C5254973738D2CC74C909276FA5A77ABFB89F640E57A4E25508521CAF67BB0268929C9D37ADB1787110D909314EED3F014FCD16FD339A8
Malicious:	false
Preview:	.PNG........IHDR...............h6....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.1.6.N......IDAT8O}....@.D...D.q..".....8F......r....Y...F...gn?.i..9o.^p.Mp....\|u..5.R..0.........@\|. )i\..H.. E..@l$.=...\.......B.Oq.l$B........... ...D..........A...)..v.7"....FB.#.........y.\|.!G.;@xF.G.5V...J......R~.Z..`h.?....R.?....".} ..q.:....G#r.:.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\furnace_side.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	489
Entropy (8bit):	7.358898727717385
Encrypted:	false
SSDEEP:	12:6v/7CEtW9QRGHCAjHm7koAMMCp5tirZBmxWEezjr2jiN:ZQRGqJAMh5cBpEezXNN
MD5:	15F4CA422F1FBCE737095F3D5ED8DAC8
SHA1:	0257C2F4261E153E0608F9110E37E8CA2761D3FD
SHA-256:	33DFD9F994A61263B52D5F87E856B38EFF7AE3BEEE8F690D929119688D085FBD
SHA-512:	EEA406E07F62BC6BCF01E96BE1AEDEA5DD5356B171674859E142F37B8619370EFEB9427E589F56107B817D72C17D697235510F375E2FB5938A09E931E8AB878B
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.....0...]r0..r....z.K.c.....>Q.=.5.......G.....1...f4.~...a..8Rk.`'.Zg;.l....B..m...4..9.[...R..._...n....:.1D......s..'..\|.....)%!.B....D.)..9GUUH)i..c..RJ.. z.s....}..ZK....X..c..#..8"...:..).....R.)%.....9..R..}....)uk-J).R.].H..#J..?.r-.r:.-M. .DJ.n._$..U.R./.......x9..!d..Z.E..x.z...n._.c....dp.\(..c.EQ0.3EQ\|.p.G.....u. .HY.......H>!.j........J.WX.?.Z3MS&Y.}.a .H..i...0...0.(..r...c....y>.>.s:[.3.0........B.=.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\furnace_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	508
Entropy (8bit):	7.3351937675836965
Encrypted:	false
SSDEEP:	12:6v/7BfxGiecBVTluDcVo3n5tWK1nvPSL1jjEHF8z:yfxGi3luA23KK1voFEHF2
MD5:	F120A35BC834D6F4EA29C5BBA9F70B32
SHA1:	E620DB3E93C40594A137FAE1A703DE4805D8440F
SHA-256:	DA2950D030E6070B08FA5BAEE22FD12F908964F11B9ACE13C51F45A265A497F5
SHA-512:	1B9C18F40B071CDD6DBF2F7D7518CB0950653FE198C1459D4B34222A3858F0A378F8B20D26C6C4A5273135BB1CD52C767FD4B7C483A02744734B11E8B054F41B
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8....n.0..?.....9H.AK....R?F.G..%."jf..........2Y9[n.......)....E..@Y.7..eQ.}.....<].kM]..x.....\).7)1.0.@.a...U....k...:.M...q.1. ...k....-+.]...f..YLkl...!..B......>9^Ek.8.L.s.....B:.u?....X..86..{.s8.PJ!.Lh...."=.B.mZ.!....,pl...13B?.7..s....M......R3B,.S)...ymY].)A...(f....:.e....\|\|.?H..........).A..^k~??.,.......,...........f.a.......;...o.4;86M....BH.K..l.......=..3....B@W...py.R.8...8..8.\..bU..m.....:...>.;.\|..?2..S.C.+....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	245
Entropy (8bit):	6.372226707209098
Encrypted:	false
SSDEEP:	6:6v/lhPkR/CnFjVnh1te3jH46NylltOWH4UgJmaeF4FZbp:6v/78/kFFh1tcDNyleWYdJC+n
MD5:	5B7BBDC24844C3E4765C77B1F00CE559
SHA1:	67397D75E6DC96E15E6DCBECC3612840D5E2C5C4
SHA-256:	9FA408E2AA4CEEC90390C5CA5571D5728A93842922A7DA62A5FC48E87F29CA1F
SHA-512:	198B4152E206751F24C7FFC726DC981B7A94D8C1EB031C94114F1F8D5B5B40C05E35C6391A855749245CCF1A4C3463D16534845135418056B3C3D403A7705F02
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J.....IDAT8Oc......2..g....l.6..*F.......e.A@V&...\|..... ...n..9.x.n....I., ,...R....(3.b...p0...I...ICJ..$...V.]..Y....q..`.<...,.... ........6.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_black.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	105
Entropy (8bit):	5.543052324695464
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lGRShs5XBo3kt/l1rKM70/H1p:6v/lhPmShsJe3kt/Xn70/Vp
MD5:	7CB6BE64834B68A9617511989957C75F
SHA1:	FC5C5553D14C8BB2C7223C2588D06935AC1557D7
SHA-256:	C05B4138B96551D63357EC3845911EF3848CBBD76957AC1AA1AE4003B113C75F
SHA-512:	4773EB77D9960877AA4FBCB186EEEEAE8C1AED4C2C647B185F2D373607D2AE83E0F269609685FB65177C95F4574AD1F06E25E5FFEBE6CBEE218A7BD5EDC14886
Malicious:	false
Preview:	.PNG........IHDR................a...0IDAT8.c...\L.f.2...X..M...)q.ljya..c.lJ..M./...o..V#......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_blue.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	105
Entropy (8bit):	5.376118580667599
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lGRCZLA+kp/7PYctVp:6v/lhPmH+kycp
MD5:	CC908DA942E44D1C06DDEC4F34077183
SHA1:	EFE18E8AAC08984E8C58135DC549F8DFC2DCC09B
SHA-256:	0416E4A8C66F89B9394A8BE3F5470E6BF8B232BDD26147B5A107EB7764A61676
SHA-512:	5B4F21FB89F6F89B176FE6C978F1F04C313F9B2DF744190D61A3C2004288752C13EAA8477D8AADF38F3504327DF06B7B00EC6945294798AE3BA10EBEA82B896E
Malicious:	false
Preview:	.PNG........IHDR................a...0IDAT8.c0......e......K.......Z^.5`...K...4.....%...$<V....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_brown.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	105
Entropy (8bit):	5.562099943743083
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lGR2clX3xo3kt/l1rKUXNNx1p:6v/lhPm2UXe3kt/XpXrp
MD5:	AC71AFF969581BDBBD1D0EA4B4B813A5
SHA1:	A57039D04AE83D1790997C76D30F3C5C17D0282E
SHA-256:	1D835741AD220DB343A3469F0C9EC07FE701C974BC97F62AAB50FE158FB13A81
SHA-512:	15BB5CD80E6144A34E70C40DC0CE22679BC092AEB18273067DACBA789F77E95F67DF16C964505E2658D3A6B192E680943FCADAD10234630664CA41AB51C51A3F
Malicious:	false
Preview:	.PNG........IHDR................a...0IDAT8.cH.1^L.f.2...X..M...)q.ljya..c.lJ..M./....iZe. ......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_cyan.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.47788905470617
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1yxduP6Olk01VbqH8B2cgOnPl9iRFCsg1p:6v/lhPF+uCKk01V2H8BvTPl9ogp
MD5:	F7F4A5B2A293CD6A649B146E83AC6957
SHA1:	40135AB9A0D53B8BCAE8397771B3999E77E4A3B9
SHA-256:	28588FAAE6C5287A863A77310253E4A836192C13E1F46C0D369075E0576234E4
SHA-512:	128D3504FA1F189FC788FC1ED2CCFAE14FEE744E9A48A0E438A771B88F5FB9D635029B1DCB0A412501795739575FDF206AF10ADD6917EDE852501285776A0528
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8.c......e.....0...fS......#...0.&^ ......e........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_gray.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	105
Entropy (8bit):	5.504957086600226
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lGRXzsvo3kt/l1rKQzApxJdp:6v/lhPmDr3kt/XtzMZp
MD5:	9AFC164E21A8E6D9FD957CECF0E27FB6
SHA1:	89D68E4C815775C355136BA89884AEDE9D1934E0
SHA-256:	EF63E3FA74F2DDA2C65C0946698493E063F42F4B9F411ABAA03B98EA57499E6D
SHA-512:	EDF86B6429A8977ACAD3576ECE3798AF3E5564A0E4C025E1465A85D36A7ECED3DFC4B136F869E4B01C6A4C9F01CDA624911780F33BD311A4582649AE9BCFD39A
Malicious:	false
Preview:	.PNG........IHDR................a...0IDAT8.c...YL.f.2...X..M...)q.ljya..c.lJ..M./.....Ye.T.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_green.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	105
Entropy (8bit):	5.509625896082826
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lGRI7ps5xo3kt/l1rKM1PXsup:6v/lhPmIx3kt/Xx1P8up
MD5:	071CE4FE2AFF053AC2F4A1A4032B8C72
SHA1:	F61EE6451C9D5F6479B458899EE2DE1607E6DD8C
SHA-256:	DC82BE445BD9C7CF158BD57651D51BFEF400310F2AD4937FE1E5B1C60B4F5916
SHA-512:	DDB4FF8785F1924B0985C6AD759B8354F8A1A1D55B0145BE1B5740D6454F2C14244B5C417C241ECF238C7D22C2B466CAFD95D0D5F7E75F6C1EF313EF03B159EB
Malicious:	false
Preview:	.PNG........IHDR................a...0IDAT8.cH.7^L.f.2...X..M...)q.ljya..c.lJ..M./......e..:.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_light_blue.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.402659493100409
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1yxduCJvdTAVmAx5tJZ3YHmt2up:6v/lhPF+uyvmV3/DZIG8up
MD5:	8F1FC75F58BB90B33AF0A2226415DF2E
SHA1:	9764FA1A0964FEA8A5DD2C6FD04B3216A681721E
SHA-256:	9E42D238C974136CA7C16FF434C825064B78A4D82341708638A76FFD844C544F
SHA-512:	B948D91A2F482F78630E2CA468E95320ABF648FD057D038D46DEB418FD73A815CD6DD773ED2E3E99129FBF75B925F5392B314F845F2278B9D83D9E9AA20989CB
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8.cH.yc1%...H#.c5`6%.......Q.F...)1`6M.@6..R=Lt.b......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_lime.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.414163700912176
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1yxduaO9I01VbqH8B2cgOnPluzttljp:6v/lhPF+uZ9I01V2H8BvTPlatVp
MD5:	A9BE7ADFB850E8D32511190BED142860
SHA1:	37B260F9400DBAF8865E280D6F8A5118FF873B49
SHA-256:	DD7E27B22C7318EE27BC3ECA7686A1EB9D960B25A9C723793555CB8E3CA7B69E
SHA-512:	41C2BD0BB5BC28A3A279A9A7E64B8ACFFD218F6113E69B18BC9363F88CF1D8255EAEA3FBB5C3B7B18B51E92E7ACA8C7B5C4A3E4CDCAABF116DABFFCD829CBC11
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8.c.?#.....e.....0...fS......#...0.&^ ...K..e.8F.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_magenta.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.447516922366102
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1yxdudAG1TAVmAx5tJZw6e3jeup:6v/lhPF+udAG+V3/DZw2up
MD5:	F14EB20AA2D7060E4A5BCD5ED57E884B
SHA1:	36830462C00E5191A60276D1630098E56A965704
SHA-256:	BE07EA9FB37FF7F8C94945570C2EA2864A7080BCF16AEEF7DECEA7479D9C73E4
SHA-512:	9112A494E2A4A3380953C090F8BF9311B94763F7295B1FCADD17C4EBB84B89CB2D45D1B1952B390AEA50C5EF516493A1A20758BCF4A43A08757411E9154AC3E4
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8.c..sc1%...H#.c5`6%.......Q.F...)1`6M.@6....Kt.29.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_orange.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.466142710386958
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1yxduK19kC1VbqH8B2cgOnPl08aBGldp:6v/lhPF+upC1V2H8BvTPlFaBip
MD5:	6565BD63D096E47F8AFFC06E78A95438
SHA1:	A1A88E2947DF7269950AB06B59A27D7C0BAC46B0
SHA-256:	136AD613EE1DA3520BC980CC8376ABD3CF1DDDB886CF89EAF37820CA051711AB
SHA-512:	6AB34809CE532C1B80E4EDB57199B9D52342E57D70F7100009EF665E7DB94E624AF75E5A42F8538C11252CC2706CDAE7408B96750F868975351C74EB461EF5B0
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8.c.Qo.....e.....0...fS......#...0.&^ .....e..ox....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	7.768607620960592
Encrypted:	false
SSDEEP:	24:wOYGdFyuEjWuyrmqcVN+IsKtXFEh0rf/16oY9O:wPGdFyRByyqyp1A0rfgoX
MD5:	AD90F84252C4CE1022D07572F86A7E0D
SHA1:	A06FE370E19EA27A17786603A1B5506BCDD55A2F
SHA-256:	801F226A88B19D9C40712A99E834659A238FBD4A474F9D1B35A2E025DBE182D3
SHA-512:	46D51ABFE4EB0E75861456BD78F20F8A870E3B5131CB9F3F73F07C64813915534AE946F964F79586319150A66328F7500348FBAEB1A1FECEBFF1DFFD510EB355
Malicious:	false
Preview:	.PNG........IHDR................a....zTXtRaw profile type exif..x..[..(.E.5....x.......{......&91..e!...C..;..KL.d].>yop.d.d....gc.}=...FN...H.........`.\|..S(.N\..0</.+........Li.............6 .....ISV.{......3......Sy.;:.w.;Fw.3y..6.d.R.w1Zrvwr=..{j..o^`...:...{o.........V....,....~..0[B..b.....Z!N,.cg.3wn./\.&..H....A......].&...\|..).r..s.4.+..reh... ...#.'.0..H]f..X./.Y.7..q...p_1u3...)o......a..`6.nbs\|.-...z.X2...P....k;8...l<.c.&..f.1.O..V6.`.2u.Q...e..9...8..(-...k......u.`#r(;u..s...]r...y..5*..6..C.1...F.].1..S.I.....S..SJ9c.....34r.d..nn.[..\.>..W\|.%.Tr........jn.J.6.\|.-..rG.u..{...j..-5.#.../j...z.J....&x..7...X..0. .e03...An03Ip(....... ........+.........@..r4.-r?.=.V.....4N........<.I..}.y...1.mCm+=z?_.<U..9......zm.]....P...~.OF.f.+.p.4#..A...X..;.$..K;...t..W...~....nh&.6...,....M.\.~.?...O.........X.c[L........C..`o..w....x..So4......."..)..n=.w.R9.h%_......Y.~...s...}H..l2......)...;..{..>:.....f..?....`.7."....F...z.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_black.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1165
Entropy (8bit):	7.727326607321678
Encrypted:	false
SSDEEP:	24:gapNQa0sZ9I5+qfRURRVB+79HtxQ385X30tw7NEl2ghlXNRclo:XpGa0098+0uRV4dYG3iw2dRN
MD5:	24D9DDFFD5FFE3B9138803374C7CCBB2
SHA1:	2A3140530E691100CE2C4BA1E25659246FB1620F
SHA-256:	5116E2B71DB89596185178A75BC7A41FAFDE22E80C26658ECD104CBBDF444F2E
SHA-512:	0CDADAF705ACF24A5DB1DB6CB7E9E2E6BF84078178C641DDFCCCC05A8F26C5A6D21913D93D3CC02E8B595AA76BB5C384349C1B13C196240750F58548065F4BE5
Malicious:	false
Preview:	.PNG........IHDR................a....zTXtRaw profile type exif..x..ar.(...s.=.%!...`f..{.}..i.6..vv.L,,c..H....ws......bH!,.\|.3:q.]...}>,G.N.....@....9>C....O.z.wV..8..ix\.=.....!.]O...]...3.\..i.......{.7!Yp......;a."2.]..>..;.....K.<.r....9 \b4.....n.J..\|."...!v........H.7.u,e.0pE(e\|...?E.FKh.K, VAsE+..1...S.L..!..L.....\X...q......I..$.O.5......B..+a$..u...}.\|...Z.K..3V.....4:.~.(..6c.#....y.\|.+ .#......X.n.%..`...-{i..i.!.o.d...@..h1f#B.#.d.......\....8..o\|c4......A.h.d..^.?.#r(..w...4j..$..!..}..&.M-.Y.d9J.Qc..cL1'N.-LSH.RL).....3.......~.5...5.. }./ZB..K.r........7.J..t..mqK[n.&.7m.Y.-.\|R.T...sj4.ub~...5........@.=..u.Hh..H.s'...Q..F..T..@.o...dw#...S..7.....~....&.Gn.P.y.(2..*.1].ac.-f...I.....T....M.^.@B..C%..m...g.?-....#C.L.K:4rhtJ....+CH...&q'./L.j.6.>x....v?..p...'.o..{.....g}@.Q......Yk....t...(\|54\|c..{..T.^.\.H...s...S.i..g.q5.....~.d..h..R.[.)..j..m..Q......z......E...>J.Z(./S.?8E^LM.$...=...t^p..t$m....bKGD.o....jJ\.....p

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_blue.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1350
Entropy (8bit):	7.784674532586953
Encrypted:	false
SSDEEP:	24:pYxqxiVbzXh6sPYxbi7NXJ8il3BUdC1APYJm826NE/nQ30egauSTbVSZrfdaVna:WQ09XYbXil3BUDYA8NCnQEU3bVqrT
MD5:	51B332E0DB5D97A37F3551A09E38F165
SHA1:	060FAD711EEF395A2E16A6F35A6389A4E7928B7E
SHA-256:	DE8800E0C867436A7626B1AC6EBDEB6D0CD799DE0E4C0E6D7BBD8802B8B7D1A1
SHA-512:	23F7005A8292E2FB8A65FE69DBA36CED39281FB37818A84FADACE15DDCA2374B9DDA9853293380896C40C4B33BF367732CD7351DCCE1B302C64AD115D7487064
Malicious:	false
Preview:	.PNG........IHDR................a...2zTXtRaw profile type exif..x..m..(.....{.$.!..1T.....b....$.........L..;....`.C..ct............n.9.&..@..u......6!.%..).e.!...?.+...eHe.y.S^...:./u.]...}B0..{$MY..6V../..qe(9.9.UT....]..].\Yr...rq)..-9.;.^..=.s.o........w..+>"R..K..r...!.3..-..0NG.h.W. ...V.3......;...\.&..H.=d.I.T.`..q..YwR...j..\..n>.lXygh... ...#.;.2..H]fgW.........B.@....#.G./y.U..G../X.6Ml.o...g.^p..,.N.2..a..g..]d...%..8...x..e...Av..6..pL..... S... .FM@.........!.J..)..C..r(Q..!...J..SH1.d).bj.EKf..d.-,..e.9..E.L....(e.M7..-ni.-o."}......\....(.=.v..^.7.R.-..R..[......cO.z...~..w.~O...A..z.F..N.<..0...x..4. .e0s... 7...-J.....g.A..}c../v7r..F...M~E...O...n........'...F...:......q&.....@.V.wu1.....Z...]....'zzV.Q..L....'D.....{.fn..."...Y.G=..s...N.zx.s%.<.....8.......T.>...R...}.\|....2...X.[..Y.2{-...d F8.....~%....z....4..u7.@~E..r9.....C.{...0..u:..`.+.]..... o9.......\|.I...J.U..f..6u..u...g.Ln...:,S.8..._.'X.*'v.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_brown.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1307
Entropy (8bit):	7.802302601611676
Encrypted:	false
SSDEEP:	24:6YN8DFVmCI5+A4iCQZBUFbAGguEsqSjPg968px6dVxJcrfv28HiS6b0D:L2DFgCI5N4NvFchspjPg8ex6d3Ci8RoK
MD5:	DCE39BCD07536E0CD28D93CBB701BD32
SHA1:	239A845FEB34E3466B5A6506202813273316A87C
SHA-256:	553DCF32F103A252C69DF865D2FA99F0E321C606446439B499D55241144E021C
SHA-512:	82EBE18DBB9EE9591BBD5EEF20A55F0A4EE3F8B5568D912D10A1683573759E3CABA965B02FEA568EA4155E8456DB57DA7D3213FA516F8A5ED564669B2929D921
Malicious:	false
Preview:	.PNG........IHDR................a....zTXtRaw profile type exif..x..[..(.E..E..I<.p0.....~o0q.'9}..S1......6.......X.\|.B.8\r.3.....d.<..{1........._...g.........XV.]...<..3.{...Hx..6i.......v.?_..dT.x...X.u."./...L#."....=.9.S...;.._.SalX..)G.O..c.>S..\|.G.c....^...?]v...f=..Q....R).....l.M...hnh.P"F.;9...S.}..%:n..3...S........:GIR.(..P...X..y...b.J..`..C3...#P.C.DV.\a]<4.e.r.Q.B}.....fntco.....f..f..!6OWm..,..3v.5(...)........@.)....yT..X9.....{.d:...Q.s.Hs,{..(-..%H..$.....Ot..e/...}..O>.....B..F.(.E.C.Qc.YE.z..U5iN..%...I.R...f..;cD..o...oa..ni...)...J,ZR..T..5.h..Ts..)5.\|.-6m....u...z..S...E......L...A..q.J.../!h..?...;..8.@.<.Y%.x...lb...A...Si..A.}.....woq.W..@..rf.[...=.V..Qd..o......M3k.{.{}.4...V.].?.Z@..{oL%.4......7o8z.....#Y3/\q1e?....4.......fO..`&.R....dQ.K..k]..G.7..r.......b.......n.&5_Q!.n.2x[G'.ec>..g:...C7a....F......H....L...^.C..PF.4.7K.....0.e<...T.n.+O.K<(..T.......].9.x..\...N..\|.N..NJ+.........~~..'u.U.1......-.;

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_cyan.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.777602243841018
Encrypted:	false
SSDEEP:	24:dUYdlOtOamBjQTNpbMKG4yRMIWbEvSOEJP9LD4aMSMBucGO8Vnbz:TdwtO5BqjG4yRMISEvSHx8aMSMBTb8Vf
MD5:	CF4BCF1097DC8A00763085DFF5395307
SHA1:	55186CC60959027550B866A544BF03FA1FC05627
SHA-256:	E91B346AD4F7C14933141A3EFB2426152D695ADE4C29415429BDB6E7E70CADD5
SHA-512:	B83923AFD730DD360FA29AB643C341E9CEED61D18D168EACBB55D0C8E6FC2D6FA9A4CEC6A2B96BCC07C555BE5F5EF1B44C1A4D2A692E6EA2B090C5A416954547
Malicious:	false
Preview:	.PNG........IHDR................a...7zTXtRaw profile type exif..x..mv.(.....Y.....`>........M{.i....S,..I.....p..b...M.s..W.!sA..y..\|X...o.O....cH .\|.}./....)....Ku........y.....]...a;..u.....C.3.B....$.w....+..u'L."g.. .....}p..{./{\>....'....q.q...Gj..?...k./.......]....no........ZDK.).i..f.b.....Zu....A......Tab.......1..+....F..diN.\|..$r.Bk..dX..f2A.$....._i..1f..y.\|..xF...............>...V@P....,.8U.J...Y0O}p.L.Jm+.......r .I."....G....Y.. @........c<..;..\V>.QZ.B%J..,..BP.O......FMj..D.!j.1.Y.J.....R..S1.`j..e+....i.9.l9.R.h...f.r.!G8.G:..G......XS..ki.!.[l.5k..N...C..{..s/..6d..#.4l.Q.j..gj.@...hS......0..M..r....q .O....'3o..Or....P.5....$......._.9.Oq.?.s..o.s..&...7.ZY'.,@3..O...6L.V..<...#.....I...)S....%X..a:.....~:..I....TbrV!O.b..w....~. s.q5...Qx...h...g..'_....,x#.`......~....'.....l...M..??.....LG..3>...1..4w...../..8z...7S..N..yL.g.Ow.....Bf.<19EA..nf=...=.oq..'./5a..U[.......}\...z..jt..1.>L.J..#.M.....b.*.r....!e/.\

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_gray.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1198
Entropy (8bit):	7.755542936480761
Encrypted:	false
SSDEEP:	24:dYNS5fJMKRW4QpuCh9tJKSB1GYQcN3qeUAsSjYIJmd:68mKR2kChhKPxcKAsPd
MD5:	1FE0FD83DCA45EBA901CCD253A7909ED
SHA1:	8DB0F32D6CEDB8BDBA782C9018187F2D8B24361B
SHA-256:	B3DD147D0318392D606C5AC5131660F14838B8A6A72CC890F703D631B98BD41F
SHA-512:	357919CD641C05F7F725BA6A7CFCC322E171BE0D1480CE4C587A1B942C6F5B3779E09A9EFE6E41CE457221A7AEF187CFB15C768FA8B3781F5B94C76E21C0EA12
Malicious:	false
Preview:	.PNG........IHDR................a....zTXtRaw profile type exif..x..a.. ...s.=.....h\|oo.._4&m.vf.i\|..* ..........St.EcH!8.\|.....G..}>.}p#...2.[..cX..lr.,P?....L=q.C.[..9/NEL...3..........v??{.`T1}L@+#;..n..O6..;.$.\|H..?....S...)v.O9..\...)FS.r..a...v.7_d9L....[[..e.,R......M\,.<..kj......E.b1b.h...`B.h7.X1c.u.....i%.....Yd.D...{.F.+p4.........4...f...$4e..].G.w.........2........2 .fLe.w4...w.....0G.`v.b......l..yp..@.S...l.9cy...d..N......O6.=-F.E."4c...N.n..(..$........jh.g..X....CYX<.H..(Ir.....4.....hP.Is....5.bN..J....RL).lF...:...Zx.,a.%.i...."%.-...+U.v.k..5.T....WY.k\...Z....Z>.M....D.kj8.ub~...5.........y4...XBSg."zO.\g....2j(.N.N....I........_.F..AG..r..Mr...P.y.Qx....q..f..)..Nz.o..16...z{.iZ................+?.=....!.0C.2....(.J.L....>...EWnh.#.tF.....W..".a...)..:..?N!...W....^?{p:\|?%......hO..l.?+..6.c.Q..y.=.$.....>..tVk....<......^..OJ\|..}..qM}RR.3.<R.]M}.C.P.......}.. ..3E$..M1...w~\.2...w.H./..?....w=..I.....bKGD

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_green.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.794785969309991
Encrypted:	false
SSDEEP:	24:WYsMvSHVXfvXF0bu8Oc3y9x9xnhSDL8QzIQQKWYTZkdVUyTgF11:nsMMku8Oci9x9xnhS38Q8uJkoyTgv1
MD5:	7C11C717604B1461D077D529E050D2F9
SHA1:	564BDF5BCE3A10B779BF9B8638C56AD3092F81CA
SHA-256:	0DA3D60547036F2327F895C1257405883DB69FC3D68FFCB61F29C35BBA41970D
SHA-512:	96AE6483D5730F4B56E1CF274453E0B1692FAFD1D1514904005C2624889EBB63E5DA40997809B1EDDF8B2CD13C351D53EE94130A655E0186F477188920C4A899
Malicious:	false
Preview:	.PNG........IHDR................a...+zTXtRaw profile type exif..x.WY..8..g...!...........j.3.J...L..\.........k...}...r.%..D..E.y.........B$...}...r.n.n.{9....m.O..q..^...9.gJ{_v7..?.l......FU..K....=.Sd}2dv..JF..I_.N.!x'..;..\.CA.o....-g}..y.}D.r....8.x.].5....e..)O....29(....m.+...\.+.....@...-...q.....\t...jm.2eQ.M. .,n,.6H.J..F.j..=}.yn....8.24-....i.W.O.i.....&..._v.4...;.....S..n....+@Pg.#^0.c.8...%.g...Gf..... D8[.....,.M.60#...dxn.......L..x...8.{.O].v..Z.....h.d..".......T.k.I...z..=...h.!..R.Q...}.1..s.I..4..(.R.84.t......{...=...x.#..OqE./..J..JE.W_..XS..R.....bK-w.Z..v.C.=.\|..Q.G.....5......W. ..b.G;......x.. ....Dv....f&Y..Z..:..<.......'vW.......r4....h@..{....j..E&@..GL.t46(..m.c&.G.o..Ga....b.K^...,..k...N...n\q......S.!.>/v..W)..a.p...6.....C.u.[.q. .....g.U]A.H....LJ....l...f.6R.......)R.IE./~..!....~X$'....Bs...L...p.>..T.Ew..O%u-... ,&.qh.Zs.Y;-..G.\|..B..3H...:%i..4........0..v..ig....AJ.c.^.k..b..N!.tZ...C

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_light_blue.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1355
Entropy (8bit):	7.799469396451825
Encrypted:	false
SSDEEP:	24:dYqqKJspK4J4/1btc5+YHZdD6pt+VqI5yaf/v7ofks9+FzdvYy:6vKqpKDZYHZxggrp3Yy
MD5:	940B6346459F818BD74854BBA82EACC1
SHA1:	94063353C19FCC656EA3F14DB4FDBBC8A9DF6113
SHA-256:	610AAED10BB908CB713E8C63779657EC8D2556DC11DCD7D23A5373124D72BBEC
SHA-512:	9E30B9E94FF41D5860564B2F787565EE85A8349A5D61908ACC21F7AA89F4AB24F4F553CEB5846A6DE91D6588BDECEE819874B99C6E00A87D8C47CC16FC6F5C44
Malicious:	false
Preview:	.PNG........IHDR................a...6zTXtRaw profile type exif..x.WY....g...$1..`.s.....2..U.J.91.,..W.........A..QC...r.%...k.d...{.n..\|.P.zY..m......n.[..e...N..1..nG.KO..=.....?...v~.."......7!...E./C..N0."....cgN...S....[(... .a.....rN...]f.y..9..v.W..e..T0{Q..L.....9,.E.<.8[BS,....6..b(...N.e..f_. D.#z..2u....@.F..Q.T#.&.X......i.WH1s%X2....g.w.....DVO.....A...q.....1..........0.'..f{,...kn..Y`.3vm..u;.D..#..#.H<...9..G.?...8>..y.L.7"..(..1&.e.K..."....&I.Y.y.Ot...^.3...W.\|..\.!..F..Q..>.......:..4.j.8.J.O!E.4..3&.p.1:."..9..p.C.t..)...J,ZR..Tl..j4Uk..QC5.\|.-6m..\..].=....O.6.....s_.F.....v....1^\.('~p........$4...s<...........AN....t..w:..2.%o.o..1g.u.....m..y{.Z..D.I...S+....M3k.g......{6N.0....bi... ....8...W.......}7....gH.ZZLS>Zt=..5o....+(.7.........y...6m...f....C..t.. ........U.Ozii...m.....X.\PJ..d./.fh..5.Q!..m.l'..}..K*..K..1.[.t..CW.5.O..E.1......T.....95tFq..8.E.a.u..s..z..cwD...a......Ej.NR..U.7QZ..xY..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_lime.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1355
Entropy (8bit):	7.786509313901603
Encrypted:	false
SSDEEP:	24:hAUY4pmJ0rCDOr/zEMXygPCR1/Zu5O90dDE7o6R2zqPt9MeT5+55m+oqJGaN:jYw1v/dXygPCPh4O9N7o6R2zqPtJ055T
MD5:	E059D3BB871D6D6F3C0CA6ECE594D144
SHA1:	F6A126A8ADAFE53CF99A8DA8C38897D89299E67C
SHA-256:	3DB79FA51910CEFA7077DD0324F3643F2346D65C94654245FF1AC427B2B29276
SHA-512:	E970763473B77414836705049E7E1153F63FEDB9D84B3D12C4CAC9AC53FDABA651DB4529377DCA3E17350FA901A4E17BF096DF3CFD0D0EA01CCA53CC827A1FE1
Malicious:	false
Preview:	.PNG........IHDR................a...:zTXtRaw profile type exif..x..V[..(..g...$!...<...f.sx.I'.N..~.)...$t.M..O7..b..q..O.[\.....h.z.n>..^....\`.....o[?C...........m.N...y..^.......^v7..7.mv.....dT.=a.MH,.qx.ug.x>.JVd..S%}.;s..w..rg...T.........t...]<.X..`o....^c.m..;.Ly.7u...A.@e..I..#...Z.....@.@+..1...Q.L.......q@.\X.,J.......s.$.H.>....\|.B.o...Ex..M&...>4..'.4..(]"..\!..5.0.r..-.B}.Tg~g37uco.. .3.....X&..km..Y.......... E...u..z.%O60.".1....Y..@.T....F.....7..4uYy.A-.B.K.4I2.rNQ?.E.PVQgT.k.I...z.......4..B.).(.E.>..c.9q.P.&..I1..3.f..x;C#..9..?...t..).h.%.XR..T...k05.Ts..Rj.i.-..R.........cO=..mT?.Fw.}..m..bn.+j..p1A.Nt`.........4..l$.x 70..q(.......@...F..N..}..Q..n..93......F...OP.y~Qd.4N....b.B..c....>.:...V:GlyL.J].v..=[.3...}..~.S.5T.SM...bu>..CIC.o.d~..}L..X1../.........\|....+...Q.fz.&..._"b?W2.V......C.3.:......w.P.04=.'......Uh.k9.6i~..5&#z........nH......!9#+.X.....d....(../.P.....1.J.\.qS._...\.../~+...x.F.J..f.......jA.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_magenta.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	7.784207203697019
Encrypted:	false
SSDEEP:	24:C/c2ZBFnJnrhAFaZygcOYHxn43hYOjFFHB47psjW9tSlXkNpEEB9tTPPKtbUKG9:mhHFBFASyggRnsTh/Wi2pH7tjiUZ9
MD5:	23A8745FD5A29C7A517B10445AFEA2A2
SHA1:	CB5607125790FA0B918179E61A1D2DC38712BC08
SHA-256:	DE8BE5E5D576F680D59F4159B99D0E78B929D2EE17C2EB9D409F198FDCBB6C7A
SHA-512:	A426C6F9B0424BFCFEB19F68A84E25EAFB09BCD40874A2BF9C666D25326F267F1762A600F5C378EE03079A464464F8DE341199E443E42068BCB34E4AE8297F66
Malicious:	false
Preview:	.PNG........IHDR................a...GzTXtRaw profile type exif..x..or.(..s.=....q0.f..{.}..i..M.wg..`Y..~.8...w7..`...1..,..\|.A....d.<..{......9.n..m.g.....%...F...!:.....c...2.x..6i=....Y?...2~...`T.=..#gq.....2.g..un.=...3....st...K..CalX....%'.......w7z=]<...{o..e...`.K..2GP..J7..h..`..%..W, VAsC+..1...S.L.....L.scE.\.MYt...>..F..%W...S@.A..\h.M._......c..C3...P.#u.l<c.y..iLc..gh....S...\|......A.a.x.l...&t.-79;....AZ.......A^{...P ..J.8F..9;.....W2.l....y..3JS..w1.......Mr................%I... !..c....hP.Ist.G.!j.1.89,a.BR.bJ)g8.0..t.F..on.la.-ni...S\|....XR...(.....k..QC*5...-..rG.u.}.....S.'.E...].}M...A.O=.Q.X.0Ac9........ .....F.....&FQ....Si..A.....F.KnF....g..@.'..n.{...Z.sGq....S.:.6(..9.'........3h.K.{..w<fP....}o^U\|...\..q.%w/....C.bD.9h.q..f.mo^U\|.S.2.ZS.H......;%Qwy...........=..K.J...9!,l.fB.....K_.F>...f.7j.3......Xr.iy.Z..Yf.r.9..z.=3.=..w[.r+..W..<).Y5..(.Oy...t!...........hN.a...Q..,~......]..o...2..E...n.....L^..J

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_orange.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1350
Entropy (8bit):	7.797122940761736
Encrypted:	false
SSDEEP:	24:amOqMNqKWt4zgc4Dqn4YoXpeytPR/CtDVTCRGbW2rv8yNr/mEs7OwlsBAf3SaJk:dLOqhtUgb1XpeipqvCReW41uEar+BA+
MD5:	BEB0660CDD7FEABBF12595F781C3AE5C
SHA1:	87BB8350BAD2E213493F878E03B97BF15BCBD5C7
SHA-256:	584772C7A6FA7C87AAF0730D214120D567381F21B0E4D1338557B267E3F5A77F
SHA-512:	D4A3AA452840ACF1D0A8D3CC9F89D95B900FF577B95395783F0AA58B8B4C6A52B828FC01F1C7555A188D71E94C09E8D558312B006B87F97B6FBDCAE6974F0087
Malicious:	false
Preview:	.PNG........IHDR................a.../zTXtRaw profile type exif..x..Yv.*...YE/.I.a9....]~.`...JU%y....Y.@..m.......m..i.>yoq...gt...%..}.......C$he....3.zy!.%.n.&.e'.Ct........2$..i.MZ.ew..uqYf......FU..6..........;A.....y.........K...0./....%'.......o..P...U.z......;.Hy..u,e...!.2_....v..g....U..p.C.....R.Nm.....q@.\X.,J....F.qR. I...>...b>.B.o...Ex..M&..D?..3.w..P.#u.l<c.y..iLc..wh....S.....{.V@Pg.#......%..@O.3v....2....b2.kG.(y..9.!..\|2f..x..R.J........7..4uYy........4I2`9..."r(..3..5h..w^.........4..B.).(.E.>..c.9q..0M>..bJ)g8.0..v.F..o..M7..-ni...S\..K(...+W.....`j...F...\..[h...;r.Kw]...z>.-.......hQ......j..p..QNt0.1v..a.@B.`f#9..`f.cS(...Si..A.....B.KnF.[...93...93.-r..}B...E..h...S+....-f.y\|..k;....d....}.1.n.xk..I....>m.........4.....".\.Rt...Pr..$........]..0.........._Z.:.i....:.._....6T.cF.\.! ...\.O\.......%p...n.....N....I..m.......1..d.7........7..<H.c./...}.D...a.s..a(..P.e>.......!T...sL..../.CoX..9.....^...{..Kr3..GW.N.o.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_pink.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	7.771753734873728
Encrypted:	false
SSDEEP:	24:/OYkZnF4cm3wqJkoRB9LCcX1D2/oNCDGH+bFDMW7c2b4vHrZ5lwG:HkZF493hRB9LCcX1Ko8yH+bFb9SHNbwG
MD5:	7FF1A27B5DA354B26809893EE66BAFD9
SHA1:	8B85AB9794433477EC6C0C0A3B711CA964181060
SHA-256:	79B321E7FADE5BC4C6A06617D3ED5D7A568169AC7B02A5AB3A18E2E168CB8CB3
SHA-512:	9CF15B8026EC40778A579A367A6ECBAAB5CC2657CC000C95CAB4656B66719EDBFB3296C2C52C1657FCDD2DD62CC5B7EE7542FF572D8E0941F9D18C47C4BFE204
Malicious:	false
Preview:	.PNG........IHDR................a....zTXtRaw profile type exif..x.Vm..(...S.....8..S.7..o..g...M2/T,,.I.....o.........r..?.}..Ir.......wNn.t=...R../...},.~.[=..../..#./.....z^....?mg.........(F3.S!...F.=..:.W..S.s..hx\;..w.fw.se......2.w5Zz.;.^a...3..V.._j.{K......T...s+s.....,`D...8G.H.b.b.hn..8...=7..y..rE.^v.."Ut.F.R..(>.w....& Q..B-W.<....rB.......A....Q...].B^28.4.r..+..}..f}.O.q..U h....,n;\l.......'w...m9@....x...V....Df.1....E.l@..1u`...N...k"O[19.h-..4h.4Y........8TL.....,[..\|..B..G...G.!.b.%i..RH1..S..-.r.r.9......V.X.....l.[...RA...PcM5..i..o.Ej..Vv.A...=.i.{..Z....cO=.r..P.E..{../..b~......t........g ... ...\b.e 70sYp(L......@.....:_.} ..72..n..r4.....n!......2.(:...p..iGc.....2.I..^r8..6.-....2....s.CI.......S.+......+(0n@h...\......).b...%.L.j.9w.%I...8...E.3..5..d.._$.....F..x1....Hz.)[......MB.$o..K.OU\...t.Ai..bz..7{<q.?..VH9..3..:k.u......L.....}>.i>c..Khl;<......#..}n..5'm...f.........3.E..._!.$......n....bk

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_purple.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	7.773339682891305
Encrypted:	false
SSDEEP:	24:U3kFqWRaJXbtSy24gUgyMl2eXn2oP8NjIaBOhasOUv2Y2bkewWaVd:f/RaLtSf74yEi+O2Y2b4WaVd
MD5:	434B84A2EE32CAF59A879C12E2BD2F34
SHA1:	8D8C610DE2A73C5DCBD334C6A75DCBAB43442284
SHA-256:	194BAF13E7CBE7896826C0383487363A151C9313F7ADDCB7A654DF169E061C91
SHA-512:	6BB501BF102E1439770A1A8CBDBA310B06696A611615A0906BADBA326B89D89354F45CE961E6A8CF40076BC2EF9408AA53A0679F8E16845E529FA63C98B46C5E
Malicious:	false
Preview:	.PNG........IHDR................a....zTXtRaw profile type exif..x..Wm..(...)..H.$..1T..............T...,.I.'.....v....1...RN...9d..._...y...6.....C$.e=......m..-?..N.c..]..%...o=.......{^...\..m..9(.8#..;nB.q..E.@..NP."s.p.....5\|...=`...=.....0.r..r...#k7.w/:].>`..i.......Jn/.9...(eNKh._.Xg.h.%V0v....:..@.S...uj..T.b.....L..r.....h.Y%....O.k.1_......J..'A........L..v..}.....+..#...`n..B.oL..w6..o.;b.....a.......-.d.,.>8......"....y...$..yeV".h. r.......$...H.9..7.(M]...(- "J..5Y...!".4.r.D....S.h1.$..SJ.F.**.4jRU...EK.f..d...s...K.......4J9..#..H..v.T.O.5.T.Z..\|....S.ig>K..Tj...6k...\..C.=u..s/.k..{.._.F...X.z....7.4.I...1...u0.....7...s.3..."2X.8.9i0..C#......%o...x.1..u.`...6s.y......E&Ac..L.t.6(4+le.I...1.\|....H!Rd..Um..`..0.qv..w_U...._..\..x..uN;....3+u.....{.D(#..Q[!........O...x.9Y.X.T[ ....~.....{v..SW......h.(.h.C..6~v..E..[.....l.....J..R.:...U.gX(..W...D.....kG...Y.02okv....^J.....I.=..m~..c...p.A.z...+..K}J`.9..c..R........S\|..6..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_red.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	7.802167763288701
Encrypted:	false
SSDEEP:	24:vY4Y8dMPQXk1N5PE1E2akcuFtjZEojR3ryrNYKZAf8qd:Q4YM9UP4aWhjF++l
MD5:	2BD10550D7B42E4AB842196A78DF5843
SHA1:	E0A140A7BFDDDE6D5C72DB0F688940A546841789
SHA-256:	624A86821D75BD941FB50113F23D4E84349BAB402A88BD6AD577528AD4EDBDB2
SHA-512:	58B514F2920EBD8F2CF02F4577A9FEBC08DF570CF313108E594BB18AC26031ECBEF119C43860A8FB53895E8CFBF14E9C7138989875E97359BFBEF941416419C6
Malicious:	false
Preview:	.PNG........IHDR................a....zTXtRaw profile type exif..x.Wm..(...)..HB...........y/y35I.T.V..VK"q.........\PK1..q..2.,.?.s&..}?....]_0D.Y...~.\..,l..].n;i....dz...!.SN..../..?\..m..9.......w!..E.O.....E.:...~.......V...e..{(..[!>.h.I..r..G.n..}....)vc.4F?...HE._..k......-b.>....1.^....6...(.#..54...R.....3seY.$.+.....&Y...~X....B.o^.%xn.M&...>....q..c...OW...gN..dn..Bh.....K../.......,.8M.J...@O}p.,.... D......#.R$o.F.8&.S..%...H....nD".I<}c...e.S..."T....R@V......CEE.S..I..(1D.1Z.=..X0.hf..$)$M1YJ)..9.Z....s..N.L....(..C.p...;..R.>5T..ZM5..IC.....r+.:R...=v..^.rm..CG.6..\.mV..F....5.M...;k...L.l':9.c....d...3.(...M.\|f..2X#..4.....u.......4.....97....I.f..Xke.(...U8c.e..A....3.y...>.w.4.A).T.Z.R....Kf..8~.3.k..)go.Ld...,i..e.6.?U\|....PC.hA.<...y..Vsz.{.O>.xP4..~.\|.GOC.......v..^...t......3....N2.Txmv.n..$.u..>.....v.RG.kx.N.*...p....'}8.......4..<k.y.{+.`n...{....%.g..f..........2<.F.<....W.{.&.S....{<.b.....2.W7...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_silver.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	7.779899658961933
Encrypted:	false
SSDEEP:	24:UYm9xI12WAW9eirf0Ut6MGVynoF3m1s02hhoL/d9Xa4YbNf3ATlT5Pv3:pmY2WAyr0ULGInoFMshho3XAfATBRv3
MD5:	6B9F1415570D2941F5231B4CDB74EE4E
SHA1:	2E014668A900AA3E54F75AE65403A673B80928D5
SHA-256:	2DDAB235E33C0EA13BAC6151F4D260EA87E271521E5ED100FD3775AEED5FCCBB
SHA-512:	5711181BA2D86BFC6F98F94C171C9A791273F55246064B69ED62E3A5D90A50D5BB79592A4F86ACB2967F0DD884DE13D105E3A78F7CDCBDDBA8B1E7C42BBE5D9B
Malicious:	false
Preview:	.PNG........IHDR................a....zTXtRaw profile type exif..x.W[..:..g....B...u...]..l.I..$.N.&.@.(..._.?.8gG.b.9...g..@In.6.....v..N....B....._`......tk.8..4...^/.>...R..<.)........<`....G....TH.eu...E.O.M.;......4<....x.v..+... ..C8.h..Nv=...=.....u_..jjm.vW\|@...M.[Y58....Z.............U.9a....n.r...g....E"..,..F.2..^\|,n.5k%M.g.k......7..fN.\......-zd..:.Z....Q+.%...Fg....B....Z.u.U.+b...Z...7m...t.Y.g..F.c..(.b..A_{v..8.."..uL. sQ/..`3.L........;.W_1..8Z@..C#..Z@.....>....y2.`.e+A...B...Q%j..b.1..cI.\|..RL).T.d..f9.H9.KA....<J.d..O6.)Ni.S..>..m.s...R.j...P#.Ts-./h../..%.i.Ki..7k..Zn.`m.z....{....:c~....`.q..~.X....g0.;.hh...Kg.s.`(L..['.rg........].{.....7y..u...u..s..=`....EW.....:m8.."....d+aW....<...uI.L.L....K....7.>x!V.U...s.r._&rHz'...i..b......._.D..........3fe...K......=(..M..X.$rH.1./}...`t...pr...g[.....E..Rmc...O.}..t...w%.C.....m.....~...B.....&r7?...x...6.%..7.RB...J......]'R*o#.4...cI..T.@....P....7..d.?.5._...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_white.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1217
Entropy (8bit):	7.765969067241352
Encrypted:	false
SSDEEP:	24:HYUT8ccgQDvYtZtRmOkzaV45jmrjjibAZJnjk8T8JUyfGFtWVzsnQBcB2MaVGlj0:4UT8ccgQDatAL2ecjj/ZpI8TRMGF4sQl
MD5:	7DDD15B6B3AE20D60FC95DD9F28B9ABF
SHA1:	E459AD1CE5254865087EB55F68479ED0BD534881
SHA-256:	DD0B8456E4407C59F197B0BE3F73466EE7ECBE0640F4485DCEE6AF669BAB5B51
SHA-512:	876239373609C3FA11514F38319B43E743BEF81D79CD869329141B3F8A22BF2F03B361D8A794CCD4FE2B4DCB33F805D06D35B5CDD210554CBD9180DDE88F2BF1
Malicious:	false
Preview:	.PNG........IHDR................a....zTXtRaw profile type exif..x..Qv....Y.,.I..r..s......7q.N...Y.%.'.....u.....\PK1..q..2..._.KO>...W.N.......el.@...XX..^.l_~.rD..y.<.e..#.....n..~./....:..Q....7!.8..E.....3..LYqf..s...C:.....T8..A<.h.IOz9...5..M...r.{M....J..TtkR.L...R).f.)d.-.%Lq.......(.#..U..~..C....3.,S..8...$a4.l..:I ...@..Xh..3.N..+......O.=R...G...%.......1.An.a. .WNu.w6wS7......4'L....bS..-...v..AV.......A]...%M..1.....`.,.7. U..:.D.I<b...i...5...P.b@...V.....PCEE.S..I..(1D.1Z.{T1.`j..e+IRH.b..RN%s.la.c6.S...-p].t.E).o..M........].......U....\M5....Zh.b..Zn......n=...AmQ..F'r_S.Em....>.AmvuAc;....8... .....'......g.P.5.... ....k...../.9.?.........@..}...Z-."..X.#.^:66..T8..N.Y.^.......t..-.^..+.Z.u..tj..w......<@H.U.xMS.a.B....[l.'....g<_9...G.xyB../j.KG.j.;%..QC..P#.........v.^j..U..K...`..\O......+.'..#...h.....W...4.C...W...Z.......)..b.q.~.......Tw.....:.....P.7...9.r...{.>...36.3..........o.s.Yw\|......;

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_cross_yellow.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1349
Entropy (8bit):	7.7921899902776515
Encrypted:	false
SSDEEP:	24:EY2XkId2D5ezHCjKeoBR9G/ywzwnsFeFq574VomBbO4zCmi2Lu:5xIq0iEZjcFeA4HBbOmj/C
MD5:	3AAC8D90DCA7AAC1F48D4CF135AEB4B4
SHA1:	7CA3C01D36AFCA382CDAF251A86EEF29ED5B1ED3
SHA-256:	9621DF85FD1B4AD9EFE757D9322E083FD0F45DE01D11407015128B0A11B773BA
SHA-512:	CFA892078B27814FA3812460CF82B279C0D3C5857DBDC36DC1A2C3588E9B97C41037C60E46BF1453C44A41532FD94091FED20C8393B14B6C450E9445351DB343
Malicious:	false
Preview:	.PNG........IHDR................a...5zTXtRaw profile type exif..x.V[v....f..!...a.;...a..tz..c.e........:..eM0.4D..7.\r.f4.Y..../.l......$.e..c.......S..O..r</..G{....e..Ni...f9..u.....]..M.O,.CX..qD.ug..\|2:...V<E.......j.ag..{(.....a..wv...{....>.~.x....{?...@..^..^NZ..2.y..[...$..%V0..fA..-...q...+WL......V+..%.d+.`q.p.A.4..~X..b.....f.......e8..>.....r9.}H....+...Mc....D/..}c...Y.F7.X..:a.X`6e.(.o.....Gfm..m;.D....t..xH.=.`m`....d.......mL..x...1.g_.v..Z@....j.d..B?.Eh(..#U..4j...;....G..A...\|.!..r..F.C.1.l..0M>.J1..3.f.....#.b..W...J,....TW...j...f.4l..[..[j...R:..?...t...u.k.=..S..k......s.Y...`..~.5.C8].H':8.c.1........Ld..`npf..P..X.9..c`..l.....sOy#u....9....s4...=...k-..E&Ac..L.t$6t8b.1.3...^.j.J....N....w.p..)....'..5....._..c.p...-j...e.....7.y@.z......4.2i..[.f..\|.6...)....l...X.<{.z..v.._..j.Oj9.jR.8W.Az.S..(.r..^G../.F.iskJ8;...D.r.'._.t.B...Y..g....nvm..l.....-....^.....K...k.2.?G]..E.&....epq..{.m_a...k.;.H#.L#.;i..{&.Z

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	117
Entropy (8bit):	5.487318886248967
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lSAW5YyR8tDTi7UL1c4UKdWHnO/kup:6v/lhPcR4wUK4UnHnjup
MD5:	37DF96AFA4E902F62A8580CD1FBA6334
SHA1:	59B6F5BB75CB629245727A034A769F43EF6763DE
SHA-256:	ED69DC989E06CCC8B88146CE829801C41BA34D4DA8CBD50EE37B592CEE393BD9
SHA-512:	E5583F9619390D7B2317689AC8236E818B3BE01E43ED4D53173BA4BA89D4A86D406C0CBCA1282988A109B167D5986739A98D6E02C3FFB496BA5C067D5B219E57
Malicious:	false
Preview:	.PNG........IHDR................a...<IDATx.c`.............. .6_.M.......b.@...0..``..x/...88.@.....v....0....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_black.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	114
Entropy (8bit):	5.330029158862505
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3ld7ExGNLv5tpUkFyR1pXSl/lB1p:6v/lhPtJhwMgwtljp
MD5:	54F89DBFE19E5AA937709C93CD3575DD
SHA1:	B0536D74823834110C06BAD1F7333AA5824EC590
SHA-256:	69C870DCF258CF38C9C5074FCE0D7F0D50B57C52A176734505ADBE32DC3CB705
SHA-512:	E57DFF68B6C03CB502F6BC669347547E4E902AD588D5834C31EACDA3AFF079D21D380F01D6F0306B6861FC7765A92616C9731EFCE18F4C16B35FCAF654BB77BC
Malicious:	false
Preview:	.PNG........IHDR................a...9IDATx.c`..$%%.IHH<c ..........\..L.. W.\..\0......AJ..^....%.Nn.7....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_blue.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	120
Entropy (8bit):	5.5125296578380905
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lhkxkGTbWTQpwKhi1EQJF4p3/9j/vaWAW1p:6v/lhPRUTBMECFkFj/tp
MD5:	5D1519950086FBC9B82AE59E57F8EBCB
SHA1:	100508AA354E404F308EB93509D2322046C0CA0C
SHA-256:	FC7FACF745B2CD5DBDCF45BC5E001C8F725E37986FB893A1D73A4D6F9E24E1BF
SHA-512:	B7B4769A52E0696D64251A54AEF7AC330D2EB713D1FD29B1029B45823145F3AE6A48165D2D79E225114C97BDA9407F6549CC2D64090E02129B526BF8E7F343FC
Malicious:	false
Preview:	.PNG........IHDR................a...?IDATx.c`...\|6>3.\...\.2@.})e.P...f....b....5`.0.R......Z......Avse.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_brown.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	119
Entropy (8bit):	5.535016397760644
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l5eAYVjEU5pUkFyR1vqAvxC/bp:6v/lhPLsEMgWp
MD5:	0BEC38ECD95EF63F30AF3BBE8ACA1D80
SHA1:	670013C96652EA081DEFFAAEA7CDC29CE5411F9E
SHA-256:	0593BD7434B5B935CE5553FBAC1D5C61E8E80DE448946208CD3BC6E56AB9874B
SHA-512:	F414B71EEAD7CC324C90A385982B19EC6BCAE082352287FAFCFA692A00171CEB452925B9954A99D2CFE9D8D5D9D63CAC4CF9CEA136850E3232B2E2090724DF98
Malicious:	false
Preview:	.PNG........IHDR................a...>IDATx.c`..R}..%z.<c ....s....\..L.. W.\..\0......AJ..^H.2.k..%.8AqTg.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_cyan.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	119
Entropy (8bit):	5.511315068997008
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l5eoXpwlSkq0tWgHm9VT8Tg1BVp:6v/lhPKzq0tnH0TzVp
MD5:	B9453505307AEF33183210298F170ABD
SHA1:	695E09644274AC96EC08C13694B1FFF0991D61FD
SHA-256:	16231ACD2EE9B158298D87912F72CB4B49F2FA07FDB0375B955CF8F1665DFD24
SHA-512:	E883A5AD4B1CAB5545F0A5893ECDBAEF3877CCF7111EC51B1B2865BB58EEEDA2725F57F2430D9F3742DB229B723CD7294B3DF5A7D4AA0B8A5D2A7FC59F41F28A
Malicious:	false
Preview:	.PNG........IHDR................a...>IDATx.c`..\|.g<..\.2....2.(r.H3...\1pa.r...0.^..)qpx..f.^....G.E.=....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_gray.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	119
Entropy (8bit):	5.511866082616413
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l5eWRyzVULv5tpUkFyR1vBFxTBjp:6v/lhPDUyhwMgZTpp
MD5:	37E8D72230B478BE3E0AA3A939ABCE4A
SHA1:	EA64B56CB37D4C6F283F91B1D43E7D09D8BF9827
SHA-256:	15CA80D3ED449EC6D6ADA0D9EE9D842304785CE8796CD2A4BB7D7433B6D9B487
SHA-512:	54E2D99418AE8B1E345B10033A6F558B454885E93221F90CC0C33A5EB60BF1DD09E675A61DD524C7600FB73095673534BF16DE89D2D94121453122D0A15028CB
Malicious:	false
Preview:	.PNG........IHDR................a...>IDATx.c`..\|\|\|.yzz>c ...pww....\..L.. W.\..\0......AJ..^....k.._.8`.'......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_green.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	119
Entropy (8bit):	5.591780158283026
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l5eAOD8IyB8n3pUkFyR1vOKXQbhlsup:6v/lhPL4yQqMgWDsup
MD5:	AAA0715D6DC7D5D9FDF28244C83D7D90
SHA1:	C2C23864B2405147F5E2974CB4508AEE6C82BB49
SHA-256:	578F59519229F5834086CB60FCAD76D428F92086B2AC704CD1F07DCA2A911F25
SHA-512:	779D0C751263FB23F3F84D95F6204BBB98F543AA5CC1C0FC958D6CC371D53F7CB39E6364D165B02D1452310A9900105F79EFA0C12A3185430F4F2A221F241B44
Malicious:	false
Preview:	.PNG........IHDR................a...>IDATx.c`..R.%V.<c ....+....\..L.. W.\..\0......AJ..^H.1.k...u>j...t....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_light_blue.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	120
Entropy (8bit):	5.653789277970935
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lhkxkAC542lMpB8uRJkSVtysEzdXbp:6v/lhPRm128BZqSVtysExXbp
MD5:	35EDFA4E3126D0BE0D27C961DF28BA0E
SHA1:	38C8706AA76165554C200A01E2B12BBD8661B3CE
SHA-256:	6315DCA8278D48D5D220D3DED835F735F2241950519F15F35EAE217EF0908DBD
SHA-512:	1E461EB91DA6D0577278D87AE65954E66A3EDFD1C349637F5107A286437414CBA695907182AE9A6109DB6FA95A2025C79FF80BC5793E4C9973FC2DB7859CDCE9
Malicious:	false
Preview:	.PNG........IHDR................a...?IDATx.c`..Rg\..8..3.r.......@..@.)6...........0H.....S..5..l.Ux..P$....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_lime.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	119
Entropy (8bit):	5.568653582399329
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l5eUw/n+QJF4p3/XDKwwztVp:6v/lhPFdCFkvDKwstVp
MD5:	227FBCD6DFB0C6F7A22A5C3632FE5562
SHA1:	9ED8B804450C4BAC312F2EE72AEB102EB5E62D89
SHA-256:	D2C2CA123203A6D631C039D5192C786C18E06BB3444408A18524C3AB2163CE96
SHA-512:	FA82A07ED59E96B248FED8E6444D46CF057FB313ACE3100DFDDB55B63E289499B82CE17B1D6D8F33B1341C96D4D093AE55678A646ED8C3F1AAC3A3E51EC0CCE0
Malicious:	false
Preview:	.PNG........IHDR................a...>IDATx.c`...OK>.:,.\.2.l.8e.P...f....b....5`.0.R...B.1.....)G.^......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_magenta.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	120
Entropy (8bit):	5.601583757083515
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lhkxkLdPiH22JltTwH9gEHyznl7wbtsup:6v/lhPRHPiH2ultTwdgEHymbdp
MD5:	90732C6689D3C07182F045197CF6F807
SHA1:	BED0A6569BD7FB92647FCF566335A572749C1783
SHA-256:	6F15E858211514044A90D52C9F2A895D7C3F1A816501AAA656611EDFB903639F
SHA-512:	CE8415E332BE082E50AC1630A8820CE9A695497C038480F56BE1B3248A8DB3B4D59C3D50E0C53918347951ED52F9220F0258C744DEA485B97E0028B0C6C208E0
Malicious:	false
Preview:	.PNG........IHDR................a...?IDATx.c`..6.\.....3.r....')3."..4Sl...... ......a......z].k..u.Ux.`4o....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_orange.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	120
Entropy (8bit):	5.47511111620748
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lhkxkCjGBbjT+QJF4p3/as/Y6NO/lsg1p:6v/lhPRgybWCFkyr64dp
MD5:	5A8B3FF444533A6C453A4F421AE33F63
SHA1:	84ACC570DD4389BAAC30E64897AEA4A4F658E423
SHA-256:	09B15047B4E70D36C12059E4672039B43970BA29DCD8BAF59A5C2BE3C12CB6F5
SHA-512:	F4880A6710067FEEC7021B40C03702C0D27058C3B370B80F52173D6BF202276B50C9EC0684141033611B540EC1AB58A3FE0ED21AF69513215FC96475FE107742
Malicious:	false
Preview:	.PNG........IHDR................a...?IDATx.c`.....=;_e...\.2.d.>e.P...f....b....5`.0.R.....C......LC.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_pink.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	120
Entropy (8bit):	5.60787448626821
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lhkxk6XqMHRJltTwH9gEHyB3w7Bleup:6v/lhPRIXqMHvltTwdgEHyB3UKup
MD5:	36BDA507A882C1A77F9F74A49F142235
SHA1:	5D448EAC52FEE4C27AC4A726E5F868FE87F36A71
SHA-256:	42336B58BCAE96E4459A39FEB440166404CB9E41EE59564FD0A9E4C3B65E00AD
SHA-512:	082250977CD20BC2279FF947270E05E7E77F1A8A0CDECE6E0B664F7131123C612D4B5213BE66D3A1DC3D3D8FCAB83576EBDD2337BD2DBC8C08F91BC4FA3EBC34
Malicious:	false
Preview:	.PNG........IHDR................a...?IDATx.c`..>./}..j.3.r...e.(3."..4Sl...... ......a.....^.,.k..R.]B.p4$....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_purple.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	120
Entropy (8bit):	5.54177778287415
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lhkxkZoQKTT7EQJF4p3/lxzVtlB1p:6v/lhPRjgzECFknVp
MD5:	52B9989138B7601351B25FA7E0F74E76
SHA1:	458BF1DDA627B64076B6B71C06ECD7E7ECB1D6A9
SHA-256:	A874DEFE348A097AF15AE1677B7123EB6DD4501FE6607C442607D3A8677E9343
SHA-512:	909EB3832A3CEA5FE839A3B0DDECDE1253BF494A533DE91E847A6278A5E847037B29508DF3E9A3191146D8E178947886C429219777D27A5F685C71500B45C842
Malicious:	false
Preview:	.PNG........IHDR................a...?IDATx.c`....7>..]...\.2..z)e.P...f....b....5`.0.R...B..Z......I7c..~....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_red.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	119
Entropy (8bit):	5.5049714765418525
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l5eE0hsfgHm9VGtG5oaYtlsup:6v/lhP1LIH0IuoaYtVp
MD5:	090D9B2A2507B8389858A6AA1155EF2B
SHA1:	4D1E9DCE9F24FB8C3D402910CDBCE84AAF007AFC
SHA-256:	678140F3D76A408F431B65FDB985CE2594DC10669F50829287002B8FF8D56D8F
SHA-512:	E8EAF20759C8EA90BF9266AA99C36FCD8B47801038EB1FFC06865B13B623D04B355CAE4A6FB821ED612EE2D60208FCCE3E78BE5FE2FD91938BC678DC51732F0E
Malicious:	false
Preview:	.PNG........IHDR................a...>IDATx.c`..f..=.d`...\.2.O_.2.(r.H3...\1pa.r...0.^..)qpxa..!^..\M;M...G....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_silver.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	120
Entropy (8bit):	5.576746673822297
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lhkxkQ9PUMlHylQJltTwH9gEHy18nCLXB1p:6v/lhPRa9PnWcltTwdgEHy18OXjp
MD5:	23309726E3A0872619989535F526D22E
SHA1:	BDE1458EC28FA44230166797C30E8FA9343AE6F8
SHA-256:	3B99A406433DAD805FC62C2704B52E0A033939BE52B8D05C5466B8CE7169538C
SHA-512:	6E8A1D3375ED623213F0FDCD91B27D1159889D01279218C0B07684CB6A7FCF27530FC3E38155B461A8D2F3DF5B8A92B7C67FC6A6E61D2EBFFCEC2F804D848988
Malicious:	false
Preview:	.PNG........IHDR................a...?IDATx.c`..f..l.I.... ....(3."..4Sl...... ......a......L.....}VS..y......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_white.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	121
Entropy (8bit):	5.548480076116509
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l2yxdRmQOFMbYu7i1c4UKdrGJZbokl2g1p:6v/lhPjFu9K4U6Grokbp
MD5:	CF614DCBF216B5066A269FDBE205C396
SHA1:	E55FD0AB7B736B00422EB0B999A10407CA210B6A
SHA-256:	08520AEDF945012DF41EDE10E831A9F6C0173DBF06281E28AB2DCF83013296C2
SHA-512:	3093BC45EFEACDF3DE4DE5EB97F161FB9AD668BDCE28D7FB0EC83302F633613F87145F5805776C6186CB81BD30A87957AD3DFFE8C4B4E4756C03C4827CFD71DD
Malicious:	false
Preview:	.PNG........IHDR................a...@IDAT8.c`......../.... ..}K.......b.@...0..``..x/...88...........y..[.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pane_top_yellow.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	120
Entropy (8bit):	5.6412078196015445
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lhkxkYUJZQMhR2JltTwH9gEHyit/3+j3Ell2up:6v/lhPRibMHultTwdgEHyilGEllVp
MD5:	5884C8F931119EA6FAAEE502CE615FA0
SHA1:	544A375EA7433BB8A2FC7139896CA2F35DCDDF4F
SHA-256:	C93FB666579B43CAC1A1B7125B5E8BEBA993641DC1EDA1A61081D160C7ADC6CA
SHA-512:	B765F9C0C52A2E6F9B943362B87E0203EEC00F817A30E03A1B16C100B82ECBC9436D725CE3A8B8EC87661754F287A3A3A0596BD67109B56C87342F91CC8539DE
Malicious:	false
Preview:	.PNG........IHDR................a...?IDATx.c`...<1zv...3.r...W.)3."..4Sl...... ......a.......7.k...mZ.[.R.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_pink.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.435770578046889
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1yxduqLTAVmAx5tJZV7A/1p:6v/lhPF+uqAV3/DZBAdp
MD5:	91154E8676DCCC5443876D5744DD9784
SHA1:	A98D4D648F2B71A46D6C0C1786E455F109680D73
SHA-256:	F0EC69C010C1483EDE08E4F97366F265E4955907F74B7DF8EBB3F3C94B01D025
SHA-512:	149488DF8682C1639EE50778B95B652EDA9DD5B014CDE33D81BFA10AEB217A46D2C7BD00CCEE4920FC1C32B03D3D9F212521A3516E2FC66146FEF559B6667EE9
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8.c.T.t1%...H#.c5`6%.......Q.F...)1`6M.@6..0L.t.+......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_purple.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.454396366067745
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1yxduaVZv1VbqH8B2cgOnPl8JOZ/2g1p:6v/lhPF+uqv1V2H8BvTPl7B2up
MD5:	FBA4BC5E72F5A49BE76010E99DDB547E
SHA1:	2E340E868D46AA9BBC6E589350B6E59E7C69B48F
SHA-256:	DA79FB23035869E65EBDDF329C2F05B49217C30F6BF68D69E6488B2CA7630734
SHA-512:	70C40444DC5B56647953AD856B6DD0FDAFEF15717E1F5176C841363E845544BF00A10C7914DF11479E2BA8E5FA17ED68BCA4EC76CA0E21C132F1D8B15B44B23E
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8.c.......e.....0...fS......#...0.&^ ....~.ei.I.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_red.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.503878559443561
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1yxdu3NRJjGBGZCD7EHC77lVp:6v/lhPF+udrjGiAI87lVp
MD5:	A6A90AE6C72AF972145347D687B87F7A
SHA1:	4A52E7311E6D29BBEEB41AE0B6A49897621DFFB5
SHA-256:	70066502228F5E5D7295F46488E9FF4290B7AA4DDA917A9686E43279CE1087C7
SHA-512:	482E9899CB14E87D0882996EB3E54F754BD4441CDBB3A0CB5647A99AB81F0E9C6B69AAED4449794CABB8526DFEB92EFCA2A8EB6591CAB2C27AF8F5DBB044A851
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8.c.il\|....e4.........P.5....#.5....&^ ...Q..0g..H....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_silver.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.438267394145857
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1yxdunda/voMQPJOkPxM/jp:6v/lhPF+udDMnkPxsp
MD5:	1F06147828382713415AC4565B63D937
SHA1:	B9AC57CDC5E3B9F456524629EA2029D9A4B6645D
SHA-256:	BE543D3AD17A329C69B7496BB45AB5EE34D6CB174B35A50C72A871DC45CAF1E8
SHA-512:	BCE140E6A3049CA67A4295AC0DCC6CD0D634252ABA21A1FF930197E89DCA637598A65E4468B778828BF7281AC75BF9AFA469E60739E9371AB7CC2AF40D669326
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8.c.9s.bJ0...F&.j.lJ..M..fS.......fSb.l.x.l..\.@t.<j.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_white.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.400531545089253
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1yxduBhJj/voMQPJOI2yM8up:6v/lhPF+uDJkMndyMTp
MD5:	5428DA58F255FDFE8F93B226E18EF3DB
SHA1:	6E48053958F6A00B96B482D9C09CE7771F014920
SHA-256:	696D5D7F921D0E39889C3E051E2CB9B1E740CBF9C1468AB8FF31BDE854721693
SHA-512:	7B3A54803E648D7B0E3293A810B7FD2BAB6BAE1DE0B40D6C93EAC0A6713D49EB25FC8D6C74A463878102C0239ABBD875B631F131CA88713824BFC5AD61C03C8A
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8.c....bJ0...F&.j.lJ..M..fS.......fSb.l.x.l...Gr..7.i....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glass_yellow.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.3909131487811965
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1yxduEwAG1/TAVmAx5tJZYqBG2mVp:6v/lhPF+uEKkV3/DZYwap
MD5:	3399011568CDB61317CC68158933D1A8
SHA1:	F1B5A10E55BA14DA8A141D815AAB2BF724BD976A
SHA-256:	3ED8187F87A5725F1AE3052B38248AA16DDF9AF11AFD6760BEB51C357C36CAE9
SHA-512:	8DD7F51A31DE2AABA25699B9D977609090B75C4F03B3686EB12BFDBA036A4CA286FD2B35021BDFD0EE4CFF00BF15362D5951A87AC98978998FB6693258353E5A
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8.cx..x1%...H#.c5`6%.......Q.F...)1`6M.@6....rtc.R.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\glowstone.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	312
Entropy (8bit):	6.998622150243524
Encrypted:	false
SSDEEP:	6:6v/lhPR3k6UzhOV4qk3Qx5VqTABdhagoZ5AC9qerCRa8/JE9p:6v/7Z3xV41TABPvM5vHrCQYW
MD5:	4DD0501FAFCDE2A88D07ECA9A37B5A96
SHA1:	D653B3C6D3C3EA464A007913260753D5434E9B17
SHA-256:	AC425EE99B1D2C5002DDBD4B8AF57BF76A44488FCBA01C07C4C7A2CA3A058178
SHA-512:	537937B87C93EAEC66C1D18DA5349BF85000B6B5FE5BA6BC70E6B71EC4412D53B22189D796327FD4AB9BDFE996B10CBD333168CD386002BAF0EC7AAD504086E5
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.m....@....<(..@....-.....>(.G...^&keN+.........%.}..~..i......k*.}...5...>C....]M..........o.Lq.....@...%.`.%N...P.^5......Rb.d@.5....U8-......2Q.7.M%.}......l..+..U.X1]F`......>X...............}A..A.~..UN.=+...K.,.....F...]b....jN...dn....e.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\gold_block.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	389
Entropy (8bit):	6.816739778543424
Encrypted:	false
SSDEEP:	12:6v/78/kFeDihJj5/pNs5619S6Nc1zZJE8XWfLL:XCJFhNtJNc19JEbv
MD5:	179B1A07CC6ADD2907CC8168B5BC407C
SHA1:	8119D034172A7745ED2A1E7017FDD22B1E710FA4
SHA-256:	59CDBC1B7774C8D82CDCEE2931AC31B7CDAEEA8A7C1DB11167D321F212B7D37F
SHA-512:	CD1D9F25485499BEB58D5D94EF01F12781508443AC75349468882F1BF19EEEA94721BB75AFC69DCA9BB01B11373A2520A255F1EEDA00777E623DFB0622514699
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J.....IDAT8Oc\|7S.?......P.....H......~.....b`...~....l..._..........p6...`.6g`bu.kfS......f..?oOBE....4\3.}.T...4.Z..l....~".......@. M`.j,`.........d.`>.........t..... .2..e .....8....m........ ;.....7...F.....d.@i..WP"..`..h....,.4./..*...\|%...-`<Y ..3..e@I.....[...\|0.%O.......\|.G......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\gold_ore.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3192
Entropy (8bit):	7.901535967049587
Encrypted:	false
SSDEEP:	48:gldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OSqPiWnxpQ:gXHt+JcNgOSiS4XsAYNpf2ESNdjWnE
MD5:	70FE9744289AF36C26ECE0A537AE636E
SHA1:	DAD4ABF3F66614E561145224997EDACD39EBF195
SHA-256:	5871387C9F5E9964ECA7E076876811B6831F10EADFC2208500A61EE9A2298931
SHA-512:	8E1DBBAB533C0C12D1372EBA6DD95CA3234B04EBABB6C208354C2B39DD5615FA33A5D50980A4C33D8EEFA9E60F500587B3178F325D06E9CF6A1A6D710ABB273D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\grass_side.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1823
Entropy (8bit):	6.702518851425704
Encrypted:	false
SSDEEP:	48:nTX/6TKsGkZvrM8hEnY//MdmvhwN8ogJEDa:nTXS7GkFM8h5/MdGw+ZJEa
MD5:	859D29EED57A7FB25CE49F0A22EEBE32
SHA1:	0FFC1CADC9368C4EA72D6989336779B59CE43AA5
SHA-256:	512189FD0E48BBF361D2379719741E7811E5E99F1B112CDE451838B2C12FC7ED
SHA-512:	E43432C7DCF32CC17C12BF3084C065C9E997B8C732BEC2C5111DCD9B72767F1358DE9409E5141F443A0DA25877725B9A681184683B288F9ACFEFDD100341A4C8
Malicious:	false
Preview:	.PNG........IHDR...............h6....gAMA......a.....pHYs................$iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:xmp="http://ns.adobe.com/xap/1.0/">. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:Compression>5</tiff:Compression>. <tiff:XResolution>72</tiff:XResolution>. <tiff:Orientation>1</tiff:Orientation>. <tiff:YResolution>72</tiff:YResolution>. <exif:PixelXDimension>16</exif:PixelXDimension>. <exif:ColorSpace>1</exif:ColorSpace>. <exif:PixelYDimension>16</exif:PixelYDimension>. <dc:subject>. <rdf:Bag/>. </dc:subject>. <xmp:ModifyDate>2016:01:10 1

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\grass_side_overlay.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1439
Entropy (8bit):	6.2854944579125664
Encrypted:	false
SSDEEP:	24:u1Q/W7UylmlgsIkn7DWINemKeAowsbBmYC+GIc6ONX+9NF7P8YH1h:0fFsIknXWXmo7ymYCduzJP8YVh
MD5:	B6B127EF2DA73EA2D9E3FDBD08B639CA
SHA1:	260984629282712927CD63978CEB597C57BDC47F
SHA-256:	67D7F942038BD8DFB8A0404C6EA1484D81E73B6650DF672C6B56CFFC25CF469F
SHA-512:	81F3C93867233C5BE223FB96BFC608F4AD37AA94F80BCB5200F16CC9D5925191EC3890EAF0792F103ED9BFB186D0612BA69A90C6C700A9CB613FE37869ABC9EC
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........+.....$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>..<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">.. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">.. <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmp="http://ns.adobe.com/xap/1.0/">.. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>.. <tiff:Compression>5</tiff:Compression>.. <tiff:XResolution>96</tiff:XResolution>.. <tiff:Orientation>1</tiff:Orientation>.. <tiff:YResolution>96</tiff:YResolution>.. <exif:PixelXDimension>16</exif:PixelXDimension>.. <exif:ColorSpace>1</exif:ColorSpace>.. <exif:PixelYDimension>16</exif:PixelYDimension>.. <dc:subject>.. <rdf:Bag />.. </dc:subject>.. <xmp:ModifyDate>2016:01:10 17:01:

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\grass_side_snowed.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1769
Entropy (8bit):	6.601905749832114
Encrypted:	false
SSDEEP:	24:nTX/6ZYWuqylxilgswBkBDv/QNKM7exKwrbknY/+0fcEltoa7TlJNDgwQyKJ3SGI:nTX/6TKsGkZvrM8hEnY/WcVD+v3SGI
MD5:	0D65B75E17F3AD7E4E97EC269E11BADB
SHA1:	3A960FE5EA6E455DA4B1F64E5B6A3130A53561C4
SHA-256:	C7AABA2BF5E615E23986AEAB2945370B713FFDD46B2045B98560A2BDD5FE70EE
SHA-512:	F2A6F1806593BEE7754E5215319848B2B59D457F66057AFC3CEB70B415D97589C6883745B57B92462CB6B9A183FDB1F08E36A46F9139DB691F6AFC602F937A93
Malicious:	false
Preview:	.PNG........IHDR...............h6....gAMA......a.....pHYs................$iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:xmp="http://ns.adobe.com/xap/1.0/">. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:Compression>5</tiff:Compression>. <tiff:XResolution>72</tiff:XResolution>. <tiff:Orientation>1</tiff:Orientation>. <tiff:YResolution>72</tiff:YResolution>. <exif:PixelXDimension>16</exif:PixelXDimension>. <exif:ColorSpace>1</exif:ColorSpace>. <exif:PixelYDimension>16</exif:PixelYDimension>. <dc:subject>. <rdf:Bag/>. </dc:subject>. <xmp:ModifyDate>2016:01:10 1

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\grass_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1577
Entropy (8bit):	6.519434639213823
Encrypted:	false
SSDEEP:	24:nTn/611Q/W7UylmlgsIkn7DWINeMKeAKwsbBmYC+GIc1ONXKK9IfIt1On5:nTn/6bfFsIknXWXMohymYCkCfx5
MD5:	79CA227D9D38122FAA9A3E99E9269245
SHA1:	BFDBB823B5EA21660A26B895334515DAF8F8EBB5
SHA-256:	59439262D895041153E376C9A3DA647A084B91BCB97B8740523144CC818DC5B1
SHA-512:	3B7D4B045925C7D7D258BCBB7668656D2B7C979F5B1756F4637E6475A83DC63AC0A79C40AF166772ECE77CCF5CCC5511472B660DEA462CB151D34C290817F00C
Malicious:	false
Preview:	.PNG........IHDR...............h6....sRGB.........gAMA......a.....pHYs................$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>..<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">.. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">.. <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmp="http://ns.adobe.com/xap/1.0/">.. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>.. <tiff:Compression>5</tiff:Compression>.. <tiff:XResolution>72</tiff:XResolution>.. <tiff:Orientation>1</tiff:Orientation>.. <tiff:YResolution>72</tiff:YResolution>.. <exif:PixelXDimension>16</exif:PixelXDimension>.. <exif:ColorSpace>1</exif:ColorSpace>.. <exif:PixelYDimension>16</exif:PixelYDimension>.. <dc:subject>.. <rdf:Bag />.. </dc:subject>.. <xmp:ModifyDate>2015:12:28 08:12:

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\gravel.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	565
Entropy (8bit):	7.517701689718849
Encrypted:	false
SSDEEP:	12:6v/7ts6JmPN1N1Q5X/4xipXjFWZ0hhdtkq0D/AarddgzRId:Y9Js+XU8nATzgOd
MD5:	A783D35CF167C37222A026413F228837
SHA1:	7FFDEDA69C5871CC6ECE219C1FF94DECAFD1FA54
SHA-256:	2782A623826FF86E8B683B2C460C5456850236AB3034F9E0251BDD45940BDC72
SHA-512:	54E8BF1077270FEA1B7AC2315E447DD019CC2775768D25EA1603F8DCB04D3B72B2E7D8E2F9DAC4AA58879C3F8CEDFE005DE5B16BF1323651B6E4A0884C6DF261
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.U..n.0..?...D. ....tp..]..E."k.)/.5.bx.3...+..&Mb......!...?.........[.@..!...>.......hc.kq..~<<0N..s..F.%U..<\|....3HC.<.v..k..P.<...Vz.6...l.Ty2.....T...MYF..tdzMx@.C+.b-+.d...Z..Ty.)..j."0.`....22.&U....9D..y......^.>....7M.\..&V.Wg&m.......5.a.6..m.....92..M......i...m..4g.S.q.Q...&.@...J... U....].[.3..Z.ZZ.;.).r~._...\/q.....Kh.8.....L.y?.Y.M.^3H..7......z..2.Rh......Eha...hm\|9U...J>.......b7....*.J/i...x...&...t......kg.!.............A.5.V....4.o5y...s..(qS..2....U?.24....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	638
Entropy (8bit):	7.52853660625198
Encrypted:	false
SSDEEP:	12:6v/7uNpkjcbf9rY4hBU4jCXiWZdJk8SxCV7X5TZZ09YoC4NiNKqwY7Pg:nTJbf984hBpuyWZdJkc7pTw9U4NiUqg
MD5:	0A2349D149EB6AE0777863B99895B34A
SHA1:	F68724F8B1EF9E1CDD60393221933D15970A45CC
SHA-256:	59571280029B7E37812BCF72DF43BA245FE0A1E65AD07C3551E540CDE1F47549
SHA-512:	A6E271F1D15E1E693A3C7BABE9EBF48DABD549B5514E563374A1E363468B68740DAD1BEFCBA5834B77B854B043087BBC451BF3F047B6FCEAD30235F9D8DCEC9C
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME......,..h.....tEXtSoftware.paint.net 4.1.1c*.K....IDAT8O=...P...B.....g !7.....v...8....$a.G.k.Xu....^N.n-V..U..[.....W-}.........\|.....$d..8i...)....o...G......n..@Q-..?.f....:u,.~hg..]l.....f./nm?q.Pe......=..XY`... l....X....&.a.Qr..??.=w.7.k.y..@.H&Ee.o...n..w.k.....,...p.!X[y5..#I.1zF.N..C\|........Eji.H.a.".V@..}..t ..+X.<]..#7.9...H..B:rH;L..vbWH.)P..z....\| >.q..y.....U...%.......t."?..f..E..eq....SQ..g......]..1...e.P.................rK..bi,....@.4R...F.. .{.V.....=.8f.?.>=.I.....E6..\|......h.b....2.9>...UZ.W.v........$.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_black.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	457
Entropy (8bit):	7.293625795910239
Encrypted:	false
SSDEEP:	12:6v/7uNpktBJcbJ6ESwSItg/KpfKfBlj5S5F2NW:nTuBabnSwSItdpfKf35S5Ff
MD5:	D3D286EEEC84E970765F5B827541E721
SHA1:	D84F94B43B44BF82222B2B69D5C54B16F7A1598C
SHA-256:	4CAD6AE8DD2BD6546016A46F5D3AD487E6CAF3D6BE95978952B7B9EE974C62C2
SHA-512:	632D66DA815A21FD4D154F79332BFF49E543F4F45AC44468767B04E49FEC32DAC4EBECA1E2CE7AC4D211931B0360C3CC836A7D05234D25176453187422FE4B3A
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....--.._.....tEXtSoftware.paint.net 4.1.1c.K...DIDAT8OUR..0..;+4EkAW.X.....v.&.mb.Ix......Z8.....8J.....r..t..........%^{.6{./9......9".~-.F^+..,v.v.Xm"..<..x..Y...K..@.E....4..F......4..(...,0E#...C...Xq.{(...,...... ..wn...Qj3.....t...J%....Z.cM..8.!...;R....X.....1..I.....$0......bt/.Z.O..z.$....UA./......4..%.u0Q....r.Yx..wh.....k.A}.x..O................=.G.uc......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_blue.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.286484599434202
Encrypted:	false
SSDEEP:	12:6v/7uNpktt9fWZzzPO/BQivlVKyIeuIy5j9fcHJgZf6jzv:nTut0ZzZwr7IBI+9Upg4/
MD5:	4AD46A971D7572B7957F60AA0C50ED31
SHA1:	710DA21BB6EFC133D30DEC0A20B5D3E17071573D
SHA-256:	89C74924EC2E86A615E45327E03F3B40125682FA35B436F8C87303F587CC9936
SHA-512:	ABC70D791F2EF93B3621E640E1EC0893AE40C05FB525BEF7BFB98867BEF03D29EE2C866E117F68BE63FCF744445262FDC9503AB95D1BB42F1C55EB04FBF57A6B
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....0.C......tEXtSoftware.paint.net 4.0.21. i....iIDAT8OU..n.@.D..Hxds..........3...(.8.{l..N.....\|q..r.kq.{%...p..L.:w..C..0T....c...W......)./_}.....8.qH..(.....~j-Z..`......wB....h(96.4......2j...a.......I_e,.\|`!.%..`.if8..c......g.@.LZ._+.mh..o......Ii`....:l..b<.c....v8...h-.n..g.0w.m..S3\.I..Xa..6.N+.r....nj.aI.!..Vg.....M.K...s......\|*.:O_Qw.......g......W/..M?.M.\|.eDR...{C\........F.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_brown.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	500
Entropy (8bit):	7.3229800572944255
Encrypted:	false
SSDEEP:	12:6v/7uNpktF/G9cbCJyqrJAmiFlOle8fTidZFUSLI21:nTu8WbCwqr2m4O8Dt1
MD5:	3E10F4FEEA524404641A404360D17F79
SHA1:	456DFF5B621EDDA1582F2EAA737983ABB9051C18
SHA-256:	F6D5484A0DE6A078E82BEBE1F9A57981B9FD5158D846B9A27D3544D3CA1F364E
SHA-512:	CA0B3C7D87C2532416B6260586D58D05446814B793D0489ABFD7DF2410AFE7DD3EB0384AA207DE05C240FF3D7940D0DF3DF28E50E5BF5A17F67B1DC8B54EE6C8
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....+.........tEXtSoftware.paint.net 4.1.1c*.K...oIDAT8OUR[r.0..k...........@....2.l`.....I..<F.>].........<T../..(.HHX[.Gw .[._:..o.{,...dZ...^.Q...sS.K.`A8..[.[0.O..O!.lk...b..#hm%. .F,......}..Y..&}Fw..%..p..Y N.;..`..%.u.E.l..]y.....MO>.^......H.+.u.x..I.t.i...~..Hi..'.B.@..,=......D..d0.wtK....P..h.=<.=h........h.1Z..8.H..e....LlS]Q.K....{..9.:.?m.rD..O.....:k.....P.c..E.@.2.3..l...}...(...y......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_cyan.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	522
Entropy (8bit):	7.322254736169153
Encrypted:	false
SSDEEP:	12:6v/7uNpktN9cbJ08aLy4h20w9dhkPrlPoZd4mT4nyTvlTwxoRle:nTuNWbJ08a+C2J9dhQPo0mTm41Ayle
MD5:	F69D1C02AA58AA601F7542863FA8DB12
SHA1:	89FE25DD11DAF235681396B86EAD07237F4458DE
SHA-256:	A0A17516449B6A710234A11F8AEB6597A989C9F39F28D09D5A9CF30F14947C13
SHA-512:	E5F611494969E63624AA8390B385C1EDFAA4F35D23530B8E0F9C48F3B0230332AA821EB764BEAF92F70B5CFD59A52ADF3A1BDD3EC304BBEEEC09B0B754308559
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.......-.Z....tEXtSoftware.paint.net 4.1.1c.K....IDAT8OUR[r.0..d-!..w...!......vF...e;SX.9.....}..6..oq.....,.I8U...5..>L.9M...Z....G.EAH..t..,._..~~`^....iII....A.3.CT.N@;.......D.U.V.,..z..(.. ........B..".1........)....op..f...]0:%.6.........Q]k.....$`.\...E...L.M.~..o.....R.a6.p.A.`w....C.S...vR[;JF.4Xcm&8e.p..K.5......d..........F\|.c9..}W2....f.3....p.vG.w.E!.\|......Gn.......y>sf.........-..h\|\|h....2.=!.yY...)..............IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_gray.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	457
Entropy (8bit):	7.252362126468373
Encrypted:	false
SSDEEP:	12:6v/7uNpktZE64cbJP2CdzymM0Y08RIBM1M2BNc:nTuGabd2Czy70CaBMK/
MD5:	612BC48142C2D4225DEDA8CD3EFEC1E9
SHA1:	7FD024AD2A9951CD6B886CB7EBFE504014674CC4
SHA-256:	58EFE8944EA9515E281FE8449685B70EFC5AF8026AEA8978666D224DFF51C09C
SHA-512:	0E3B74A5C73738692EE51E9774BF8936D46B74E314D6A41CD0067ED4678A42681635EC35D42ED6159AA8E28639B20DC2F41B8D403204037B186A453688B2AC0E
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME........Q'....tEXtSoftware.paint.net 4.1.1c.K...DIDAT8OMR[.. ..s.dG......._k....b.....{..].+.+.x........B.Qp....Z.+.g..%...........`J...G..4..u..........PC-:H..}. T0......&.J..,...$....&.)..wO...AG..d&..[.6..@U..3_.6M..1...0.U./.d.x..].._..-.....IT.Ui..`......E.....\|#.[%=......4......+.%A.\t..{8..~..m.......kR?.o.......<&.~.>7.......*..Y.;..6.k.E/.o..)........^ .....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_green.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	513
Entropy (8bit):	7.314914463445196
Encrypted:	false
SSDEEP:	12:6v/7uNpktXcbRekrpAUM5Xyu7ac26y/keLfpZOtE0FhvwQ5c:nTusbYcEaZGeLr6xhIyc
MD5:	CDB62873D7523D416DC261A1D8B24EBB
SHA1:	40000FB573D6B4BF1632230A13B730CA5286C57E
SHA-256:	7D6B7F978DE7649D10DF65DC6D581C9276B1F7A0F4303601A23864438857A7A2
SHA-512:	5E4C0ED863D8B594F6250CAE01DC7FD19E879C8AFA926846A7BECBD1D0094AD65E1EC3EE7EAE2711F4689B9972239D8139CAA74F156FBE434B9ED9A4C8932397
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....+.%.1.....tEXtSoftware.paint.net 4.1.1c.K...\|IDAT8OE...@.D...}Qp.Y...G......=.....C'.D..U...N..'...H....AVaG%.>.\|......5>m..xw..^>..m.O.m .~.3.....n.x.K7eE}..:....>..\|..Y..f.b.OQ..u<,...%1.v.qJ.d.J...u....V.cV%.#..I...%(.g...`.....$........)./ `....X.b....". Z...y...Ul..@B......b..5g.QQ...J..ci.)....X.gqGmq#.)........rIb../.s.3.._..w.B.>..........H...B.._....8zh....C..2=6.3.,M. .nf..2.91^.t..mJ.u...k..........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_light_blue.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	488
Entropy (8bit):	7.321486527133557
Encrypted:	false
SSDEEP:	12:6v/7uNpktbUcbPXfjvhTMAWI83rFEhwTweHZ8IeGBieJ51:nTunbTpIf7COvHTeGnJH
MD5:	93F9D08C8F37903864A8F9425057BBBD
SHA1:	870675610A103FC6B02442EEE2AC3B09A1C78878
SHA-256:	805B1B5D7E0A2B3C4B257DB47789804DE39726ED487938B46D413892CD85EF3A
SHA-512:	820F7F02838638DAA7329D4BC1E59591CF585C1CA247CE4ADF5F499FD6BEB80D4AF685BB15796C7B851B8F0765274F253B40C4F67775420A3BD5574B98DE8C54
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....(0.u......tEXtSoftware.paint.net 4.1.1c.K...cIDAT8OE....0..=.......l;...T.=.~/..L.4.........).Sun...S....W.n..L.}.;~.....Ma..~.[...`..0CI\.^......s;E.M..(...,..?.,.g,k.....$D.d......#a....w....@.D..Y..1W....%9.. o.w)T3J%a...j.n..S..y...Jr)`....P.......x{.WS..9x...^6#et...............I.kp\|:g...K.....M..w]...8.....GG...C........#.8.U..i.9..y.p.k....b{h.....,.E..M.}.........nC.....S.r.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_lime.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	561
Entropy (8bit):	7.41082030579755
Encrypted:	false
SSDEEP:	12:6v/7uNpktITrEKpxq5YlFXfoDPPCnn/lxYD9Zu+zMJCVixNrGw:nTuITrEKpgMFQDPAPkZtINaw
MD5:	806BA5F21D8F431B9F9BA72CB6565374
SHA1:	0149BF62BE112D4E2A2B25D742377131EBAFF86A
SHA-256:	B41D4B5DA2456AA76352A17168ED8E2B0E06EE549E9CC7A0A593561257E96393
SHA-512:	5FCB1657E7AE5A51F54DE9A56FC3D2FC40665B6A5DC9289BC951685CE5D259C6D6FD84A9AE9F20A76035AE3D9CDBC536F100FFD6695BC04F8CEDC16AE34A7370
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....).........tEXtSoftware.paint.net 4.0.21. i.....IDAT8O=..N.@..y......V.AR......iKZb.m....f.I&....\|3]...\|=}-....e..6..6\n.\|.....buG,B...%......>.mT.Q3.....<...D!.;......u\|.$n....O.1..Z..j@....:.K.u}R.R..N...$...g.$..yy.W...<\2.8&."...~0.V6..]{.....<a ..8..].t....N.....;....u.T.....o.jE.$.....l.8..6.....\|s....*.H...X.d7..-...!p]..>j,.cV.fdPF7J[...[.b......N.R.#.jE......T.2..H...0>..m...._.K....5...4.:....sn.........1(..o@?5M....`iz\|.......S.....4/.?'...]......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_magenta.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	568
Entropy (8bit):	7.362274881639465
Encrypted:	false
SSDEEP:	12:6v/7uNpktoqcbI8miaxRNJ3jGQGG2aKpyhY:nTuGbI8YxNjG2KpyW
MD5:	8D80EA85E3BB60ECCE1E51588F5B0FDD
SHA1:	14F0F174E99B7FA390B9786796F94B4A894AFC9F
SHA-256:	154CC3A7A293029A7D0A983A7F5229FB0E024F4A90DF14AE5E1AB5947169896E
SHA-512:	978401A25987FAF1F1F455797DF2276E6DC5480D32702F52A9477AF7A73A584AE7742F39BC955CEED222107EEC2907A00524EBA546CDBF798C28A0A30BFE7DC4
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....(+<.......tEXtSoftware.paint.net 4.1.1c.K....IDAT8O=R[r.0..f.\|...@....'.9:M.#....v.....j.r..Yf...kuN.N....T.R.Y......1...=j?....cg\.mo.P..n.J..E.....v1._.w...[.K..id.e,.q.%.p.e._m.}y;.}....k_:.......n....X.:\.CG8TRg.../.HY.D#Z.....#.ix.@..Cr.C0...U....l..pc.@.T....gE.......<*P.1.[m..,..P...E8.(.eS.3.~.....41..1..b.,.[.w.;..0.....]....~....f....E..L .w0.2....%..rJj..6.;2.....;}C..x..;..KK.Z.[...e.<6._....'t.v.=.K\|-...(.....P...I.....?`.h.q.\i..mo.Z....FQ.nkI....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_orange.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	568
Entropy (8bit):	7.448049905205252
Encrypted:	false
SSDEEP:	12:6v/7uNpktw2zcb63qDotaYvEjT0tTuhTTVp0QV+9gId9yPrENNUll9W:nTuw1b66DZYvEn0tTuhlpoDngWNUllk
MD5:	8ECAECA3EE28F4F1CD51600D146EE80F
SHA1:	B2375BA2084551AE8A832038C39F2E6FAA8AEB58
SHA-256:	A8D1C0DB6F4796D9F0222031AFCC1665C0C0075DBC58F61E2F4E32A786AC0C6E
SHA-512:	8A7DAD5617AC4CBBCD42D7B2E7276BA9C3BF7C7E60A204D21B13F9AFF9F26516E0A2E2908CA4CC7C27B47BF5D0937CC1300149A24D7A81384274C12B7E6E2CAE
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....($...m....tEXtSoftware.paint.net 4.1.1c.K....IDAT8OM..N.0..{...R\..\....X...P..E.h#.Q..\|c+.+=E....7..7..f.@m.....5.....b...E...\..&.w..Z.r}T...P.Z...o.1Wp.]D.@:../..6.4...B...Ke...>.....y.....PhW.X..%...K6..&..-..?-.h...;.&.+i....U_.\..y..Z.iD....5.Y.U".k.\.E.CjH}..<.\|-K[&L...H......F..f....-i.u.B..../....D.b..O...pk3..!.1.....k...g.:...gWH......^..H8Sc.$.l..wH.c8.K.....s.,....Ys...L.\....Z...*......\|..Z.~..l.........q..Q.%..z?.(..K............O#.x ..)l....Y...'ub....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_pink.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	559
Entropy (8bit):	7.443741186936032
Encrypted:	false
SSDEEP:	12:6v/7uNpkt/9cbkcLM0m7qmZs1VXcZSx+ubmZNrnOI4xJHorCOIbDnX+Ki61:nTu/WbzLzuu+UbM5nOFxv/j
MD5:	868F2AB43907935E008CAF3C3EBEC5C9
SHA1:	7B52AAC20888FDA906CBC927D59720F60B2CF836
SHA-256:	79BC1FE119F55AE85C2FCD869BC5914B2C4C59B2D701983E8567BAE2CAC3E13A
SHA-512:	95E1D0C25748486D464F24689769B16D4C70C54C8073EA64B848C100E8AB6572EC15C3C9BEC4E77D64E1ACCA526EE820FA8836E4B378C57B18B3542D33C3E654
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....):O..O....tEXtSoftware.paint.net 4.1.1c.K....IDAT8O=.kn.0..s.X..?....p.')..,;Mo... .@ $.9..(}.T...U...x...R..p..E....@,..GJ? ....\.6;[.;R.c.O..@....u-....p..!l>l.....w..Nk..)..7#..>.....7.3..w..k..Ak..1Q.. .i.....(..QTf`D.=D.fcx...(../.I>..ci..0v...%....h>b._.....-.U@...1....n. ...#.y...Y..".#.Y}......*.2D..Nb ..._fXU'&8_./[........0.-.zVD.8....G...n.!.."i9.W_Ng..<.?.........BXu_.f.w.sNl..../s.y.~.9.. .'..r..F.....pwk.gi..h..^.L....r...[.n..{Uz...".,M&j......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_purple.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	562
Entropy (8bit):	7.458151875255164
Encrypted:	false
SSDEEP:	12:6v/7uNpktxBcb7iZXUap8N5CThEl8fpaJP++P26CJOs8D3i3lafQdGPkL:nTuxybOZXyNE1wWpxzy3jg9L
MD5:	C7ECFA1E29CC6764262F618CDDCEDF6E
SHA1:	FD7C53822FD5F97FFE30558B0CCF25F455E73F14
SHA-256:	0684FB492D5FAF69F87B57C3DA098C89600720DE299E74F69CA1DB430BD17653
SHA-512:	AA213FBCBDE28DD37D09F5553B3972FC72441D9C2E628D120CEA83AB5CECBBAB35E33FDAECA7060EDBBAB880AF3A72839A240174CB967D3E03C46295379BB2E1
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME......VN o....tEXtSoftware.paint.net 4.1.1c.K....IDAT8OER[n.0...@.U..g.....w....B.wf.....;.3...)..$..S.e._s}J...=%..=.1.[1..[...W.Z.[1l..k}o..5 .@...K1..E....^..2[8K.[..F......z......a/....Jb.....(....J..\|e..+.F0.....Q..`....wU......P...B#.0.)ly!....{i.0....L....vq...3T.........T.8#....v...y..]Ob...}.a.2....Ab.........qv....q.%..s,.[U.....6.....K..W....== ... ..)..?.;..!..7....%2....JM.~...Bog'I.:@...~...s..@.'\|-iw.:.zn..(.>.R....H.CL`h...Ln.<&.....Q..n....){....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_red.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	579
Entropy (8bit):	7.405206617997069
Encrypted:	false
SSDEEP:	12:6v/7uNpktHO9WctGUvj9JExIFJg5MqVHtihcClpXgg6gByDNz:nTuuUulbDgy2tohcABB6F
MD5:	F7BC45263E885CEC6CFDA9D75A5B3CB9
SHA1:	572619E6A9084B909A11CDD85B00F38F80C1ACB0
SHA-256:	1C902BF069E23BA5658A50645228FAE7D18128970C0DFFC95D21DD98218BA8F6
SHA-512:	5FCC5B9D075C4D27663030F81526CAD4EF88FBA430F381680BC900F66C9ADE7B1118111C5ED0201F311BE6E9454119EF209BA79328E8879426C0A350590497F6
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....+..0......tEXtSoftware.paint.net 4.0.21. i.....IDAT8O=.}r.0..}.....,.0.L..!8M...F........Bg..b.}.......+.<=Kv./.......n.....r-.k{...v.....kl_....S(..>J...4im.V...J.^.N.i.z..x62....YV.dS..^.J.._..F.E...-.5m.J...5..wo..2.4,..P...k......FZ7.U.;.....W".P[..E2....:..V27..5.....S.LNHz...].."4....J...V{..Z.C...."=.n.R........K.\|A.h-P.{.{w;..fh.*N...-..]Wn..Y.C...07...v..-w.......]B..U...4...b.q;..DIey......V.a/..=V.wl4....T.J..g::..]..q../..s....=j.6..K...,A.b.4<rrN4.~N...m......@.s.s......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_silver.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.343552133098277
Encrypted:	false
SSDEEP:	12:6v/7uNpkta+cb0++GdjeKEDmWbdHwzTTobz4tdRgWpAXm7:nTuaBb0K2mVfTqAvkm7
MD5:	6846C6873AAEA2256D1437BB8B5BEDA1
SHA1:	18C61A8E61B0474FDE197AF3E3050C6165FBBA89
SHA-256:	E228188AC46FBAB6A5A6CC1562982D4F90F5B1404EC12B5A6299D1352708249A
SHA-512:	28E5633624978C36D068EFF6B78E793758B36A59D3F3D4C3F1A9BD8F8112A02D3F319183C21BBC6A7F88F6E898BFB071BD9E4AA4D91C86521CA0427779BD3597
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME......BO\| ....tEXtSoftware.paint.net 4.1.1c.K...{IDAT8O5R.. ...TL.V.m..Qh.........MF..af......zv.....)[..].p..9..#j.R..h...M..Q...A/..c..[....A....O...V..`R4I.h.dr.<.Y.e.[...a)M.....m.ZG.K..y...73.....>.iH...<..f..K.@.`.4...V...Ab.`.h..:G...h.....x.g..X.l.U9....&..0;.....l.(..a..sJ`K.@...a0H....)........x`...I...W.R........2%1FKx?<T..../....>n.........qM.pI.....a.:.P......x.~...@.)\|\...j.C..k...g/o..*...1?.JM:.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_white.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	523
Entropy (8bit):	7.376675576577284
Encrypted:	false
SSDEEP:	12:6v/7uNpktwEs+cKg8uoRFd5VrbHcoQk45R2KltKlFY:nTuwFzqRLcfTRs8
MD5:	640C538AB8AE820D8523F9099DE14329
SHA1:	AE4B97F94BC0AA53674641A86883A4413EE36883
SHA-256:	BCE349597B4A02FD49E5563E32F8DAFE789C12289466E621833E069A982FA8AB
SHA-512:	03AFA5862AA76F57FACB0D15248CD962FD913181BD457CDB00A30FBB4D0F1F20058F3FE9DEF284E089BB3A9AEEE4A803686172BDF91FEFC10186CD7FB055A9F2
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....(...o.....tEXtSoftware.paint.net 4.0.21. i.....IDAT8OE.kn.@..s.....(g.X......z..-!=O..B".+.k{.].D..C@...4.O.....C~..).........r..el.......+...X?.zj.\|.I..o.....O....Z.v...G.......[[.}W@.X>.R..lC.%...2.@)...-.......LR.@eX....oZ...Va%....2..t....NL...KBF....\..2...v..B.....ry....r..3...K...\....A.E...g.;....%.gm.o](....$I......d....,.............x........4....yN..'m....6....9$.~./..C...........,.$ ;.\i....Sk..&.K...K....D.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hardened_clay_stained_yellow.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	581
Entropy (8bit):	7.479089713182592
Encrypted:	false
SSDEEP:	12:6v/7uNpktoOiUJbzoXRIweU184zmS7cpmjOn/2Tp1JVZ6SMD1:nTuZdBCaweE84qSQgjOn+iSMB
MD5:	F1BF1ACD173B9BD120C0E8BEE69FA829
SHA1:	B7C8F47C0428BC8D2616A507667A08C1111ED267
SHA-256:	88B4F0C80998D43A8734ABC83E86BCF24BB2BE0A64CBDBEF5123BC0263EF4C18
SHA-512:	56BC820F4F6744C7D8F56824260C001A3B58B887E30CF7926A1053B42A9E8978E860041FE95969310A4B2636933ED285A2BA9E1C8586FC5A0182C6FF1AA2339D
Malicious:	false
Preview:	.PNG........IHDR...............h6....pHYs...........~.....tIME.....(7(.R.....tEXtSoftware.paint.net 4.0.21. i.....IDAT8O=..r.0..}....#...K..b[.V..i3D.lz.~+5.yx.i....n.c......{v.....i..w....z ...i(.a3..7O.S.Y.n._.....4M...w.b..>./...>\|]./...e.E.NoC!w.d..X.7...U....mn.Eb.t../iy1..eu..@Qy.J...%.e.6#....&.. ..F..!...c...7.`MW..+aHL..p......k..~L.....d0A.\|....Rp./X.5HD}$-...^t...4L.2...1.8.$.".A.my.}.....P.d.7n.9.;.%.E........X.s..@6..J...PBZ.......i..~.s..pS...a...)..C.....:(..<....d..)..y<#..>..'D.\ka.s.iR...@4.........o{..u.."7N.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hay_block_side.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	274
Entropy (8bit):	7.003111996322124
Encrypted:	false
SSDEEP:	6:6v/lhPNRDRkFyp9sYlF7ae8POZ6Zzp0IyuU4yHeG66DahaO9/ljp:6v/7jRkFyzaLO+V0IyuCPh+haOF7
MD5:	A154FCF52B14495FEB252EA43E2B8F5D
SHA1:	A8CA8A1BB0CA97741280A90571B354CFBDE43851
SHA-256:	C02F4B1E21248B8D6C2C04BB0895F573E81A73FE6E694514349DD9869949319C
SHA-512:	00F4CC36B223C6DE0C8509A033AAA34E1A7EC112500D12156D197E9D7EFF2E8F449C8197AF22F33236D1C9DCE8ED15939B4ACF6D4FC223EA439EDDADEE07BE70
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.....A.._!"..i.....Z......%ht...X..;..anW0Xf..2o6n.Ey..r...L...6.w...y.. ..Q..{.$.ZH......<N.....r..\..j<1.:....e.".2[.G.(.U'..WR'....ky..1tb+.....<%.......f......vS......G.9.@...v....v.......8l.V..b.../..S.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hay_block_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.9484069602303355
Encrypted:	false
SSDEEP:	6:6v/lhPAkz3sWlxBjbNbaRWgLwkNneF7cck+hAx6iKx7EtvkndXtzqU0wop:6v/7qW7l6Lw+neF7ccy8iKx7ERknVt+5
MD5:	7C13766F0C1B29C8EE75F542E2D0A79D
SHA1:	DAFF933BDEC7B81216DD46C5ABC6952DF637185A
SHA-256:	CBFFFA8413F547E94EFBF23E6F3189CF61FE8D1FF38FC548DC7C73C87CBE2859
SHA-512:	1E46AE8CEEF604E632E2D12B38896AFDCA647CC375BCEFD0F11F86A3F16F6357291D93DE54AE98C1330AEB80289157D738BAB11D1BD88EF4EAFEBB9ECF9EA778
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8Om....1..U~.U3@&..e.t..g.....8..0.$....y..q]...K..e..E../%.D...r0/..<....(..P}.....3..A..bE..-..;...A....=.{..(y.O.3....>.6}.;.R...RA9.....G.w.k....-x+..d..R3^.q...\|@..xr..V.9.2i...8A+.......j...<./.WP....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hopper_inside.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	195
Entropy (8bit):	6.508563658482638
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lYkx8uv9xh93P2Oh1n7Fa1wTLLf1dSViSBBdsesb6My3MH8m/:6v/lhPokWu1xHPP6wTTMBByyz8H7wep
MD5:	97DBB27DD0F8187B8BE72588BF7FDB50
SHA1:	BB5A5668F4E320777D4510A28EE227CC38D68F92
SHA-256:	C9DC074F1315BC2BD15184C2C921447C2910BDDC02B4EAAE6EDF0379DBD189F9
SHA-512:	15B92597FAFBDF09F346064073936D32BEE2952B7FD1542549DF827EBA4F697454648188BF86CFFF83F07F94C5E0A1CE2C02681F3501CA17CC1CA4FBA4D27ABC
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O..K..0.D{...........B$..I....~-.y?....l..FMk......hP$...yP..+..6..F..v.@$.b.*.g...\~.=..0n..V$x...3...H..X8\|.l.X.^".i...0l..((.`..x......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hopper_outside.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	220
Entropy (8bit):	6.631865675978503
Encrypted:	false
SSDEEP:	6:6v/lhPi28OfxPLcCQ2CC1owXlfjPOZyYolVp:6v/7628OprLWwZP2q1
MD5:	A3E943290BAE5489975A59AB6AFDFB28
SHA1:	FF0BE0CCF623E046E60FE40F1F85E596A7FCF101
SHA-256:	82096147097D6F840C5EC550E0306BF506190DF6DB417C01A77E072B5719563E
SHA-512:	6F324A2C5FE2247DA76B2D11F97F4A4A340551F7BCD55FD228A47B77A9D64193F287144FC275A3A18D5103F859BDBB436BECE1DB8C0CA4D2CB315F22A1012B68
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.R9..0..hV).X....BI.._..H^9..gae.....uM.<......y0.1.0..xD.z.....H..<.C...'.g.`...G@.}.E.}..k?.`BE..^=.*..8....k..`.l....]./...+..<g[.k.W.%.}-.....`.R...b_.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\hopper_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	155
Entropy (8bit):	5.950346049230291
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3ld1HNWHele+XXF3af4lHjmbF9qFtQd1Vp:6v/lhPr2etXXEf4JabKn6Lp
MD5:	81FDD92334266137E2E4954F875EA00F
SHA1:	8076FEF2109DB46AFE997F8EFB6DE4635E27CC4E
SHA-256:	B6BB8D17E0FE5FC1DDCF8A9F4584D3844015629062876243850A079D506A243A
SHA-512:	D1A7C602F642AEDD506B1370D1B98896D4E58B84EBD9FC3F3D4B7EFFC40F1CFDF61FF13D3EA30E1EAF516E4E12F04BDC514D184B2FF21B2F4AADAAB1EA058219
Malicious:	false
Preview:	.PNG........IHDR................a...bIDAT8.c...........p.....a.0. ....c..Az....X...s"...b...` ........\.@z)7.......;....X....%e.3.....f.%.].C.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\ice.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	340
Entropy (8bit):	7.153449494028251
Encrypted:	false
SSDEEP:	6:6v/lhPW3VVWl2ECUV/QsbXB3bA0v6oTiDXay1Jx53S5hWfdxLyl1sKp:6v/7I/WljCU6sbR3kBaiLxJP3S/uuTv
MD5:	5B5EDCA7896BFA26E493AFF01ADD07F7
SHA1:	ECA665A1E0205FEA5BA1511D63CE255DB611CE69
SHA-256:	125D4EF20A9202955862002461EA8ABAE0C069D0D72E7A9EDBCC92B6926ACB49
SHA-512:	B1E1A655307577443C87E417C4D32E105CC0FA4EC9B0312F471728C6D034253520E3CEA6773D93C9FB79356392336AE69F2E87FEE0BFF196A0D407E776CA2623
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.uS1n.0.<...'..!C..C.>.O.s..>.?...X.h=P(.!>..]..D..x......s.w..x:.>..q2..z...R....[....Ni................................I33.R..v>.2..k....U.......&.^.`..k.).....@y,.2......W...8[.A.g.. ..j0.a..&.......5zc.J.;)..#u......W...A....:I....j.....}."lc....8N.iZ.K{u\...........=....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\ice_packed.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	347
Entropy (8bit):	6.912253401694655
Encrypted:	false
SSDEEP:	6:6v/lhPmNpswMR/C+q9Zg7OP/icA/kVMIXlORMzUmpKuL3xsqENbp:6v/7uNpsb/ac+/nXp6mpKuGn
MD5:	7A1024AE90E29D29A8AA706E7A41C52E
SHA1:	4DB60EBD8DF3A25486C83B11BC72657D10FD4D1D
SHA-256:	3755D41724E0C0BF2788463E8CC61BFFDE60F90ECF70CC6D0965882D37252830
SHA-512:	6655A2A359210A1C75451E99D0E826C6115F8160CF613EC063C212A8548060CC926F099C666B856DE0BF8AA9A1E0EC057477BB72DAB7C8FA4C4C02414FF9ECF6
Malicious:	false
Preview:	.PNG........IHDR...............h6....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.1.6.N......IDAT8Ou....A.D.....O8.AA..m.{......c\..e2.....n...v8?........iY..[u...RZ..0h..y'm..t..#k@.i<pc.*E@.j.........wi.#Al...I..3....".w....../.;~...T7.9UJ.-a.u.......zU..2 ....g..C=..W.>.5..-..).4.+.F.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\iron_bars.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	326
Entropy (8bit):	7.1499714275219075
Encrypted:	false
SSDEEP:	6:6v/lhPWQoPkqrPTU4rGzJBJ/LeUuRdI/6NGhabgtVrrG5bP7ypYaAjDdwup:6v/7doPJU6knxeUuRm/6ND8/G5Xy2aAH
MD5:	3682A074B2942E65267795438F56C28D
SHA1:	FE1FFE04D24740C6C77D495E3C0FD6A89E3025DF
SHA-256:	0D13F3F0B15C3DDB0F253F6A61052B1EAFA00DA027DBBEE9FB93E72308D1FEA7
SHA-512:	DEA34D8AFC55E61DCD71483186258B6CE9FE220F5CE940DFE10564AD84B518B0C144B0B7A434137915369A128178C4D72AA18633B91C6A375536EF7EBDE36680
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8....r.A...2;.5.Y,..gP.{...W8...&'.....7......l1.5[Qv'....g.M..pU...n..`..m.?.Q..OSH.W..2<Y.........&........lp:.......o......Es...........&5..2..\~.Kz... ...M.o..K.6D....&..N...D.}p0.Z..n.......M.&..+.e..@y.R#.H....b......Zu......4`.u.......$.E.......<.b.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\iron_bars_cross.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.811989398396401
Encrypted:	false
SSDEEP:	48:ecmQFzQJI6v+tShGHt3v940GYLICKckhDWxd:ecXU52KGHBjGYLHMCd
MD5:	8EB067C8CA7DA94B4D8664361BAFD2CD
SHA1:	EDCBBDD3812E68F03AC7C99358510CA65554162B
SHA-256:	9579F5E426429C4009E20450CD3E03347C722BE5CBE79784050E25D4C31496C4
SHA-512:	D007B6069E90831314851DB125175A38FABE55FDA80F97CB12A6F44E167E39B0FE4823A36095E6A1411DC83A8208A4982A0ED42142AD4159CD3DC2F0BA0D37B0
Malicious:	false
Preview:	.PNG........IHDR................a...zzTXtRaw profile type exif..x.Wm..&...Ut..!........d..LZsbdY..{.......^....%....E.mR!..:z4n...../z./..H{:.};...1@.._. ...NG.....C>........9....?[N.....MFe.G.l#$..0f..Tg.....M....M.`...m.;.N=}M.....K.N=.EO{.{Em...F......k...K.k.<..ZK...fM%.a^..U....K,.XU4.....j.;:...c.}..!:.hom.4u..F[..$7.v+.....(j.j.c.9o....:sE..............A]D.v.4.;8.a...]....gNy.w6x.y...A.i...d.."3>.E.gR;6..5P..@S.s....vh.R.=..V.5.A.I..%g.".."t..+8...u..l.......(4.....+....Pbb...Y8p...;..{.F%!q..E$H..(.....!....%....1..S.I..N::.EJ.f..s.Yr.1...).p.EJ(..j+U...W..j..aS5..&-..RW.u.s.]z....W.......@.M;y..j...G9."f..2.PB........L..).j.....1E.5..qc.@.G..p..!.....9....q{.ZM.D....#....65h!.........n.(...{.Q.}...m....l.%F..h...#.....8.:..K....0tu-<.i..K_.....;...H...4=...og...y.......n..._...XM..o.....=..kC.....,...b.r.to.p.n.,?O.u...7.....vp.....{Xn.bmm....@.i.'C....J......]7.b&o.}.y..}%I.E6).7.S...[J.....h..m*......e..P.5...[.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\iron_block.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	376
Entropy (8bit):	7.025764492534078
Encrypted:	false
SSDEEP:	6:6v/lhPkR/CnFDqDj0cTWMj9aiPoJcSNmTCyDW6ksvALIHzMa1Obejp:6v/78/kFDCgcTWvDJc+ya6/ALIHzMaZ
MD5:	DD82010E9E9268CAD3A5765A67410A19
SHA1:	377FC2BA7ED7FB10A36369FD26A3CCC1931CE0A1
SHA-256:	30CB51FB4DBABDE9ED9E8872DBA89ABD29BA9B5EBCF71510E2C3195D2D756E73
SHA-512:	FFDF8BAB90B5FC327609DBDE86428634E12CA8EBA07443CBF29FD62AF3E274541535209ED081CDC32C68BB7105834AB80987501D4685639529C8E1628980DFD4
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J.....IDAT8O..A..@.._...U{.......%..8..7 ....Dc+...Iz..7c:..K......a.......t.....?~'.2..9..$.....m6[.t:m.....J.8..m[.=..y.F.v...Q.....}^...(Z.. ...[ wF..&.!.MQ%J .]$..@V..:.......$..0kY.....q.S..Q(...J....j.lJtY.w...T.0].*Q'......W>...".o...x.......X..$.w.....'..x..&......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\iron_ore.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3187
Entropy (8bit):	7.903140010463019
Encrypted:	false
SSDEEP:	48:gldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OtBTW0qDIg:gXHt+JcNgOSiS4XsAYNpf2ESNkq0g
MD5:	88236F3E2A804FACEFBD0431A689C75E
SHA1:	82E8C4F1C342B15E393825A921FA8C66B3246B86
SHA-256:	F9A6390F9EAFC8BCF9D8A831C71D288E39A212ABA18E63F86DD7D81A192EF3DE
SHA-512:	E7F7D28F3A50B3A3F3A72DB955A9B0955A145F3EBC64E7E96FD8F05C31EE7F791B9774B626B3CE4856B3824B321250DB4B8B88BCE08DCF52060D05514E121559
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\iron_trapdoor.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	207
Entropy (8bit):	6.0297337468467935
Encrypted:	false
SSDEEP:	6:6v/lhPfqcyo3AghhM37E4robNbWPNZujp:6v/76do3AghQ7JrcWCN
MD5:	9B4A939155F95B7A8227E933DF19D9BA
SHA1:	396362FC95B4FF486BDFB5A95AA53F2800D0F2BA
SHA-256:	6B33054575975C9F3677D8897F6D281A243FEC74D59167A3A95487E6CA13C583
SHA-512:	CC075BBCEC23B6C6A6C82339D4918FDE4CD25E6236721FA41609FE1D7A0AEAF52FDB8AEC76C9EB5D726282CA13461765365B87137AB07002EB9863520455C50E
Malicious:	false
Preview:	.PNG........IHDR.............(-.S...$PLTE....................................6.R.....tRNS.@..f...YIDAT.......0.......kY.......Or....Pr(......K>..RW....[.....A.%.N.......K+....nZ..7......J.>..I....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\itemframe_background.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.945291720779774
Encrypted:	false
SSDEEP:	6:6v/lhPigUg5PjmxIej+8+WsbFLMezjBr/0l5p:6v/76gUg5PEIpWsbFLMarMp
MD5:	370A988A9D1626651436D5E501223649
SHA1:	E8D9AFC0294ECCCAF5B70568BDA7F1C5F443C7B2
SHA-256:	F3D4091A78C25CA8B79B1F33030550A4AC364FB3BBA7F96AB21EF581358DED8B
SHA-512:	D8790AC8CF0DCCC963C75FD18EF48A2BDFFEEE25CE59FBBB397894BA9C3E894BC3FC2157BCB1A7817087D587C3A9C75FB4A2A8AA761991FECFC333B4FFE5374C
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.S1..0..SP..EE. :300.2..FF.....c.:....pJ...g..y..vi."x...g...vh~.~..g.....4>"....y.....,...F.8V.P[*..t..H....D.}..N.......Bt...u.R...E&.44...Y.......}s...@...=.1KA.T(:.m}..._k...]9q.....].\|...0......u..m.v............8f....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\jukebox_side.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	201
Entropy (8bit):	6.200253950571156
Encrypted:	false
SSDEEP:	6:6v/lhPfx+8UEjnuzhgBWleHZucjq/9mNvI8up:6v/7NnehgBie5u+qVmNv6
MD5:	5FEDD430F2EE020E38EE7D2EFA300F2A
SHA1:	49AE28961070F12B97A32821C338C9FE67AA3E03
SHA-256:	D9E860ACFEF760C2DC70027EA889F5A3BD5C9FDEA88FA882CC051B2960BA9CC0
SHA-512:	9A495814D4EBC3D3C94238321A24C813A85141BB97B37EA0954FBDD74469FF24128A4284422152FB177FDECD4E7C7E34DCBBBAB0001FFBA6CD717E0F7B4ACDBD
Malicious:	false
Preview:	.PNG........IHDR.............(-.S....PLTE...)( 9(.A(.Z<)Z4 {P9.]A.]Ad......tRNS.@..f...\IDAT..e.... ..5....x.,:WSCZ(.yaL.`.......B....B*.X.l.X..S........g.Z.+#{.u..5O_."Q5k..!\x.e$.C........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\jukebox_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	202
Entropy (8bit):	6.303659758905048
Encrypted:	false
SSDEEP:	6:6v/lhPlRhDTrLx44PbVaMldknAZ0Vx8GWtVp:6v/7NnLSebcMltEW9
MD5:	0EA1D8C72D4E3FA145AF7F02104A108C
SHA1:	1AE7CEB566917E90C7DAEC741FAEAD55421D8AAE
SHA-256:	9F43B3887DF21751502D25CA431C239A8C33A68DE6D73A3D6B4D1057FC82B794
SHA-512:	9BF343EDA408CD9AF9875B6D9D05C9DAB0CF550DFA4C35F491976292F96D5923ECAB19DC51400B77CCECB152CA021A0966E875D3FA570842E2BC59D5ABB985BE
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c..P.....`..G.0q...f..Q&@l...:...Alt.!g.l.T..XG8FV.K........$.m.9...0.6@BT... .l...l..4.....,H..(a0.......D..\.(..%$.X.()..L....eaB....s...a....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\ladder.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	254
Entropy (8bit):	6.295605083585749
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+q9Zg7OMr6bzXFNgkWigcFIZ+7h9kup:6v/78/acLrwbHgklUZCb1
MD5:	5F855809E2D2313DC77CA83D880C0F18
SHA1:	5038CBBA71B9786F02E1215843AF630E5CDB21AC
SHA-256:	6916785DEFFD9AC725C4022ECD438931B9D5C78A221C09BBCBC82C0E57C552C2
SHA-512:	04362D3DEE4EDDE849660E3C0859372FB219BC50F82F609F9E81EE7B72CD576534DE2E44C82E3B0A3B8CD9FA03AF0E8E6BC5DE4DD35325A55C5AC910FA4E7FA9
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.1.6.N.....oIDAT8Oc..i%...}..C.8.VuuI........ . 6:....`......t.. :.M.Lc. 9.:..j.....mU.z..:.....x$......$>....Wd.,>.......-........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\lapis_block.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	316
Entropy (8bit):	6.99947940310992
Encrypted:	false
SSDEEP:	6:6v/lhPW8sVozgd70zCxBt0Nwi5lSbyEKYsXSXTlE/fkWRjIp:6v/7lsWMV0at0Nwi5lSOEKYsXSRE/9li
MD5:	30AE690A0B04DE8BDB6D1F5A1607CFF6
SHA1:	2F49975791B48BF29349E91D2B4BE8FC7D044470
SHA-256:	77BD60DFC1827D2D4AE823BBD47E73A0DE4A4D3794F298B60AEEC520F84CF3E0
SHA-512:	32247C627DD84FF9490F149B9A9DE9B420ADAAD04A02F388E67D43CA3F87D528E270C4816E9429229291451CE4D3B14BDCB0121324D90B39B63782DB2309E395
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.mS...Q.....6YL..F1n2.F..nT.E......W.x.pv.0.....b.y.r.J.J..v.4.^M...?^@(..,0....=..'.U.u.c*..Wa...Q..Ug..>\.~...nrE......^).x@N".x}k.....&.3.\chk..:s.]m...hE..&.....w......:.}...m.w@....;Pt.z\|L.............W......3.._.G...:>.~T.v\..j'....s".cAV.....1........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\lapis_ore.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	553
Entropy (8bit):	7.462399189567536
Encrypted:	false
SSDEEP:	12:6v/78/ZiozN3HLImbonYE4xQXiKzMh/CbfJkjqOZTb3C5ToFxp7U/JSZOb7:X3z6yKzcWCjxB8Tod66a
MD5:	34BDAA46C03145DA48064EC2AFB05A1C
SHA1:	6F76F02C3B69BC54F9C01C8E4B94FA9951BB966C
SHA-256:	DFC3F172019C65127155D9152F63382B3B94EE46BFC1E994502E4223BD4D35AA
SHA-512:	F1657D1383F58B5D42EC3745E526342E12FA8BA2F5687ACF2DD719B7B579D6622714957054366968F186B84E53C23C78F72987AE0BF8483C37990D38F82B7074
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.........8.S$....IDAT8O...JkQ..''.I$$F.b.bac%....;.A;[..... ..O....#..s......D0..y.u2..Ep...........y6(.j.x{~.....\%..=.^.g.ry.2k.Z.Q....}.R.$.n..e..!.w.ab.n.w...o....6..].i...h...m.q..n3"C..l...\f.f.....d...........}.v.!."W....#...Nv21.).XH.D..-..W)^."...j......#V....tT*..f.)...lV..-....j......zuM.w/5LA.J....g..#.$...b...z.T...\.. ..Fz.P.A...X..h..z...H$F....;= .#.E...#[.....F(.n..^P?%b....@."..P..8..0...H...2@b..(...u.....94.;x.R...e..#.8}....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\lava_flow.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 512, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	9931
Entropy (8bit):	7.929751477908618
Encrypted:	false
SSDEEP:	192:BS461ToEB25zKkekagC/WlLv2c2EwNmL4vNy7kd/78ztPxt1Z5ZekuWD:o46toj5zK/hgC/Wl7t2E5L4cZztP5Z5P
MD5:	021A51EEB6F27F5568C25EA13231AF10
SHA1:	1D8B52CCFE3A533BE35532C1C89592FCFEEB054E
SHA-256:	EE3673EB09B74E4B0374A98019C8E860C6C766AA966B8D193E2B71103028C528
SHA-512:	0EF693C6D168328C83A2F68854718B8A6F195886BD2501B56B36FFC83EA5465048B7B592DA387EA946FF4598E89CDDBEE90691B2F04F8F03B439876868423E95
Malicious:	false
Preview:	.PNG........IHDR... .........l+......bKGD..............pHYs............... .IDATx...g....{....n..[WWw..).)..Iif4...1...c!........M.3.$..y2...G. /I..2..=3.(.n....u...v...V...=....H.W..P.tUW.9.s..k......XG`P9.@.Y....dR.^.[...U...........?..k.....w.aQ.'..4..v.V...)..-?.._...s.W?.z..;.....n....;.H....o.T..a.......U.9u..{..D.E..p..Y...e.<..OnX.TF..>;..UF.xR.b...Of?...Kv.s...&.@BRh.f.....&.]y....X._H..H..\.a^}.........w...i..k7s.....Hc..I.j8....J....Z.0CW^.{OK.DD.d.._..(,.E...G..6J@...,.x..;....@HF.}.3.c.......[w...)..&,C'^.{.L.s...N....4%;..5.00H..6.t.....x.;...I:.. .O...Lz.....M...Y.Hd.dV=Z.i....W...n->.X}x...(q.........T...(.Y..;.......S...A.7...\.6.?.\|......_.mF...WH.}.=..w....../........r.....^.2..2.k...O...z..q?...o..JT(],...).S{..i.W?<.t..r......o.JH.Z....$......&....~.F.........U..t_.qo..[aQ..ws..O....7....:...l\|.......\|%\|.I.J.....UB@.,..^..Sj(..1...g..B..z24.I....~x.6p.........?....z.....U...D.a......H..P....#..P...V.......v.n..?nN.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\lava_flow.png.mcmeta

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	3.763623631783828
Encrypted:	false
SSDEEP:	3:3HvzzfkWNjUIAqlfF1L9n:3Hv/bNQ0fTL9
MD5:	9BBE5F5F156AC21F2485B60ABA8A8B6F
SHA1:	707A67960CD833BE36A8FCA460AED79ACC4605B3
SHA-256:	77259CDF09FE827C6D23896CD8B2D6CDF5DA1D2AB8D3EFCDCCD7641CCA9A4898
SHA-512:	C46C064BB2DC1C135A0FE06A3B7FCC88C603566A2810C75A6305CF071EA6F0C6787A1E01CE708592C1322487B4DBF070B6F117575D7B80BD8A49EB1BC74EA754
Malicious:	false
Preview:	{.. "animation": {.. "frametime": 3.. }..}..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\lava_still.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 320, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	10420
Entropy (8bit):	7.921435391382575
Encrypted:	false
SSDEEP:	192:mSnlMM3WrUxNnphlGqFpg0EAMXNRcH6xclTliVN6Nj1CCld5MNq/XtTRidcB/Z:Jn3UU/ph0qo0lMiZloNWj135F/XpRwOR
MD5:	66D4FCEF61D94BE08140BE41D6A6CA7A
SHA1:	1A3246B10F43FB8C568FA9B3EB7584B4A6C69AE0
SHA-256:	8BC4C492D24DF2089961835624398E21AE50CFCB3077EAEBB1F836A4CAFC19EB
SHA-512:	9F9D7A9971D488FA42BB2FF1FFA614DF487131D1D293A094572CC2736F20DDB7C38AE79DA13CEEF28CB314409FCCD96D8A458F8F00B3FC61032C460EE1E13987
Malicious:	false
Preview:	.PNG........IHDR.......@.....:hku....pHYs................ cHRM..z%..............R....X..:....o.Z....(:IDATx.l..$Y..g..s......KeeUuuuOO.C.r......$..X....=..G..e.A.....WA$...]6w..gz.....YYy.......=xv.,.x......~f.}f!^..#w......g.s...m.....TK.Ij....J}P.5.!.W$....\.....9AyR....l...m,.......5..Sw....\|z.WA.R.L...!).<.......q. ..7M.....f^..^.......u....??.1Qll.......RM...4).rW>.e....q...\.IIl.@..12.Q.NiR.....8W?8.G..7...8...CB-il..(.......p.tg-M...B.]...`.6=qd..k.#........&%..^m@\|.7n....I..U........g.B..........f..c.n..K....)....)...]..[.hw.m...>..............Q(.....*.lj.j..JP-.... .@......lL5.B.\.\|......W...{$K.G.ac...K!...b.B..".`...."..,..js..>../...R.EE.?........Wl..r...J.j.PKY..0...$K...? Y...}.ZG...g......ML.R.......q..R...wg..y4.%...r..C....\|:W.1j....(..].2g.\|....(9Z.....9r...].iZ.E%kC....9rl.{s.....X.T.{3Y......x....',5.j..M.7.o.W.4.2v.w6'N.%..5..?j>...8v).R.Q..&..j.{V#)kU~....sL.Zg/w.%....T.O.i...8.2g..H.._\b.)....B.`D.2.d..9.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\lava_still.png.mcmeta

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	470
Entropy (8bit):	2.761551601604902
Encrypted:	false
SSDEEP:	6:3Hv/bNQ0fsv/IaGvmKivKpcR4cqbasfoS6R+GvRB7/F1K:fSNlKM8c/qbasfcRlRB3K
MD5:	CF5DE2F00C5560C1D90B6AB071E89978
SHA1:	2AC4828D551342521B859B849867ABCD3D6C1A92
SHA-256:	84A0EF2A3EEF33B8D2CDE7A87B5156909A302B2ACC30DED568DCC7A92C6FB9BD
SHA-512:	05472A50E87D70AA57C458A666D54D0D0B058305773E5177C6F90E42153394C2A349F0243FC8962FEAF6FC862717A7FA05F4BB292FC96FFB4A6EAC4F54E7CB68
Malicious:	false
Preview:	{.. "animation": {.. "frametime": 2,.. "frames": [.. 0,.. 1,.. 2,.. 3,.. 4,.. 5,.. 6,.. 7,.. 8,.. 9,.. 10,.. 11,.. 12,.. 13,.. 14,.. 15,.. 16,.. 17,.. 18,.. 19,.. 18,.. 17,.. 16,.. 15,.. 14,.. 13,.. 12,.. 11,.. 10,.. 9,.. 8,.. 7,.. 6,.. 5,.. 4,.. 3,.. 2,.. 1.. ].. }..}

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_acacia.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3378
Entropy (8bit):	7.914300338705554
Encrypted:	false
SSDEEP:	96:gXHt+JcNgOSiS4XsAYNpf2ESNLSmCX1Igb:goONgOLPXsAYnUSmIqgb
MD5:	9A0FDD8688534D79E6C9A8D6DF6E0BAA
SHA1:	915EA45F32D8D2AB6BB7366F528E804045BF9285
SHA-256:	8A4BDADF22F470D86B449A3AEB08D46728ED3D14AAF2A5E39CD0EE8F4AA8FF6F
SHA-512:	E3E73011A0795272FE90AECCC17154446F9BE596AF639FBC648E606BFB37D0F9593FA71EF997A7A797CD3F09CD61828D675CA99A582F97D97C614BDCF618E563
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_acacia_opaque.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2970
Entropy (8bit):	7.875736055210171
Encrypted:	false
SSDEEP:	48:nldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OUIO/6XgLw:nXHt+JcNgOSiS4XsAYNpf2ESN4OSXP
MD5:	7523A672C4F436F95B8F6F75D0AA13E3
SHA1:	BCE7C2870CB9510D9F311A3DAA4B344CD604D71D
SHA-256:	588D5C81D329236FC358878E4B68881379B397FC488DEF909356E21DFBED5378
SHA-512:	1D0071CAF5C7C98D491B552514F45E9F4A5A5058F94452145320493EBE44466CDA0C05805E62FE7BC98D3D1B470E617B0DA44DF6605D6B6206B8FFD4854A81FE
Malicious:	false
Preview:	.PNG........IHDR................R....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_big_oak.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3352
Entropy (8bit):	7.915106138922168
Encrypted:	false
SSDEEP:	96:gXHt+JcNgOSiS4XsAYNpf2ESNLSnw6lg/:goONgOLPXsAYnUSu
MD5:	16A9C21AA99BDB62233B724C678B0FE9
SHA1:	DCD58D96F863D9AE880BAD382FF38D31A8F8A49C
SHA-256:	6A33E614A5679937A135A7D611D6D5DC1A493F938B0E98C12CD3143DB8CF8C18
SHA-512:	7FA92AFB3485FE26F64256BDE7088C28E856099E84E049970CF80C2BA390EBA7ACA2D25BC4D60FEE24CE4C4FD092A2B60666A9EB555A0628E984C6271E964657
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_big_oak_opaque.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2969
Entropy (8bit):	7.883319879021053
Encrypted:	false
SSDEEP:	48:nldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OUIO/6bitvm1:nXHt+JcNgOSiS4XsAYNpf2ESN4OSIm1
MD5:	C60824D03EBEBEEAC5F2A07F902481D2
SHA1:	6DFDDDF139938502114FB0D2F6CF2E0F694EBE1A
SHA-256:	C76C5086B49E0835EEEB3F5F3B76C1C05FFB772877CC6BEA16442C60617A5922
SHA-512:	2FFFCFB40B844B5159729CFB8BE3B7D01D273CD690D926CDB2FAD68FCD4925B836AA159BD075FC554C6B607004E18103CF47DC52E1C6FE6646CA7B5513B49ABE
Malicious:	false
Preview:	.PNG........IHDR................R....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_birch.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3275
Entropy (8bit):	7.908004344707052
Encrypted:	false
SSDEEP:	96:gXHt+JcNgOSiS4XsAYNpf2ESNLSxssGpn:goONgOLPXsAYnUSxhGpn
MD5:	BC3E07B457230C4985CDC61178F6C3AC
SHA1:	D99E3396B06DEFADC5F2E7EBA06910928A77D499
SHA-256:	48FA54948306874CAC5700BB3040A01DC0182D808423087690763BA6A891B4A5
SHA-512:	68AA1AB6E8A707E3A890EC34279095905D879A9DBB2163E11FC1F4B37A52CCAA8B939B5A403886596F30D51948C28CBE230B6526764E3B0F8B08EDECE8FA179F
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_birch_opaque.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2946
Entropy (8bit):	7.866862594044194
Encrypted:	false
SSDEEP:	48:nldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775O+E/60Q:nXHt+JcNgOSiS4XsAYNpf2ESNnES0Q
MD5:	7E1602A99BB0D9908A63A813AF38A087
SHA1:	B231114B4B949C437E28F7BBE499823C3710FCC9
SHA-256:	90953EFBE5C04FAF58FB9859EB36B9751CB066D71B00FED642F509A1F3EE88C1
SHA-512:	C4AE82C28325BB35FDE846769F1113DA4658B281781F3795088643F6E91F568E55F344D3B66ECEBB4B9D3BEAC90A6BA38020772B0D8CCEEBFD2D6C3305252F90
Malicious:	false
Preview:	.PNG........IHDR................R....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_jungle.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3237
Entropy (8bit):	7.90702717244814
Encrypted:	false
SSDEEP:	96:gXHt+JcNgOSiS4XsAYNpf2ESNLSwPdRnsi9j:goONgOLPXsAYnUSBi9j
MD5:	90EEF0FCD1F14D97F476053C7A18215F
SHA1:	1D57CD938AB31478E264242C056C8BF4AE8952A0
SHA-256:	6B946FBB898EF44850743A2E990E61587FB4E44A86727BE380C506CF5C4122AA
SHA-512:	C2A11134296ACB22ED4D5ADC84A7D8C325ED9CC941EBB9A5A902F6F8D31F8F4CFCBED363A3807E5BF27B2D9548CF7E30CE160606258E4A909ABD28B6CEBCB242
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_jungle_opaque.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	7.87137351760041
Encrypted:	false
SSDEEP:	48:nldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775O1/6rKZw:nXHt+JcNgOSiS4XsAYNpf2ESNUSH
MD5:	76AA4B61AE6D58E3BB1A95B81D712319
SHA1:	2110C33A06D9AC8737AA57756F606A59D1E76B60
SHA-256:	A0D8E432F0A53AF4041956D34319ABD29EBFA6DDBC490186EE8718FB6FC2D5C4
SHA-512:	AB7BBCA2050583C157429158E3BCCD4F13359AF34C3264DB8839A73A1D2E621D7704C551DA63CE88EFEA86A0A1721A7DF2BFDCAE373DC82FC92A02A2C6BD6ECD
Malicious:	false
Preview:	.PNG........IHDR................R....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_oak.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3352
Entropy (8bit):	7.915106138922168
Encrypted:	false
SSDEEP:	96:gXHt+JcNgOSiS4XsAYNpf2ESNLSnw6lg/:goONgOLPXsAYnUSu
MD5:	16A9C21AA99BDB62233B724C678B0FE9
SHA1:	DCD58D96F863D9AE880BAD382FF38D31A8F8A49C
SHA-256:	6A33E614A5679937A135A7D611D6D5DC1A493F938B0E98C12CD3143DB8CF8C18
SHA-512:	7FA92AFB3485FE26F64256BDE7088C28E856099E84E049970CF80C2BA390EBA7ACA2D25BC4D60FEE24CE4C4FD092A2B60666A9EB555A0628E984C6271E964657
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_oak_opaque.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2969
Entropy (8bit):	7.883319879021053
Encrypted:	false
SSDEEP:	48:nldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OUIO/6bitvm1:nXHt+JcNgOSiS4XsAYNpf2ESN4OSIm1
MD5:	C60824D03EBEBEEAC5F2A07F902481D2
SHA1:	6DFDDDF139938502114FB0D2F6CF2E0F694EBE1A
SHA-256:	C76C5086B49E0835EEEB3F5F3B76C1C05FFB772877CC6BEA16442C60617A5922
SHA-512:	2FFFCFB40B844B5159729CFB8BE3B7D01D273CD690D926CDB2FAD68FCD4925B836AA159BD075FC554C6B607004E18103CF47DC52E1C6FE6646CA7B5513B49ABE
Malicious:	false
Preview:	.PNG........IHDR................R....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_spruce.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3259
Entropy (8bit):	7.909933284668293
Encrypted:	false
SSDEEP:	48:gldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OS/6xJjAumY:gXHt+JcNgOSiS4XsAYNpf2ESNLSxpAFY
MD5:	0AE97949B7FD660986EB40F48C7E9ADD
SHA1:	B5634640D79DCA050F3876064E9CA9390170116F
SHA-256:	DD39625769F32114F429B0DC74D559076DE904A25B0BD896AF1D7B51754A746E
SHA-512:	1244DADEFF7F58B4F3FBE6FD6EDA7D9BB6724DD6509F66948B0BD864966CB24900EF79494A4058FC71314B0A8E517D56C0D9A45906C0BBDAF5779D324FE44864
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\leaves_spruce_opaque.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2955
Entropy (8bit):	7.875465448099426
Encrypted:	false
SSDEEP:	48:nldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775Ov/6ccvb:nXHt+JcNgOSiS4XsAYNpf2ESNaSHvb
MD5:	97F6E0693C1DA9FD69305B6E012026D5
SHA1:	C42E430B8627C277D296F161E205A1B034046FF7
SHA-256:	BDB5C9A9E811BCCFCC8E2CBA60B7E9952DE746A6F75A3AE2E1C34860722DA75C
SHA-512:	2B287836ED839DDDB978C3BA1E3090BCBAEADAEDFD4B307CF8A472067359A99B47CB40D2FAE5E6FE3C52C8A2E35A2ECDA6B3AE3ABD8F537EC1717BC12FDFE03D
Malicious:	false
Preview:	.PNG........IHDR................R....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w.../iCCPICC Profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\lever.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	138
Entropy (8bit):	5.812136897868806
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lVYgezmh5i5/Y60APgl/mbnw/StNRTp:6v/lhPlYLzmh5ieLAPg+DKgDTp
MD5:	DC212203CD3CFA56AE7CDBCB9F7D8D80
SHA1:	7CFB893EB224DA91B6BD06D66FA3A7168DF1AE10
SHA-256:	AFF928C7F11F56FE4F41A4E0DC5365C067A5A33FA099E41F789CB053F6FE6403
SHA-512:	AE55D9D223CDD0DCFCD9FA18DCE3DFE1954A74D5DFF4559FB73F9EF85EA5E722E5099E34894CAC145C2881CA893E34512958327129CCD8A51F4D6428F953BF8D
Malicious:	false
Preview:	.PNG........IHDR................a...QIDAT8.c`......../((.O..........7`j....p3..._....T.2.B].(......@[.Y...ZO.2..k..5....))4..U....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\lilac_bottom.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	456
Entropy (8bit):	7.317039832564318
Encrypted:	false
SSDEEP:	12:6v/79qeAvMf/pGtpd+ZsSiNtJc8NsYRKmrU3gxhxbSEg51:I5AKep4UNvHuJ4nbSEg51
MD5:	43FC5EFC65ADBC847856783DC749B35E
SHA1:	5FA7AE54CDF4E873AB71243502247C32E6DE3332
SHA-256:	928A391F9BD8B2E0892FF21CD02AFC2A93ADCBAE86709C20597B5BFB4E80B94A
SHA-512:	33B5C7C3BB8A72A182C5C31B4A8AAEDB7C1BC29FA82EEE6031FC6888A0F0849648FFF29FAF1F7CCB59CDEE5FBCCF1DCD9D2151818B074A3109DC043BA24DB158
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8...=K.P...+.....D..(..`E.D..C....B].......'.q.....C..c... .Z.......:.P.D\|....s.s.S.*M.^^.7.P.-....^f...g1...Y...s.p...7....Zg<.....^^E72.2...hX..L...Z..S..}a........+...[u...,\.....UkU.....,..n..s..(....U..+..(.a.lI..K./..&....H.G..A....V.)..T...d._...RPvT.....+.......7P.......&K.%Z.BO%....(+....2Yf........]...2?.......(...r<.p.\|...A.w....).b.f<....h'....?...ik..V.6....v..{m......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\lilac_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	7.201811973168838
Encrypted:	false
SSDEEP:	6:6v/lhPWRrUpOIAWu0aJHsU+akGhRvulB0NEb3CBcPJdJVPNBPeqNEWhuvO4PR7B+:6v/7WrUejsU+hGhyyEzCSPJJ/mJdO4JE
MD5:	7943E55EE3109B27A9E33517035F96DE
SHA1:	D557C9310855188995CBF8F8570107B172E86658
SHA-256:	B39D18F7D31C8D1CA3B1C44158EF4383BCC8B15C40B2D49A18A6BC7B5D08951E
SHA-512:	E75EF2DE465AC0AFE181086A0533B519A56ABB8F80F3ACDBE237AF672EA33EF5ECF10C7AE0FDE5904BD49D03D127E2111DA8B750D162F2739413BC2B25E9CECC
Malicious:	false
Preview:	.PNG........IHDR................a...1IDAT8..S.N.@...1.(,...%......). ...E....hs.........G.5G.1..PPp.Z.....6.of.....X.h..t.&.3b!.j.....tM...FE6QK7W...B.....BRT.....A$.3..U].^-.Q...{......*..5..I8.Enj.wc/......4H..dy..B9...=R.I..\|..0..5%...m.G8.....l...R....~F..8.EZ ..8...KH..^...`.,d.S!..^.?.i..MMRT.._..YQ...4.....&1.$'..<.Pnj..[.......A.'.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\log_acacia.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.109517951560472
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/ryelgCtdoV0/Ti9vdyeUxDQm7o1QP3p:6v/7b/llltSV0/Tc88m7o1QP5
MD5:	9D1AF9D1DEAF9C4B5131B8B6003FAD7A
SHA1:	EA9B9A6557C770264FA7D1A4C11D43A1EDAB4B6A
SHA-256:	BAF9E2F9E9F339FD98B595ED9C483B138100A52D3C965F3F3B0F4D03DA846237
SHA-512:	0D822AADD2882E64CDA4440F66682D632647A8EA96A7A8BDA506D6B4EF891B67657B385EEBD59A3BBD4F59C280A37B1DF164167EA12B9B760B7C8A8A09A01C0F
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a....0PLTEE<2OC:PF<XNCcUJk]Qzk].............................`.....pHYs...........k....xIDAT....... ...(LPsn..`....P..ha..B....{D....w.Le.,C;G..U...$.J5.l.....z....4..jxO..H..VLief.._....I;l...+.n<../..._........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\log_acacia_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.337832670118772
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/rljZY8/Ut4CtdodDPtpkI3r1Z3z8NzrOuUDeXLC3TlVp:6v/7b/p28/UtNtSdZpkI3rn8N5UDI0T1
MD5:	78960088D9073721A1C64F64EA854914
SHA1:	EADDECD2F23901C14AFE93AEDE32AD90351FA7CC
SHA-256:	AD4AAC07F72CA98B7D67B28CFBAC2FEE6966752F0145DD5141182BA8CD4821ED
SHA-512:	33FE9DD00C3C1CAC327C514FD762DD47E00623CEAF0D9968D7CD0BD504E6F81E079236DAE2996472CA0CC031E5BBD0B63D73DB5A52CCDF54490ABBA9D4BCF4BF
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a....0PLTEE<2PF<XOC.L.P+.V0.]2.c7.m?.......................K.....pHYs...........k.....IDAT....!..0...!.Lk...`...ib[X.d.K.H.\...F..oP..+.-.).s....B.7..+E..5..M.6.<..WfO.V.n1..R..=.D..Utj..:.....K7&........'6......'R$.u.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\log_big_oak.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.197206158793408
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/IILxBcf2nFZM1UKlmDToCwpOfajD45KTp:6v/7b/I2xBcIFZMijToClajk2
MD5:	350110135693FE82E8EF566F27FD4615
SHA1:	0D4210D59BF9D37DDAF382BE1A3BC553A20960ED
SHA-256:	F8C889B1B1927EE7E48B96E9FD00A785BDA67545EE7E4569FEBF322E612BBBF4
SHA-512:	244E23C32799B3227C3D4E0D8CFB165F9A895C64B9A058C3DDDBA7B90261CF1694854B9013DDDD7E11A535CC1D576853A7241924BD28248F224AA812A89CCFE3
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a....0PLTE$..)..)...#./#.4&.9.A0 .........................L."....pHYs..........(J.....IDAT...... ...K...}....&...G.{S..Z.....@.-.&.....=........I..\|..`..)...F^.0.:k...&.yd.l...G....Jma..sqY.?..E...j....S..'.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\log_big_oak_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	292
Entropy (8bit):	6.165823833153067
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/IyLjKll/onF9uFdudecELG3TBceOWVDplvTp:6v/7b/IyXK//6FSwEUTBddplV
MD5:	92854214B8316D10CCDA8D2E2A334928
SHA1:	25D960C8B5B6EA096193EB78E6A5174896BE083E
SHA-256:	0DAD844DB775E33A4AB62640F742BB43BA37605A8C2FE9A7D6BD654643FEA23F
SHA-512:	D2572863BB1C438E1308DCF4057ED7A944167ED4D912747E9FAC224738ED5A23A91075446021A51458235A9EC247A57CAC069267385D013176FF2CD733BE895E
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a....0PLTE$..)...#.N?)RD.]J0dO3..............................l....pHYs..........(J....}IDAT....=.. ..'E...Z..@..d.&.P.Y..G...{...&..d.....6.....P.........cK.+t.C.Y1...q...c....z+...C..L....F....h..`J.q....n.!.n.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\log_birch.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	308
Entropy (8bit):	6.675072298527521
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/3rnZ+ngSkRdnFGzIY6xDzxxTa9vtXCRqqU9Tbp:6v/7b/3rnogSCFXxDzXcvtS8qUh1
MD5:	89D26C33964FD705596490FA6197C52E
SHA1:	8F92DB017468E484A1ED8DED57266DEAFCD743AD
SHA-256:	A867E541E801A73693E6ACF5A4A24FEE74D46B3BEA9F1795D2455E072AD3688B
SHA-512:	2D353960F3C3B98DEF2ADC2E2A2C120F87ED0E2C121D20E774FD7174EC6F66CA4451654F1F4E0AF351B025FCC300E66DADFCB02BB1801BCC30B45424AA23CFD1
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a....0PLTEfd\usk.}t.......................................KN....pHYs..........(J.....IDAT......0...B..'.2.{0....\|Kn(......%..... ....k...}....K."g.......(..*yv....m..n8......P.w)s...W.".X.?B.0s..,.M...i.'\.....2..Ods...G.N..k......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\log_jungle_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.361132854853799
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/YEl0nN6hEBeABzEFbeFw2yQIZUUp:6v/7b/NY5BvBzsbPkI1
MD5:	C4EDCAD3EE07C66FD672405E6C5422B0
SHA1:	B56089D210611BA5C432C904773EFB65DC56C9A6
SHA-256:	03B3B1729CE3EBE8D0EA4F8E12CCD57DAAFC2936B003407C0801A6B476674E3A
SHA-512:	C1DFBDE95702B00886CE445ED185ED5EFC0F7DEEDE7B3B006EE144FD38B4F40C869D990578096EE4C6FDDC72EFB11F734B42991E13E7F73014ACB4B533EB4310
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a....0PLTE>0.@6.cX }]&.jD.qJ.yT..d..k.....................`J.~....pHYs.................IDAT.......0.E.+bB.DwL..J..J.*........3...4..m...W...q.`^..>.9.Q.$.',B.M#...l.P.x.~>c'bm....#.}4.....<.%..O....PL.F2m...r....(....6....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\log_oak.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.202127520058482
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/6Ts2Xk9Ctdot4/yTB0kubiLHax2WGbxqgTp:6v/7b/z2XkMtSt4/yV0kJLHap4qi
MD5:	B8D58EB315F3B4745D418D9907D961A7
SHA1:	77B99E79F76EA2BF24C0AECFF5834E4C4FD50C1B
SHA-256:	C232F15BB2CB9446C271D6567FAF8569003E8429B3EE6E4A64C3E56B7C6F77D9
SHA-512:	18D2867F8663DD1B32DF5822B1DF415224C5B7789CF01FA51DEAA37C15EA832D2FD383CB520FA3077666A1A800080958002D381A6A06C983EFE5CC487D8B70A6
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a....0PLTER;.\D!\G#gN)dP(sV-\|^2.k<........................6.......pHYs...........k.....IDAT...... ...k...}.....w0Q.G.{S.......L.....b....$n.u...G.\.#..:..R....3m....I3....d......h1-]....>\|......$.>.l--7.}....D..6.)......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\log_oak_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	298
Entropy (8bit):	6.331034577672587
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/6NebTgCtdodDPtpkI3r1Z3z8NzrOuUDeXLC3TlVp:6v/7b/1bTltSdZpkI3rn8N5UDI0Tl7
MD5:	8693B1FBCCFF0D8918C5D9F4D4FE8FF8
SHA1:	5BA8226376E37E3343BDD8D91E0AD36EB9D06D9A
SHA-256:	74EC430F30EF5C318EC9E020B1A3BCC4CA6E097182181A75A50381045D0E31E3
SHA-512:	41CDD22EF2BB5F95BBCD2357A38D8BE8B22468AC49A43076DE00EAE90F523624F5388DC4351C5A4E873D3A25890215CD1A19D177C7A7729D8303E18F95AF9DC3
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a....0PLTER;.\G#dP(~b7.tA..M..U.._.b.....................!s.7....pHYs...........k.....IDAT....!..0...!.Lk...`...ib[X.d.K.H.\...F..oP..+.-.).s....B.7..+E..5..M.6.<..WfO.V.n1..R..=.D..Utj..:..*...K7&........'6......'R$.u.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\log_spruce.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.0895341972276835
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/KgBU2IRj/lEzijnFU/Ti9vdyeUxDQm7o1QP3p:6v/7b/KVr+z2FU/Tc88m7o1QP5
MD5:	9A3C771A9BE2583757D1EDBC1DFA5A7E
SHA1:	55408D211B0D977F368962B416DB483376C93A21
SHA-256:	22C5B160C939E61186FB8249A6A3C17F9E12912FF273B032A7FD74E250A29960
SHA-512:	3EFBAD10FCD9F80F4965CB2190D357A006A946947F513B64E1C83C1EEF7277CF608683CCA71F7304688A63372BD386B5695F277D6D3E9247EF6475A5EC27D829
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a....0PLTE-..2!.4$.;(.B-.I3.V;............................d..^....pHYs..........(J....xIDAT....... ...(LPsn..`....P..ha..B....{D....w.Le.,C;G..U...$.J5.l.....z....4..jxO..H..VLief.._....I;l...+.n<../..._........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\log_spruce_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	299
Entropy (8bit):	6.343154112673549
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/Dl3wYk1aonFoLe9UNUsrK6AtxjFOfhyz4/lp:6v/7b/76FosEAIfh//L
MD5:	6D150F967E03C6252B22C4315F632C6E
SHA1:	FC7B193005A99E92F229A966EC7CD98371A723EF
SHA-256:	5DF8D57B1865804441B96E127D839C580E3C5B377CF95FB560F9A555BD4DB7B2
SHA-512:	528EC766537E33F632217295ABA88BBB8ECE01F6C58F455E58D1E79357409A7D1301D8F87BC5FEF52FB9626BDFCB2CC0EF4AFE119F6B9F7D8585BC2FED3A93B6
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a....0PLTE...%..)..fM(kS2xX6.^6.g<.q@.............................pHYs..........(J.....IDAT..%.1..0.D...@k.<...!\ \|...Kp0...k..U;;og......J1.BZ...u.yB....u+.iD.s.,.(.E...q.4....Q.,B.[>7t.Q.w..P$1<V....8$.WI7.~7.?.@'0..3....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\melon_side.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	210
Entropy (8bit):	6.516528266685627
Encrypted:	false
SSDEEP:	6:6v/lhPN+5RKJVakul77+0Hsb0qpt1pYqKx2up:6v/7HHsHsrPpYq42c
MD5:	95FAAA0417E719946585B9E0105B7E67
SHA1:	EAEEE3C1CED866D166A89B112A87071E562F9304
SHA-256:	2799571C6F5F143D1E1644FD6C4843C40D35671039B1D3B6DACDEE16AE844FC0
SHA-512:	1BC19B344489A112455E7F9236674B3842325D17BD6D5DAF685FD61C1E71C968FD7C23FD4973C79906BB0BCB895A07C552EC6042D0C1D8F3CDE7E793947449DE
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.....0..=H.a..$lAEM...A.A.d..r...@$..B..z....<m}..T....d.I.nIun.l..+.....U.+q...B...........j... .Z..^....K.o.r.-hA....1'^..BA.,`.Y..A.\|..<....!.;.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\melon_stem_connected.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	146
Entropy (8bit):	5.460171647832205
Encrypted:	false
SSDEEP:	3:yionv//thPl9vtt/V/dho7OjllXhl/wx92GmFDDhwn4JxnDYPHBSg1p:6v/lhPfVzo6zhy23Dyn8dsPDp
MD5:	94F23EA1F195A74D09294DD9A55E3EDA
SHA1:	07D5D655AB3021BE42A57214AF68B99519DD25AD
SHA-256:	ADFEE001219FEF6DD3E382ADB9ECC84A59DBD8B92198042CF23B7CDF2BBA54CE
SHA-512:	E469653207F5A4D87E1B2A213F9C35492D39FF2EF12041BD5BBAC42ED8D86A3860C6D99A0D23D8ADC156FE2AA5F56CE8C92664C0D6B60CB8F522ED5C40C9EFF6
Malicious:	false
Preview:	.PNG........IHDR.............(-.S....PLTE...bab.........KY.....tRNS.@..f...1IDAT..c`..`ffD.`..f.."..........&.2.C..M..........G,......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\melon_stem_disconnected.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	148
Entropy (8bit):	5.717127026864506
Encrypted:	false
SSDEEP:	3:yionv//thPl9vtt/V/dho7OjllXhl/ux5riYJlTWEWDDStH3enq/p1p:6v/lhPfVzo6zhMlaEWPStu6bp
MD5:	94A2BCC9797548777C34F0CE3447D15A
SHA1:	0768A6FA0F7663EB0082121F7C1A88A3DCE065E1
SHA-256:	01BF650E7B691DB3439EB52AEE56F9D0C4CD50123C2197F12EC565F5A0AC38D1
SHA-512:	86EC4998B8D0CC5373F9F8C6E2E097FEE594CA2EFD18FC59E6D05695C1B0BB4432494A44405C273A66055CC08A1465C6C4307EA8F9FEF2EC272AB39E273F97D4
Malicious:	false
Preview:	.PNG........IHDR.............(-.S....PLTE...bab.........KY.....tRNS.@..f...3IDAT......0..@..3.....l.s.`.dT.w%..R_.U.....-...,,..[...O....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\blocks\melon_top.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.867605292465248
Encrypted:	false
SSDEEP:	6:6v/lhPUbvSpMwA+zP8b2eJHFQjZyQl0uUa0NWVz95U52dp:6v/78bvSiwAWneJlQjZyyhoSXUAz
MD5:	1BE05FB5394CDDBB8C35D78D62E26372
SHA1:	A83E04333296B940CE30873E439E93E0D022E642
SHA-256:	ECEF3619BC4D2135BBF23F8C13EACB4ADB28AC84303C94BE8F42376AB7CC6DB7
SHA-512:	946BC3F48DE0F318248AA4291023A1FCB2199ECBE25C0E47E9E91B081E2FA0D117E465F3444DC25C8F557439ABEC9552A11F810C22C63EF1C966DAE19382D724
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.}....0......r.&....)2Af..i....x...RYz....ko...n.].k?'&...+,......^..;...0..i..)...4rT....5...#x.k.d.5`G....XN..u......G.......H..L.'..F2.B.....J.....*..B....p@.\"?.P..k..r.X.n..z.G......}.\n$......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\chest\trapped.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1265
Entropy (8bit):	7.4065117063083274
Encrypted:	false
SSDEEP:	24:qgjo0f//oU5P9A9p+RDzSpVsBWL0eG/XhPmZlV+Wk4QLh1:qTCHX5P9A9pYDwVsBWL0Vh+MWEV1
MD5:	C874104664008AB7DF7426034DC77353
SHA1:	A806A2D0179CB31587560BB65896AD8BFE85F01B
SHA-256:	FAF91357E75603532BE1D58587FA6D4DC804CDFF4BC5E8665A02F042D168E76F
SHA-512:	83713F4C82ECBAF4E56439BFDB354CFE4A2A435083C7E70646E31D6665FBF0DE017C709EFEEB107BAD19DA23FA965B60DF715B6721D5CD67783870A5A95D3E48
Malicious:	false
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a....>PLTE............+&.3.%72'61&($............}S..`".a"._ .] .`!.f$.f%.X............50&.y)../..-.r&.a!60%E0.J2.F1.@-..........d$.f$................`"._ .i&.b".d#.a!.\".Y..[..`".U!.^ ~U.%.80%2-&F?2A</E>1.]..a.D=0.T.d:..^".r).R!{S.}R..t,...@$.,'.#..&..%..#...=..D.e..f..`..hC#....spO1.E=/xJ.....up\|K..b..q(.j#,&.%.'#.!......13H...jtRNS..................................................................................................................pHYs.........j......IDATXG.Tiw.1..Z.h...:.%@.Ug...........u_j...?.K. .h......0.{.....:.95.G..B(....K3,1.....;......._p.Ba.....p.......q.-..._*U..V...J.Z.0,1.\.^Y.:...\..~...UJ.z.^.U.Q_.Xb...v...Md..B.h...!.P..@At........~..Q.....2..............+r. :..\|#@.....#....@@.r.'. P.4........U...s..yK.....M.A..+..[...m.k...zH..K...b..y..c.{.4...N...... ...a.~.r...S...F......S.7.m..v7.K..k:.~P.%>....3.^.....n.eO.....;...f).G..W......b.1.~.+.#...8F....}@2.M.}.ir..pXb.T....

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\chest\trapped_double.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1582
Entropy (8bit):	7.575828947288979
Encrypted:	false
SSDEEP:	48:Je/Y5hR1m8O4wQVoIfK6ADI9ii3dOMuQt:IY5hR0ew4oIaDi3cMuQt
MD5:	10D3F447A3D05ED07CC43965F4633328
SHA1:	D5CDAC7402EABC77E26715D2610E14E27EA8F820
SHA-256:	CBDEECAEE4AC403FFA0DE5BF2125175F648CD5E18310C7604D81A1222A5E6A0F
SHA-512:	221126D250C77BE8478BFCBEA39107221E0B6D414B26E56A345C05CED044EA535AB5272382FE2B88D49C7E0C7CE3E96EBA12B17F9CDAA838591C95A4C2E0547E
Malicious:	false
Preview:	.PNG........IHDR.......@........M....sRGB.........gAMA......a....APLTE............+&.3.%72'61&($............}S..`".a"._ .] .`!.f$.f%.X............50&.y)../..-.r&.a!60%E0.J2.F1.@-..........d$.f$................`"._ .i&.b".d#.a!.\".Y..[..`".U!.^ ~U.%.80%2-&F?2A</E>1.]..a.D=0.T..^".r).R!{S.}R.d:..t,...@$.,'.,'.#..&..%..#...G..I s#.q#.x..pD#....spW1.E=/.J.....up.L..b..r(.k#,&.%.'#.!........)...ktRNS...........................................................................................................x.E.....pHYs.........8.S$....IDAThC.Vi[.8...H...4@a....#=..miw.:...n...6...tF....8O(....~.....$.aC6..a...\.*...X.)&..........:r.(..86}\|z.Dmvnnn.M.Pz....B..;9....+..W....S.4/.^m..Z9.B..EK>.(.vf....RC.n6..F......h....Z..H...B...p...WH.y.+..e.6..wd...2..Q... :...].......N.E..+@L.;.S2e]3dW..~g......Q0.. &......`(.8...(...1m.....\pk.c.r.R3.@w<..k.g`..k.g`vLg`.s.c.CqW.U.EukCQw<..b..o...X....4.....K!..@.{.......H{<.^.Q.,..zQt.~..R`#2..X9>.R.\....'A.....Wl.;..j%..w.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\chicken.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	472
Entropy (8bit):	7.375553592446099
Encrypted:	false
SSDEEP:	12:6v/77Hj5AJtYfcAS3DYFJl4ABGVRje5FBKfYzpM4:CHdwYfcAyDydwfYzp
MD5:	176120AD1428FA685F8E5320CF3EB55E
SHA1:	88D41B82F0CA9BCF80B93C47A8126881354BAC46
SHA-256:	D2A6C25685CBB2223D3898515E815B09E9448A21552BFB05B384A6FBC5D54F53
SHA-512:	E659FE93BBE81EE32D8A94C6661F1177FC442F1DA1611F7F59893C60DBB11E70DB571AB1960DCD14C690C46A72A171C2A0F8A01291CAF399472D47DFEA86B1DC
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh..X;N.1....Q..((IE....w...Ti.J.i/.+q.$..;..hf.$.u.?...(..g.......!2...aP.x.....H#...j.!.._.I..;X8.@.....2`~;...C. .."... .N.I...{L5...a#..I......1.}...8...."..8"p...>?F.......R.>R......".+...WF\|......Y.&..B...8..x^2..oJH`N..Zn.s.e......[]bU...M.2'`.D.ZR<&...V1.X.@+..&.bV.8...H...r.}.'.x..`..u......".....c...j.Y. Ej.k..1ga....d.E..6Jn..(w..V.m.k..V.....G.....j...S..=..lu..(sP.z...I. V...fCCCCCCC....z....o.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\cow\cow.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	7.649371388503786
Encrypted:	false
SSDEEP:	24:58hJg/yhzeQOrzs5UgLKPLNMc876aQryDl0jCCgH6qyXN21vDSBK:587ayhivn2KPLNGQmD5iYh+K
MD5:	64E4FCACFE84EE63B91898364C883D40
SHA1:	845B7B89FB9EA0ACF352C59DADC7A31FB1A610B1
SHA-256:	3800D29036C33B4DA3AE20D07FED0633CEE0C249B7F92C92B441A1CAE3F18673
SHA-512:	59AE26F31D3EF9B0CD7A8CDD51374D4FFFADC17A2BAD4FA5DAF3C4F52F91D1C71D0964B8C35B0476C1AD7EB079C1674C420A249C60C0AF83EF1B11B8A15B576C
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....)IDATh...n.1...!"..T.E.....9.F...T.((.......$,.@yu$$..y....X.O..73.^..4:...\|..g.C)e0..}...o........fS.......\|.dx........Z....O.5.}._ze....&.<....W.g..\\\......x}=R.M....I..S.7+..`2..F.R.L..............`id...$....7e...n....o.P.7H..j`A....E.(.o...5.y........W...0......;...>...........W..~....e..ec..4R.buTY...h.......<w........zvV._].fS.1..=.....=..\|..S.../U......\...................h.=.p.....}D.......{(;....V..@.D..<.... 1..H.Y[/0.d..!d..$S..L^.M...Ns2..P.OOO#..]....;.]k..m..l2.h..)l.\..X...V4(V>.2.}..m.....x3g..v[....U...zf&{............ .. ....K....AZ&..../..~q.E.\o2......<...D 2.K..-..@..WGG..V...<..z.[.x].....9S..S.....@AxN+....)[+C...&...).Z.O..{f..D..d[G.V7..bJ.......Y4...hR...s......(..Z...5..Q^..".....%..&...Z.6o.1..,=......=:.......d...Z.t..........-7Z..l.<.g]M.....O....g.\|\.J..@_..(..N.....3.."...[g.Q..;...^..iEN.'.i)...^..A.&"....g.`.@....m0......;s...#.Q.....4:..C.[....G..@..7z.u...(3.bs.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\cow\mooshroom.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1103
Entropy (8bit):	7.698223806148446
Encrypted:	false
SSDEEP:	24:eeTrFnzQA0QfAa1TWaHMTpPQG6RLFFfwH2O3hHfZTtyS:3TrFna+AaS9P9ApIT
MD5:	00FBC3CEEE0959DDCABD3F43355CE6E4
SHA1:	0C3C4D088664EB4E6B328FCD6B47643B2D22CF9D
SHA-256:	65191356AF0595B8DFB1100BEC7F95F28A6BD6F9931DBE678FB30CBA08351D36
SHA-512:	E00FC3146D0C64B4F92330F6433D1EB3B7E45ADD5A67DDB2D2A922718EA5CFAC391F8B83625D6DFA1C2BCE9F7485A9C783DC06B40DB74621C2D5DADBD620A28F
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh...j.A....b..y.....V.H."..J.....mD.u.T....$..#U.x.~....=.H0h.nwo......m.....'_on....l..v..we{.y.p...3i......F].........k[+M...71.......=....j...M......]...].I..S.7+..`2..{r-.............^.[,.Ly.3}.k.P...S....E.P.......i.\6,...0A...e.-.<.F;../....b.....f.T...e........0{.S..b.......9..l=.l._.F.C..*..\|.my...B.x..N.8.............lj;.....u...g....`.~....-..`.?7.......Nx..}+[]...U.<...{..=.v....}.....^..2%...)..=...g@z../....!d..$S..L^.M...Ns0..P...'......xut..k...-.......3.....E'V.........g.!p.,.@."...Y.p8t.O&.N...jf&{............ .. ....K....AJ&..../..~q.E.\o0..t:...!...D..t..Y.e..h.......N..)..t.....^.xA.x.T....n=..P......i.......@gq..R.Sc...s>.. ..Q..M....,....0Dy..C<.......@.3.:.a..R..f..j.....8d.r.........[w. 3K.@.B..G..).,1..=..:.1....0....6...s.o...?;;..YWC.. ..S>....<....?.. .0..`-......</...A.`.Nr....xGZ...IpJ.G...G...H......X.,..3=o..>bp.,...n.n.@..E3.&...~i...5....(..F..Y:.ef^l.....^5..#...g.H.A.Z

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\creeper\creeper.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2869
Entropy (8bit):	7.907991121722498
Encrypted:	false
SSDEEP:	48:uHv/oF4M8xgj8qVkX9hhg6F1z30W2eeZCDN1CsIh8mSmt+v62H9w+whgPx95Rg0m:e/8Wug9QGeWbDNVImmKis9wPCXg0AeJg
MD5:	AC0B35F87B8D706637E2D08EB7C95228
SHA1:	2949528BD64417060D3EFD815264014CABB7479B
SHA-256:	15C5F8859F0269F94ABC97C8EEACD3585FBB5F79CB8FACA2308A14A26D7AB7A5
SHA-512:	9F033C9CCE019960C3931B29E46681FD70E68DC20CFE76E61C29EEEE36D4FC20A105F09C33F53449A40438A5146B22E3BB6D349D0DF5D95FBFB02D83917D1272
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....gAMA......a.....IDATh...SSw..}...t:..U[...T.(...C ...$!$$..W...B.."...&..(..Z..!Dn..I8.c1....3..;?...7...f.L.sI...=.............e;..nB7...).....7.F...l..\..=.".A....._..0k.....t....!.;...".%.,.k.1.z.I.`z.a].F.3.'...X!7I...B..... n,..S!..28..Q4h....7.sQ.....(.^.>...<.H..F..H..E.....@....P5(.. .n@...6.qf!....}.{`Y.KKK...3..........C..........k.P#K...EO?..K..L..n8.O..H.C.....?..j>t6)Z.uP5%....0~g....L...e.G...0d5R.)...e...............<d0.<..I.TS.M..M..F.<.E..Zs....s.8=c\|....d<VP...../W^P...Q$~..@.`....A..3.8.. ..g<F...^...0.....l.aR..`.Rk4.J.~\..'.c....B.t;u.J.i\|.p..S...j.N....U.../.[.....2..x.Y.aL...tZ=...8.....L]...J..AvE...y....X#P.^D...*..7.%`4.....l6...E.=..U.FA..qf....R.......yX..K.....X.?...v..B.\6. ..W.=.y.....w.h...R..Y...k.....&..]....?4..B}#._J....fwd...s.&\|{\|../[.Z...U....._sq..lY....<....J...\{.%.9x...jg.R...z.........n...0j09.....z....!.Pj.....\T@.&...9.~..#.C.y.P<...{.[.o.'.?F.l.... ...Om.>XS....U

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\creeper\creeper_armor.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1948
Entropy (8bit):	5.871509787784188
Encrypted:	false
SSDEEP:	24:BnFXzHU+Xy35wCKceA54Mf27VyGRjZqN1EmqqpkIxdWyRyinQqNqXp/u5TK9hVvW:BF7U+Xq5wRqF2JdjU+qsiQwqXuufPygW
MD5:	3E81639F697C8672014440AD3C691FEE
SHA1:	64D2940B1CB5BCC7DC223D4B8B7568D8CDD50FC6
SHA-256:	68701AEA43AC6AC7822047DAAB32C4C46DF305834A73FF5838A9917E7939A2B6
SHA-512:	95E0962BEBEB505DE2EBC99EF93F56419D1737A5812F47A9D5C5DC6B8678105BA533A17245CA6853B7B80EF0DD6B63A6605E0AFB54EC17A469D3227CD2A86267
Malicious:	false
Preview:	.PNG........IHDR...@... ......C......gAMA......a.....PLTE....*V.+X.,Z.-\..^./`.0b.1d.2f.3h.4j.5l.5n.6p.7r.8t.9v.:x.;z.<\|.=~.>..?..A..B..D..E..F..G..H..I..J..K..L..M..N..O..P..Q..R..S..T..V..W..X..Y..Y..Z..[..]..^.._..`..a..b..c..d..e..f..h..i..l..m..n..o..p..q..r..s..t..u..v..w..x..y..z..{..\|..}..................................#..%..'..)..+..-..3..7..9..;..?..G..K..N..S..W..Z..^..c..f..i..n..w..{.................................................................................................................................................................................................................................................................................................................................................................................................................................................tRNS...................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\enchanting_table_book.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	366
Entropy (8bit):	7.305928636892153
Encrypted:	false
SSDEEP:	6:6v/lhPvs5i9RVuv/5v78ELJo2RPBQxJWJblh3FPSmOmkIPYxIkZYgIYVQCLTRMP+:6v/7sQ9zuv/5v7lmkRhNSmOmkIbkm3uv
MD5:	DBFD2259F25C2CA9D3D4795F36502DA0
SHA1:	1D6922B6E09643791BD1C61A9CDBA4F08B87830E
SHA-256:	51853DE4C9E3DCCE6414F49DF02998F58FA4449C3B85517900CF4B74606A1884
SHA-512:	35BE574DCCDCADD1CE8EF178C730C3665EF2EE40BC0E62F0BEB0300F19024A08A523A4212908E473CF0AEB8C624ED3ACF49435380B6F5BEE0BC949726BDA90DD
Malicious:	false
Preview:	.PNG........IHDR...@... .....-......5IDATX..U...A....g.}..P.......B...UJ.:.F.Z(%J^2..d...;+.2.lf..vfO6.6...OF.U..[..y...A..NV$..l.K.D.......g...".Y.....i@4!...<.$.c .L...."O.&.?j......w y...P...>.i.....$._rn.e *.Z,..A... ...9....OY.#..S..L.0.I..<..5`j.8]..N.#...?b...2.!.g...6...../;....i.wF../..oS......sq.t.4BRO...!.4...K...p8.......n.%..a.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\end_portal.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	10716
Entropy (8bit):	7.942365521540897
Encrypted:	false
SSDEEP:	192:jnnnUDhhj4yh9UShDDGTQAEwohfDG4CIIFchjNAYk3NJuKSPlmPD:jnUDhhjp93h4ehrLWk2J3N2w
MD5:	8B503255C18E99E371C5901AD78E53FD
SHA1:	34EFE748EBE0C5481C6D3A6AEFA13AC7FE8AB77B
SHA-256:	81ACB42873E1E9BB22A9C5B7A47AA8754B732BCA3E46A42005AC9ED585E850AC
SHA-512:	B76220907D5C47074FA630FE587059ED313466DFF5692F16091D3D07E46B1C0B985BC2762D58C5CA772326AA9287253FBC17E9A087D75A0A5136D021F8EF4409
Malicious:	false
Preview:	.PNG........IHDR.............k.XT....PLTE................................................................................................ !!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnoooqqqssstttuuuvvvxxxyyyzzz{{{~~~.....................................................................................................................................................................................................................................................................................................................................................................................................................&..&.IDATx..].\Gu?s...w..].....T,Y...dK......Lq......L.-@.-.1$..P......@.1.b.....)ww.3_lI.w..9.w~...0....#xI.....S...>.,.....@.6..._.{n...w..`e..4..?.]..)..N..-@....#./..y...@Cq.@a...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\endercrystal\endercrystal.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1651
Entropy (8bit):	7.744338067405
Encrypted:	false
SSDEEP:	24:Y4Wn+N5etAxaQiFBCqROUNAeFEMiTnqrbaTUlWOpV01TUK3fvd0d18aaYtGA:Le6xl8CA72lLbXOpV01p3t0z80GA
MD5:	C53BECBF92EC03B4DF1A9C4BE5C20029
SHA1:	11C6976631C2796E4CC42753F0EED6B4B2E55498
SHA-256:	6318892FD9FD808B54D1FC5AEA03A518250EF5DDBC9E61734C6A5B1F0CE17171
SHA-512:	26E71E72FF5EC811946AED346C74E4BAA4F18CA6AFA24605CB81452B3F9D4AD88C6BC3050336AFAF4C9685FEFC41C6781E6D580697F628E91A37EE44D30611D3
Malicious:	false
Preview:	.PNG........IHDR.......@............:IDATx..[=o.F..B.j..5..R..?Bu .E.wvc.p..il@.\.r......w6` e..p.&%.=..=.,...g.....\|{:..\|..j5...?...F..\|.......y.S.....ax..\|\|x#c..;....WP\..........">=.......yL............J..... . ../.X.S.....<.;......X1...a#.P.A..[.j...@..{2."Ei...l.\|.{l...................W'V/.....1(U..x~fs~~s..q....}_.!...1.`...j..X..-.D.....m_.T\|O...Xc:..b.....%.m.1.....o.u....4...p^.U...`.5...gu.0.......:J.YTyj.P"'.V.aU....#.`)P.V.5....\7..}....$.k.Y.Z.......}.S.=...o.r..0..........[...7z....... ...i\.........G........h\|4.... ...G........h........8....._.{.@.~.....+..@..x^#G.\|........x.K.}.z....r..K...@{......(..1...W....l^4^c.E..........H$.......u..f...._3....Pb.@M.<<0..V..=x.M......W%Z\|...kx.>n.~k..f.......x....-...QW.....Z..Z.{...%-....W.[c...b@.~lK.....[b..w..P2.S......[....%..[....0.x....i..k.............h>?\|?A4.........$......~..../...__.^.......Z.{c.%._.1.(/...b...Z...........X.2.)..{..(r..S.3..^:^...}....j..?58C...===.NNN....h...}.~..0.iV..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\endercrystal\endercrystal_beam.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1566
Entropy (8bit):	7.827080439003832
Encrypted:	false
SSDEEP:	24:bUneZdMzXe7aEEztXWGpNrf2T0sM14OsekGlKsP8pAGvjZVxxZowxX6MPYlyqj4G:4UdMTm7EtWEN7RsY4pxZoWXzIyq4hvI
MD5:	4EAC2EDEECCD4DDB47B63C9919C6A4DE
SHA1:	94F8C01B7BB755C916C4FF69181BA9B2395669E1
SHA-256:	391BDAB96AC90AE0FB322B8EC5A9C14A892A036286AC4B459DF43CE01D8079FA
SHA-512:	52EFFF7BECB0D86FA6F9B9F6BEA495DD02206682A509C3A29B47D670158011E0E4314DCB72A3AB7CF3ED15A4A74D83D15E4333740EE7E89F60062F13C7344E66
Malicious:	false
Preview:	.PNG........IHDR..............R.N....gAMA......a.....IDATx.[.n.0....g..<8M^.[...+...p.Y.(Jo.0I.....k.......D{...t..0.B. {.....V....8Sw.....'R.i]O..4.......{M...]\\....xx..2NWWWy......>.R\|..I..j...sx....\|.....GBf7........V.5h...X7.K....2...;+........k..........5#j^.b...T.o..^__.~ ...=.0. ...n&..\.AZ..2....uD.....d.R.8....\|~~..\.A."..8AM..m.....o....8==..d(. RK[..Q#...G.h.....57....'J;l.J...5&..T.PPh.R4#b...^..P...F.<.<==..Y..T..H"C.3.......O..C.G4.l...G.ran...#.].R..."..4..fm./.41....0/.B..&/2.>Q3....MY..s/.....92){...@l../NV4...Q..,..(..z.\|....C$+....!...u....D....4.(,.u.T.&2.. ..'..<..AH<..@[..........hw.H.Lt....F.L.8...l.(IB...4`A/g....".@`. .h...p..mNH...A..P....S]..E.~.....!%........~1q..........p...CT..M.r53@.....x.a.......\|.c.kVF%.Dr...APM..D.3.*.x.Z\|.3:...%.u: )]...H.Md.t.H.@.b....74./.#........_n....$>.+].{.P...Xj.........u...aL..$.p.qs.J..~...T.f,o..#...N.$<'."W..m)=.l.B.U.>.....CY].........<3..b...aw.Dhm".....I@!K.......d.6...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\enderdragon\dragon.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	6190
Entropy (8bit):	7.304264548153334
Encrypted:	false
SSDEEP:	96:ojBkq5GgO/n72bFy5LWogWaTzbLMc0kcURAgHO:o2q9Oz2bFyUdWaTz8pJAO
MD5:	4CEE86014A3F758A3FCF716A00EE5FE5
SHA1:	E94C31C2D3C78872FFB0F83400A8D231FFE3FCE6
SHA-256:	132CC11B012A3A3531CD2F21FBBD3112CB444533925B49F9BA01AE217757DC87
SHA-512:	17DBA8EEF1A58DAB5C31ECDFFA75C6375C28465484D430E5536CF3DFD437E792DA43BDA15F635DECB8E2426A9C7C41DB5A55D1D0CF89383AD28F91840D7EB6EF
Malicious:	false
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....PLTE...................................................... !!!"""###GGGKKKMMMWWW]]]bbbiiippptttvvv{{{}}}.......y..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................~.@.....tRNS...................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\enderdragon\dragon_exploding.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	41004
Entropy (8bit):	7.961612336726424
Encrypted:	false
SSDEEP:	768:1RHtyQydP+IWdIF4OXp4A3nOVJYbMWzUK0nk4ENY3niW6HqmYAbenVvCgrL:bvW+xI2B+hU1nONYIHwienNrL
MD5:	E981E35CCBE4FFBAEABBE7D4632FCE6A
SHA1:	087CEA43971DE24D050CA1E96ACA251A93077E3F
SHA-256:	438F7A2CC4C1009C080BC4403DCF4F66D4824EB80A892864363EE84FFCD3FD06
SHA-512:	562E47E3C28438CEE162A9BF1A8316C87EFF524FEA80E2DCBBDFF57350E3C24C3C14C028F3880C10F4E74BFF4416AFFB62C899D72EDF30CADEC1F61C4096099F
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....gAMA......a.....IDATx.....e.....>....7....g.HH..hB.&&.&F3..:... B.j.....h..(.!....4R7R.[..g.w.mVzoNz......x..[UY..../...<g..?...........?..m..&.....}.u...U$.......W..>y...N&...U..s\|.O^;..T....J^...n..N^...D..Y..k y-&...?._.=y.........\......u..n'.%.[.3..?....u.>..........5....3..y.$...U.....]i.....5....O:'.$.A.!..c.eI2.?..x....U..I..U{......^.....k#y5.^.z.4...0.k.O..q..O1.v.7.u..$..\|...l.*..U.l7...l.PK..7....L......@/.5.=.............+.w..x.f....w..e.....-..}...D.2...x....5....X.t.+a..&....A.)QM~...@4i..)..C.U.....C.%.a.1....XJ .t.^N^=.g.1...j.>..<.....n0/...(...".?.......4...S..s..t..X.V.......a.....ha..9O./..Ml.U..9]e.?.g...`...R..{.u.a.w....g...e..dn.......9.....[g.W...0K..Q. ..g;.S.@.q......@.6B@;\|............kK.az]?}......Z..G.S............/@..2..e)./.w3.....-..E..pY...~.xj..R........S.?....8......<.z/rm...........r}.s.@....\|..@#.n..e..k..y....+e....uhh...........W...k..q...M.p..>.A.cw.ca.....O-.-1...2

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\enderdragon\dragon_eyes.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	1.9577621054671464
Encrypted:	false
SSDEEP:	6:6v/lhPktk/OXISi95qkfl5pbxlUmQDmMtqNS+EkpuDb/4ZhTp:6v/7FOXYJxlUZD7YxEg869
MD5:	1363E03D054E257E678EE18AB62B8395
SHA1:	F30C103E688D2AE5CAC877DD6A6E945FAA279938
SHA-256:	0B323FBAF7C12DAE380E4F9455A65CEDB7A2949B6027407E14B7DAB7F722B441
SHA-512:	85CDFFD74BB1462F879DC7A6CD605660E341796C677BC8B20911EB1DC9A6076E1F07631F2965643759C8ACB8D1DBA0301420022780BFA1125595DEA4861ED904
Malicious:	false
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....PLTE..........y........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H....tRNS...................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\enderman\enderman.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	471
Entropy (8bit):	7.222391346029945
Encrypted:	false
SSDEEP:	12:6v/79xbekGHOu1wS66kjDZ/Af/0dZ8lf+lYDHR2Wtjt7:ebzu1wckVAEwfyQ2qt7
MD5:	B43CF27EC80E7D080C9CA44C38BA05B7
SHA1:	4056270F8AC56643781484C58382A18E26F6E0EB
SHA-256:	ACF3A184B7E409BA005DD6709014E9F2575E3F7847EED1E897137746516814FD
SHA-512:	B6018682AE78716219930BB4D2B55297B6CDD2520580470491353AB5C9305BE151866928A3ECB41069EB1263D0D57562E9CBDFD0BE69B922179D75BBA6EF8714
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....gAMA......a.....IDATh..X...0..+..?.^6O.$.b+[.z.y.5..tY.X......4.....{X.%.;.W!....p^W .2`...\|............go?/....!\=.R...Z..2..1...0........"ff.!...`.tb.....,iY.y.ca....@.....i.J.3....O..w<..H.N...J.pu< +-1a..K..c.u[..G..$@.!1..!.h@j...j.T..uV........\...B....sC....Z~g..D.......}>+...Q.....Co)H.CH7M..PI.{.;.1.f.!#)Q......0.R..A......)zz....v...d........~...EP!@%I.R&(."...(.#.M.8zz.......>..X%..M.y...,.1.t8.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\enderman\enderman_eyes.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	1.7172098014932127
Encrypted:	false
SSDEEP:	3:yionv//thPltftiwcTLC9/+xghGlXUglN2aRRa212syxtiGOFxlED6782dp:6v/lhPEwcTWISMlld5ROiXlE+782dp
MD5:	3D5E39A774AAACEC45CE9BE357CA650D
SHA1:	5E2EFA172B32DF4E57F54A0A15BB340BC58A523B
SHA-256:	CA54CF7A44D4819403FA9483F6DEDE72AE25C93AF15A6D823E43A58A0FB0CF61
SHA-512:	4E603E737221310CFA3A692293FD5D0CE4E72415817BFF9834701DEF8B1AF2E38DFCA3283D654C3C536C5F57D643773DCAA21853F72C0617CB4F14C21B6FFAE8
Malicious:	false
Preview:	.PNG........IHDR...@... ......C......gAMA......a.....PLTE.......y........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................u.......tRNS...................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\endermite.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	896
Entropy (8bit):	7.6737446958227045
Encrypted:	false
SSDEEP:	24:xAEoE2nlN5y2RZESCKtIB+uFo+7Hzv2VqwCuK/vT1tIrJLXC1:xAE4Ny2N8B0+7TOIvHT12dLXE
MD5:	F0BB76AAB04D5596C208D5F353DBD030
SHA1:	2F01B410F0597DA6CA5AF1247AF7535DD8F7EFBE
SHA-256:	CD4019184A39419B3A93EBE2FEB363EE45BAABE0B73648A6E5E167E984558B9A
SHA-512:	5345B27CF2B34D19DFE6D3B56720D53F7140E1B8BE47EA5010E3F8EDF45C501AE09948376711E7880CE863945FEB93A5CB55E60117CC86A156C2DAC7D164DAAD
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....GIDATh...R.A..........%.!!!7-@n1......(..............l......f...3=.../..V.%..sYNmKr"'.c/....2..H.z......b.g...........s...Z.H ..mO..x.....o.k.f......%....x..^8..x.\|3{(..Wli64d5.+......V.8.5a-....P.7..v.......{0.?.j...}..`.....n.$.S..@.kD........RLVde.E.Vh.h~S.d.\W..L..R..MS...`.H&.T.T...8..%.Of%>2c.F$..2....x.!..W....=2. .....#!62-Sc.2.[`.....F..Z....3 ....(}1...qs..\|%.rg. .....A.9.1"...H)..G.>...9....c...G..XK.....(e..wM..?...S.vD....Y.K..:.u."\.f@.9Q..{a..m...F...q.s..\..Io.<.v...s"C...}.._.Z....g>...........P..9."......v,......f...:....D........%....;u.N7)..2(.A#.4.&.....%..cd.......Q..)...gN#oK.DA..5.... $...._...;..6;...(.z..g.j...CsC..3...-i.....V........>.`.].0.n..!....;...e..[V....<mz.......e...<@.N6h...........T9$'.a.l%.i_m.\=3..<..^O.h7.....S#d..M.......f..>...(B..4......6.A.....3u.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\experience_orb.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	543
Entropy (8bit):	7.409602667096571
Encrypted:	false
SSDEEP:	12:6v/7r17tNL3L/uEjgUURV4GHVk+6KJVWydMJ+OV7JleD6Hc:AXUEELV4dK+wsdFk68
MD5:	E9AF7694991527FE871E6F8ACD82E8C3
SHA1:	AFD03A9BFE6FE0C7D46B9519D46FD456C04CCE33
SHA-256:	40EC3A361A822919D7E4940D1CB8AF5CE0862CA90B20A5C7198A026C1C6EDDEF
SHA-512:	108432DD338198B565FE852484B6E5F8339D468904547B190EFC8ACB00164B1E012A25AB218518285E8F9CD120EE0B61761ADFCD7B79602715CF3E16FFD66334
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx..[[..0......9J9Y..f.5~A....?&. ..x<..M.^/6/.7./.K.{I.\.t._ke.Cb.?...h$:V+...Zk[..M........E...5...-..O..a.....[.."........R.....+.6.e...kB....~.R...A.!Xa....N...O..3.D.....m...x...>`........g9..+\|x...%.E..A..4C..}.k.M...std"..5.x.<..c..x.p.....\|).=.k....T...#......d_..o.0B..h...z^....7Nu.U8./....!Ml..3...t.$/WZ.......g..#..].S.[..m5....7...^@..n.....$%..P..x..[w.[....FF....V.4...S.o...fZb......d}........F.V....a...../p.gjw./p.w./.....C_M}#..@...\|.L......#R..]......n....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\explosion.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2055
Entropy (8bit):	5.063777700987465
Encrypted:	false
SSDEEP:	24:uWaGqNmlx/e7VeBliBQVJMmzURdlVuHlS96VLPElEoE9Lmj:dq+eWg2VJ1zUKi6VLPSEFmj
MD5:	5F1679FD1CF9C77AD7B437E4641ACFC9
SHA1:	C23A98B598D6BEBC12BEB7BD12D7B19B1777CA30
SHA-256:	F89879DA35D52E78DB4A498266065723C4A0260B8D40A7871FBE4D5EBB95A89E
SHA-512:	E4D0577966FC7875A59F553D604BFDBA730410EA8899828035EBAD3B8708F0A292BD73E2CD7740A8D9E6F35BFB9419AB0FAEAF866AB5B23F3BCF3AE8BE3D9404
Malicious:	false
Preview:	.PNG........IHDR.....................gAMA......a.....PLTE................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................gv.c....tRNS...................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\ghast\ghast.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	686
Entropy (8bit):	7.464371138752964
Encrypted:	false
SSDEEP:	12:6v/75rvGABYGToXssPdXV70tx4HUqaDF1YykUKgJjYGarsGxJhChQ74EN:aYGTkpv7mgNaD/YyGgRY2GjhChQj
MD5:	FF4C76763A980CC553E3C230043A1F44
SHA1:	D271A82D2DADFBA45D903F2A730CCE2752525ED4
SHA-256:	720B7E3B0EE3342F65144D85D5ED05EC95FCDCF13D0B516BADD0EA4A9D10045C
SHA-512:	226C0CE655DF95248D7AD7B55B042D01AD9FF0D663D49E4CE8C9CB3053C7440C72727ED683B96105D5CB2D1D7CCC3012992FCFFF7EACB84266519F98D8CD9F89
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....uIDATh..Y1n.0......5...>...%H...Z.(.3s.HY... *..E..............6I.>.'r.\..:f..D.U}oN..z...:_....v..0.22..V4z.......y?.&9..3.y}._......3A ^.@t.LI1..z.....[....n.TC.........x..X..;...Y..%.....8. .R........f....e..:...@..'-....3......F.#.@.....l.0B.#7.9.V.......=%..:..l..A...xs.h.Z..+...^...af......6..k.....Y s....5d.#.....=)...LD.....8r.......f....Gr..{N.1..9.E..L..`.....R.R..,...G#."`......}..2.Y4...h.C% .DILkL....;.y$....K. .?+...t.....v.../..ZH.........T..{...f.g.......okt-Blq..........e..a.5.:..h.0]...Z...`j....D..}.."....J...#...zw{.c/0.Y....x.....K....o{dAh.:.q..d;.V.{..o......>...z.."G...Ga..?..$....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\ghast\ghast_shooting.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.567902525549418
Encrypted:	false
SSDEEP:	12:6v/7kCXPV8myUi5MpldNYHUuYixA/tqgNb/6gFe/10l6ar60PaykGES7:YfV8HGdNYhYgutqYr6ee/8OKaykGX7
MD5:	26A2AFEA4C6160486EA18D8B5F40F743
SHA1:	F5A6F7A626316BA37F250662997381811BCAB221
SHA-256:	AAA4FA6F30938D4CDF043CEF8EC27AD11CDB6F5C70D870E485C38B9165708BAA
SHA-512:	3D071DD056F002A7AA5B524ABBDE80B8B19B858AB85F261B5CB45F56E663D30CCC0F3BE5218793B6FF9AAE75D8A3D587836A3AE5EDFF360B3043656C4E53FF4F
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh..YKnB1.\|w....t.E8....T..At...#\.f..!.P#Y..sb.?q.i....t.:.....P9..~.'.s.G.F...{<.i.............f\.....F/..9. \|....f.."..w...4.}.."..).D7....~..0.Hj.5..!.fS5.....1.....s.....Fg..M....\|.x..!)........h.......^G.2...b....y....E.....GO3Pl....U&......6X.........=)..:[......b#..x/.....g.0K+...2.../C#...h[X[......P.}.....!..1..^....=5.....cm.Zqv.....a]......v...^.".^$..p...`o*....}.`....d.(E>.)....z..F...2..!..O~S~m-,f.h.......\|.-b.c2.'..yE4...$.....,.<..P...P;.Z..~O.().B.7V...e...A...k.J4.<.n.`-....J3...39v/h9..~d.{O...YCY.../C+?.P..(..A.....ZD.)......x..[.K)o.Z.d..i..m&.@......[!.@+.Z...^4.#..h...@9./..9.........u..U....kJb....x.@d..).~Ox.}...#.."W...g!z..DS.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\guardian.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1518
Entropy (8bit):	7.747716404146556
Encrypted:	false
SSDEEP:	24:0dYQsULJBYUyFO8eKUJGCwpLlqGsiQA7z9xohPwHj98uUbsqjpJavYo+GPL:MXH3uLcAQAFGJwHJ8TQ4pJ9oj
MD5:	670B2B4628F1012D12EBDCDD32572D26
SHA1:	008F4BC3A2F6076B27B6A48FB2D48032C873B88D
SHA-256:	AD078DB5DB44A257E526E7B83289BC3F60E01A163E99B0CB9C02DA8CE0679739
SHA-512:	7E89999160707F82B27D3FD153D8A6A3E3F0C79E2973559AC1440AEFB0E5A650977D4ECEA8857EF34DE2C7690ECF3AFDE35786BEEFF99357EA056E5F68C383D2
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx..[=.TI....P...eP..L.qQX...w.....vqP.....A.L.`....@&ufD.q6Y.............GUuO?{..>.U.........;.....a.?.[{..&....R...n....`..~...0nd..6..9..<...I0..x2y..?.>.........1.........Z..@.r..W.1..B.M...`..,.`........w..=.......6]..aO.Z..1...v..6-hD+..a0.... 3)..`..v...6W1.y.....m<..@.sm..1l.0.h...t....../R...n.@......:..........+....xLq...Z.#....Q..............d..>...8.7@....M....3..S...6....N...Ic.....-..}S..R...f.pb-....&7..ir.m/..~.;........@..D...{c..N$E.\|.Dl........z^f.)/..^..0........Z..vE.^L...l..<....@......X.....m...&.q.....:.4N.U...+.....:...s.`F.k<.km..}.n..."..u..,...e.b.Y...0.!{.OW+/....o...Z..Z...}.^-?....X.Lr=R.....n.+2..;...m...X.@..m...._..:.N> G%..V..........!...........4.pf..c...4.j*..0g=.:G.....D..3..>U..kO>S(..~....R7...;..X.R..z....~'f....'f.]B.P.d.........k....{.\....\|+.0.?...v....x2.-?Z..`..z@.......#z...+.....#..q.W...MW......&....?......,.......42L-.1....5+.Z.`.(..8#.]..z.....lg.y...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\guardian_beam.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.566336933793903
Encrypted:	false
SSDEEP:	24:z+9K6kfIahzPwcJKgBBPtKjxj+uSWaqtfD362P:uKLhzPLzkjwOtK2P
MD5:	1B63FC09546CF09667FB270EDA03B199
SHA1:	9C34FD1E70A18B23E8028C6DD3E9C297B3C0D8A6
SHA-256:	D6C8C55D76C244C1221193E2B2000B7B3912457E61D321A7B01127492849E8E7
SHA-512:	6376052F7B87B7A97B8F2B8FC4D7FA5205188EB3DE854C319FEE1A1CFC943281D626DE6A2D43642D7591E0E5D127AA60FD6B95F99225A72540F5F91C8CA1EE7C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATX.....!..}...!."..h..-.M."...n......`.8...W...<.F.p<...zE....^.W...t..=l6.0.N.x<.8...........L&..xd.NF..\|.a.\f....J......96..m.N...6.....`..2...b..e;....O...P.=5.".G.}.u../....f...@.j.....n.... ~0..).X....e.,".........C....@._....=..8.;.s..T.P......u.Q0.....9.C.$....hE...hvZ...7......Qm..7qC\|WE#..........YX,.q,.1W.I..G........%&.......$.l6..h.h..W..f.......tA........mi~....].y`.^gZ...j....\|..U.@1?pl...S+1.1!.....@V8x...s...tK...%..(..}.S..p8t.<...'..>.?j5...h....B...O.Pcl~..aH....-..A"..\..%F....<..e.$....Z.9.+...>....B.k...~..\$...fC.......k............-.x"V......9e~.XdPt.Xn.Ts2..w.......r....s.......5.%...oCM..H..B....;........'.6,m=..y.`..pov.A...@s...NNJC.N5..7.?..V.y....N.._....T..o..@..[..'..'b...@...........N`b.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\guardian_elder.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	7.723212737330054
Encrypted:	false
SSDEEP:	24:uNWVhOe/PnLVbCz0XuRSzQpMceo+WsN7SMT6lHBX680/guc7HTArLmvrXsiyic:uNInLtC78cfEWS2MTYt6NFcTTAWvLK/
MD5:	DABE6E1ABEA8F2CAB20CD9DB0F92CB0A
SHA1:	0DB78FA6BBD5AFD40CA4AE4A2D14C4436E196391
SHA-256:	C9F6328060CAAC8DF31E1AB3292275D2B1964CA52382616228A9B087FC000280
SHA-512:	6A109346094D6A72C17B315BAAD7F147011E4E63E52598D65D0A4E0FA44C4AAA40080B7581C141AF958402996EF70B0917208E088A5A7DA0789DA1B154E60392
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx..Z;.U1.>.....n.D..l..EPP.B.B.f.\m.m.E..b.DTPdqE....+..+.....!2......Hr_...Irrn2_...!TF..O....jB..............__...]...../..l .7..W....G..~~...?.L.7Go-..R...{.^.\|h.....&...;+W..{K5..O.-o ..~ ...........V.6...`L.. ..+s.....S...6...{....2.2..w.<R...q...........U...?...%3)..`..z+...M.Q....d\;.`.......@......Zn.../....uv........\.7..S........@.1j.i.\M\..$....'.8.....^.e.V...M....3..S..^m..wE......k..t..uQ.&.....4.~d.0n..An,0K..k..x.5...H%@.^0d..v..`k..1....4......4e.y..[..Ud....y.%....{u..X8\......Ud.f.Qo3.^T..."T....1vS0T....&.I.....&...X.Qe....."......<....Q..O.:..Y...o0..\|...F....pY...Y.Z.0.:!........Wk.....`.K..&9..R.I.r'...1..0I.T....y5..l@.H.^7I......pd..Cu.l.....y...*u<.:{.....H..3..6..\..iR.....`b.......x..8..n.<w......l..B...>T<.bqG..{w..Z...}a...p.......`..".a.....l..6S..H...7.M. .l#...NV..m.A....TI..7}%.R.'.4)........`+..i...........>.\|.!.pbU.jP..pD.g.c....x~.@.1.8`d.p\|?..>.:G&...Q..E.Z....

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\armor\horse_armor_diamond.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17450
Entropy (8bit):	7.979382702840963
Encrypted:	false
SSDEEP:	384:nIhq0EaRfddjdkQTKABUcPBCnGPE+XyvRpOD6+:IBNJZ4ABzPBCnGPEE4d+
MD5:	51B13826758EC891D21660D2CB88C4FF
SHA1:	278D9D10A3DD68AE01C16D3855A4F7ABF7F9FC83
SHA-256:	F3FA17CA0BEE8575F2EBADC00C0B47EFD1F64BDD0D142873C4FEF034B03D33E3
SHA-512:	8AEA7AB487E04BEBDDDEDDC312DB960C16F495D2BE535EDA157098E87491B1156C3A80A680AE91436E6A8706885DB0BCB289F8262F62BE4721F77BB58F1DE42B
Malicious:	false
Preview:	.PNG........IHDR..............>a...0.zTXtRaw profile type exif..x..i.$7...s...N.........tWfJ%.T}^e)...w3.....;........B..e...R<..=.8.K..}..>.........~\|#.....r...\|.~.@........}..}..7~{.O......}..?_.....................w.,.6./E.O...{.$. .4.=...`.V.{z_....v.._..x?...........p.\|_P..F....{+........o4....._...v.......{S...../.M.g5.......W.W.....Ds.k..Cd.o.a..n8.......?c\1...Tc...%.W.....R#V..%...\Kx........xe..Y.'..../._~.x.{..!..c......2.9...H..5.....%o./.MD..27np..y..I.On......g.?......K.g..Cv..KH.J.5..`.....c.q..`.wp..T.N..l~....h..e..@X.JS.........C.egf.5.6J.X)..a...j..Z[.u..r.VZm..6z....^zu.....C.o=...+.q....2.l..H......j....N...eW...{.pH....r.i..q..n.v...~..}.....?D....QS..{]..5.\.oo..'.............3.B.Q.S.\|...E..L..A.#...h7......m...n."......s..7r...?....Q....Pk.....W....z....b.....w..o.o....um.D.osk.R.......K.1....~.^.u..oi.Oic.V.......~b..m...TW......c..@....;...h.\...gk.Be.G.{d.,..>.f9.>g.c...X,...9.1..,.S..g....I.fh#lO.-.7g..U]+%.t.a.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\armor\horse_armor_gold.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16209
Entropy (8bit):	7.972111501442977
Encrypted:	false
SSDEEP:	384:Hg3kOT3yNocP5LP1CbzbPuci00LNVsH3hA3tNl9tjSz:HgP8LtM3uci0eHsH3el9VSz
MD5:	D3A7C85C59CB90219CEC25300D2D9CFA
SHA1:	C7162F0D0427CB87D080AC898B196CD37F8156AC
SHA-256:	E1ED69B60A7F806120F83B3D3B4A982C6B204FD8A0D8A6374496C156A98F0BEB
SHA-512:	3D823AE269AEF9C852BBECF4115D956E0EA1094F6EA3828A6472607DDA6CA0C7FBDA6E83C7974890D69211BB2B55E9DEC15A65CDB35C839500683A92DEBC55DF
Malicious:	false
Preview:	.PNG........IHDR..............>a...,.zTXtRaw profile type exif..x..i.%..d.s.Z.'pX..sz....F..I%}RwgVED...N......;...]....#....V[.x..{........\|~_......^w..".R.{..Y.......7........................s......].y..........K.s..;W.c..K..B.\|mzJb.......`^....+9.._;...Y..~......z..R8_~.(.Y...........O../........v..f7ra..........E.....s}.;..S\Xlc....B...!..F...+,....1...k-...zF...n..g....j...oc...=o..w....Y........7....r..\|.m..W.O3.YN_...........u......&,ho....~~...S................K.........B...XC`.....<..'..fq.w.MJ..g......2.!,.B.).0V.....a.3.b.u.%.\..R.0j.Ts.Zj...:Zj.Y+...z.=...Y/...z.c.......\1.3.<m.Yg.}.....l.UW[}..w......v..+.\|.SO;.....t.[n...;~..U.l.....{.....b.]W.../....Apb....9`.*...Q6.-..e9...HPX.j.d..d1,.O.v.o...r..n...e...,.d....s2....n.c.=^FI.@.B..O.`[.....=.=;...]..{...Y3...<..a..R.k.....{...}.M.:.Vn..Ic_n;.=.1M[.\|....w.0n.s...v..........T..b3..w.~,f.I.Ls..K....J...9.8.f.c..<VfI.....e...\k...j:..8,.b.a...!...\.GFR.Vl....,Ng....

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\armor\horse_armor_iron.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13419
Entropy (8bit):	7.9722603250820905
Encrypted:	false
SSDEEP:	384:8BOKPzJL3Vuvt44aotSDfSgI12GhyLUZuXj2mH:8BOKPNL4NakSDfSgI1T8AZwdH
MD5:	758C2B801DCF3D10316244C30FAADEC8
SHA1:	6C46AA548D440083CD468127F77EB8473D9FFE66
SHA-256:	75BBB487DEC018708D75F6C04A2B61C4664CFB08973C9DDA2453DBB9AD0776E5
SHA-512:	057A69B17B9BC89455C1F2E8E680F46AEBBB32E03CFD07049D5157B439E9FFB5E8952399BD6704F2E6D60F59C9E9429924474C8FB961FBC3BDB46B72893FFBF4
Malicious:	false
Preview:	.PNG........IHDR..............>a...$8zTXtRaw profile type exif..x..i..7.....s...X........>C$."U..Gl...2#._.........q.......[.....Z.\|S........../..y.}.".R.k\|..........%}^......\.~.....F.9...}.s......g.>.......=...d....s.c.....}\|........;.../7...\|.Z..s_..f...~...?.._M..yC..F..}o.k.?...../..!.\..;........Tv.M.....7b....2.........S...c.o..L..X......}.N?Yb.;...0C...XB..:%.?....b....E^._k.....o.....s1.'...}.......Q.z../[....a....]8..M....q................7...s.}.$......\..qoc1Dw.O..\|.O..x..+..<.....fayw.M....{...{...e..GX.JU....)..C.%gf.Uk.s.)[.daT/..b%.Rji..XS..k....[h....[q...z.Kw>.yG.#.8..G.u..'.3..g.u..WXq..+..V]m..7....w.u....v.I.N>...N.....z......xM.K.}..x..........XH...y.....S}JA....H..x....<.........O........W.sr....\.......V..%^.).e.'..m.C.n.':(2.4^hQ..TN.{>e.J.[.q.......u.....5b.m....1.5.jm..a.}=..5..K....c...V..o37B>.a..W...?....8.wm....@I...F.;6...j0.h.,...a/...:.....wka.}.\|N.y.Zx.~...K.....[>aOJ.v.$.Q{J.....Oi....x....}.J.h

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\donkey.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15049
Entropy (8bit):	7.971141224264498
Encrypted:	false
SSDEEP:	384:dn/sc+0n3yElwxy/NN4MLDB+1I+CevCz1df5X6YA2dFHoqsco:BP+0n3bll/UMLDyI+TqNX6YAkoq1o
MD5:	4B239BCEEC1A1D45E8D14DBF2B39310E
SHA1:	6CED9000B74BAB75D26C60B7E7601C524005B006
SHA-256:	3C25CABF82CCAF3A121889946DE6D50B36C16B7A219D21969759AF5EFB63B74E
SHA-512:	4FE974064BB95E7B69981CFF525917E23919845DBDC29C4A4D4DD471F6F83D0482BA3B470A49DDC6EC5A92E3300F9084BE677623705361BEEF5826D42F66E404
Malicious:	false
Preview:	.PNG........IHDR..............>a...%.zTXtRaw profile type exif..x..Y.\9n.../..8,.c.w...;..P.U.!.~.K........".....u......e...R<..=.8.....>.................3}.Z........j..>.....{......~\0.....k....y=\|....s#..8...y...{.?.=W....St.$^....$V.z.....7.d..S.w../c.~.......O....z.c(./.7.?...z......+.......=F...~....{>O7r!R.}.....x.$..}....s}.:......nN~-.z.D...v....\a...O......Re..mJ.pce{.K..Z.Z...s-.........3...^../.W/.o~...J..\|..+....2.s..w.!.~cj/...-o.o...A{an<...s.i.Wn........J#....!...b...\|..B...XC .....<..';.....7).6.E......-~^.Z...D[C..Y9..Ss#..%...Uk.m.Tr.RJ-.QS..j.....h..f...Z.m....f...z..M...\|z..1f.i.i..:..s,.g.e.....k...w.....'.R..c..z..g\r...r.m...s....].....k.k...W.../....Apb.3v,...W..I{.[.9j.g.G.."..L...v...'D........o...h......._...}w..../vm..(.m..P1...l'..Z.6..j..j.r....\|..s....S/@.O..C.'.Q.t..:1...g..=...).bOK...}.........m....7w...k....5....bV..).)..k.[w$4<]!..].I}.6.rTv.w.\|..v.B......%....a.*......ZC.....I......oI...\g

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_black.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14995
Entropy (8bit):	7.974818611976523
Encrypted:	false
SSDEEP:	384:8SfNdSfRvVgpmOvVeYV1zdzpuDDQAatMZ0JTTck:8SF2vFOvVeY3zNpu/QAaWZ0hx
MD5:	D83A532A0EE9C1C5B7DADC764C1E9923
SHA1:	5D0931BD042A219BFB5B6252100483D821CFF6F0
SHA-256:	BCA180963642BC7A94694CC2111A2DD393207F728344276057F5670F81F43E08
SHA-512:	A0264C0AD4AD13BC56793C97860DE6EF17AEE183855FEDDCD4DFD3663FF40095475F553AA4703FBAA401639E016A8D95F064EF8734F9BAAD1F10A2DDBCCC6517
Malicious:	false
Preview:	.PNG........IHDR..............>a..."vzTXtRaw profile type exif..x..g.d7r..c.Z..Y.L...@..w...b.9..Q.Y&.{.".......u...Jw..^G...y..'.t.....\|~.=...........?...j_..<^.xC._..??....N.....?..t../_.._.J..x.......m:_...._.....X.S.^..Z.........&....y..{\|.....v..,...~Y;?..O.^....../k..x(._..B.G.....=...........f..Tu_..1.../dQszo.\|5./.....3.M...\\|m.F....9.0...~..b...?c.1..zjq......nl....&j.....w...C..'....X....r.{.....B.uC...Z1...f..............}...-.......N.>.X....VzqN......4B;_.`..wa0dw...TB....B`.;.<.........%6)U....{Zx..%~..Z.DI.R....s!.Z...,.dWJ...^F.5.\K..Ua.l..VZm..6...^z..>..q$ ..:..}.1'7.\z...+.\q..WYu...Xs.>;..n...'.......g.i.H%.V.Z.n..%.n...[o...;.F.+...Z.%r.:j.+j.X~.k.D..[.q. 8)....9.....Q1.=...9..HQ.H.BQpNP.`....?c.G..e.\..Q...E.)t...s..W.....D...(..HU.5...l....M..wm>.@...z..ln/.z...A..3...e..B.....*b.c`M..6.(}.h.Y(....[o...k:7.#$....?..+!ae..8..y........(D..jq..u..m.{...v=\(...........9...3F.j".6.......s...A..._.....e...\|.M-..p.`..c.y..F:

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_brown.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16184
Entropy (8bit):	7.974785097720224
Encrypted:	false
SSDEEP:	384:5YQjj86pcC+WQvkevUiqlUGNNqTH3y1op3jWM2lBOw:ljlGC9oVviS8NuH3y2djUnOw
MD5:	E67C64B76EF17D97676A4539D4F1AE00
SHA1:	F3C92B639C38F4612653F14A961EBAA838C9B5B3
SHA-256:	85FD48F03DEFCF8A75987240E3356716AB5DB16F5DE8B6A67DB92A6B277BBC40
SHA-512:	181D431CA3641C2AC06D3805BCA981DD3DFA2CEC2991F4491163D497009249109B7B62D9A51FF6AFD1078FBDB39275F2BFB04606A76CEE89A0B9DC10DC80FFDA
Malicious:	false
Preview:	.PNG........IHDR..............>a...%.zTXtRaw profile type exif..x..i.$9.....}.n.r.."s.9~..f.dTV.d.dH.{.............s..._k..l..^...s.........\|~_.{.../.........>.,........5._..}....N.^.....L.s.....B)~^........M.....z........^......k.].#H=.......Z...^.)....?..x?..c.............k.}=...[..G.~../.(%...kww..\|f7ra...N..T.O..E..}.......?.?.).".....r...j...#.p....C..........Z.......'.X..v...E../.c....o..w..1p..'.......??/t.R7..~....i....+." .~.....?..56?.....enLp.....$.'..s.}....u./..qoc0dw...d.._c.!.....F.S.........&.BpZ..L.....e..@X.JS.........C.egf.5.6J.X)..a...j..Z[.u..r.VZm..6z....^zu.....K.>=x..3.4.Yf.m.9...UV]m.5v.iS....v.}....t.SN=..3..v...n........oT....G...o.....W.E..k.q. 81.....xU.H...r...b.{.(,..`.......'D..g.~E..........].B..#rN..F._..7Q..1Jz.R.jM}....-........+..L.h...Rc.~.&k5.W...D...k....s..n.[....3.\.@....x..Q..s...s)..)f..;...W..q.#F..*.vZ_...m.p...z.b..d..t.....N......8.....F...dz'...r9;m.A...X...]Z.V.`..T....4H9F...m.y..q.I...).

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_chestnut.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19284
Entropy (8bit):	7.979618451821109
Encrypted:	false
SSDEEP:	384:0r6Aq7gHxuSjfkz1Ce9cSCIekbdfkgJjSY1AyUXwv9S9sJhT8HV:s6AFRuSzveWSC0MYSVwc9gE
MD5:	AC1406437AF5231740A119F9F0ECC98C
SHA1:	A789F1E1F79F1CF7B868036FF62D2604CFF9E174
SHA-256:	6E37F7974D25F2A777D5B7B98A695C806B1DE068D56758B8C097644CB6EDA024
SHA-512:	4C83AE19619C814DD3233669AB8067A56587314CE285C55F3C44FBEB93EFFDBEE6A2838A8C03DB20D6CE8D5327421C7D3193D29574E76B66DB8797D9D9B755E2
Malicious:	false
Preview:	.PNG........IHDR..............>a.../.zTXtRaw profile type exif..x..i.d.m..s.Z..a9..s../._0....K..c....2.@.........]....#._...:j../.<...?..\|.>..?..~......"/%....\|.?y........__wm}.......&.9...}.{..?....n\|?7.O.....oz.\|......p..]<)$...$. .4...WN.k...{.....s?~.e.~......}=.u)...7._...z(._..B?_Q.....C.......kww..\|.n..JU...?n....Y...*....~n..._.....X...\.!..7...7..}..%.xb.{.+..ZO-...Q..q..3l.:.XX-.r.q-.w...9...3.............q.{.._..V\W.Os.....,C\|...}..O~..2l..-s.....!.....J........Fh.{...s..... DH%..[.-..c....a.PJ..]l.R.8=..\|....X..e..C.T...@.X9......Jv..ZZ.e.YS..Z[.F.Zn...Zo..z...z...G........sr..'...cN..,[.j.....Yy.UW[}.5w.i.....v.c....t.)..v..g^\|.o.......V..../...V._..b....i5^n.C..I..X...7Y......!.(..f~D..D......,........v.Z._...o.-.3.9....rN..Z..v....\|.%=.)...>]....v[.I..........[.<,.1EWY.....N..v......3.6.".2.....l~.._..-._......\,.Y.pRn"Zt-..n...W..nZ..v.jm..k..F...n...].....t...2B..F.kU..`.<..n....a.r.]..=.9.....6k.\.......Z..-.......

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_creamy.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19090
Entropy (8bit):	7.979021262814866
Encrypted:	false
SSDEEP:	384:n2D6klychCuGr0mE4fH3EGVc4ryypOuhPK1nnY+zw5Vlj1RxeEVVGn:n2BBhfGImhXEGyzuNknnY+KVJgEVVq
MD5:	7056744ED379D19342595A001282CCE8
SHA1:	F031A0BD12F032F2475A9E8ADB6E4B2C08FC000E
SHA-256:	94A36E636AAD8A7336452AA07CDC93E830DACE756B140E4952C24D6F056CC485
SHA-512:	D426BC4FCDBE13F3741D7BA5494377DE79591BDEC4FF018611702E2C23F95FB807F2088A36BBD8179E880172FDD2BA6963DBA59F7DD9068CB57029068A4DBC39
Malicious:	false
Preview:	.PNG........IHDR..............>a.....zTXtRaw profile type exif..x..i.\9.....}...q..fs.9.\|...T[....................u.....!.\Z..V..y..'.t....5.........~. .R.k......'...~.......][....?.q..;G...../.............\|...^.......p..]<)$..]wI<A.i.wx.sc^k\|..:yG..s?........{.......p.~.P..G..C..{;..............._...~...n..NU.]....x#..?.Q.....}{...:K\XlcM..ra..n...3.p........1...k=.8.zF...nl.g....j....g....o..w..1p..o....../.~^.^.n ........<.,..y...........~....a..,o.;...>...S.\|+=;'.W\|v........".]x..;._C...bl!....L.<.....R...b..*..Q..wZx.%~^.Z0DI.P.. ..s..Z...,.dWJ...^F.5.\K..Ua.l..VZm..6...^z..>..q$ ..:..}.1'7.\z..w.i.e+V.Y.as.>+...j....;m......{.y...N>...N?....t.-..v..w......Z........j.X~.k.Y..[.q. 8)....9`.&...Q6...(..f~.Q.D......,........v.Y.......-...L..a9'.}-.g.....\|.%=.)...>]...C....L`u....Z.8m.2g..j[.%.iVN.......S.9.z.#.....=.~...f>\..R....vv){.;v.....6'42.g.y.Z.6.6...m..T..u.uW.3..S...k.;.W>`!`.l...f.O.0jY........P....i>w.f.&;...1ls.\|..].`.....wW.i

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_darkbrown.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15040
Entropy (8bit):	7.974551815643114
Encrypted:	false
SSDEEP:	384:dqoWoA6BT7utkSQbaXBYP0TWdy9f4MhRAeFJmcxD834PbC:dqDonT7iIGxlWINhhRA2mw8CbC
MD5:	40BC2DA359C1E9EC3D2B814FA924E2DD
SHA1:	0746C92ABC1DA4D0C971F0C36AE868B40F81E7B2
SHA-256:	CD04AA6DA94A86162C50B2C76C11CDDD8696619654A842BF24E31CCA47816B2C
SHA-512:	51EA6D007A29F0E7A1F698AEEF38DFA3680C258C8BD2C3CA1967C5F328BA44388EEB86B5DEC271CE4A5ED8F13F1C7D1DD86EB513AB6B1D1D79A16D0B72A4DDC4
Malicious:	false
Preview:	.PNG........IHDR..............>a...!.zTXtRaw profile type exif..x..W.d.rE.1......@.......Q..f?......9&.6..;............z..z..G.......g..}......w?..<...>...}......Z.>....k.{..=.....L:s.....@)~......o._n...-~..=....F0.p..]<)$....$. .4...wN.c...?g..u..._.....~......C.\|.........u.^.~......DZ.._....k....+...{S?n.....jN.m.........\|unq.1#.......h....n8....K......wL.Z.q..d}....1.:..d-.p.y-.w....9..^........._=....y.{U.!..3V\WTMs.......7....}._.....D...s..._.C.OQ.j+.<'^W\|v.........s.......J....[......."...h.]r.R%9=......X..a..D.Ti..."Y9...N..Jv..ZZ.e.YS..Z[.F.Zn...Zo..z...z...G........sr..'.b..WZy.UW[}.57.......{Z.d..Uk...'.J..SN=..3...M7.r.m..q..}....2....YS..{].#k<..C..IQ..X..7e.....!..)g~D..D....cA.#...Xn...?2.O..J......sN....S....E.l>FI/A.B....]!Ei~...../.u.~..n...k..L..%b.am.a.y..,u..b<g.si..9...._9.B......].H..].u.p.S.q...1j.Z...<.G9.......).~.}...X....).....N.y[..P.2..g..b....S..u...y..z<...k.C~.o...sp..;2m.)....G(.b7..;'.Y

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_gray.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16127
Entropy (8bit):	7.978786117254709
Encrypted:	false
SSDEEP:	384:LwO1oTLLUbnt8MdekWzlx8MdlJAimf6WaY92wO/V1IPJFWSEAksnD:d1o4bWvMuyiex2TiS1cD
MD5:	738C654EBDFE7560A8FEE473B8CD40DE
SHA1:	9A3920C1E9AAB1BEBAC13EB593186C1DD9248CFB
SHA-256:	8AE53B120E599C5D10F6864F24E3565B4D9E9821F892D073E33DDDAC89FFCE1A
SHA-512:	313E272A690C7DCA3AA0B27430260BF054305D2DFBAC763E5BE4DDE1D6A7078E6C881660470F9F6E2705A470F236722BC162611FD8F2641267796E3BEE1C913F
Malicious:	false
Preview:	.PNG........IHDR..............>a...(.zTXtRaw profile type exif..x..i.%9...s.Z.'pX..s..-_..#......O...q.;I..3......y...n.l..^...s.............^z....._D^J\|O._..y..u...5..>......:..B?..u..;G~.y_..P.......\|n.....k~.%......+......I!y.6.%.....kx_.1...s.+....?~............_......3.y=.?..;..W...._~a7f...........n..I...._[y?.F.5..Q.S...s}.:..[\Xlc...B...!..F...+,....1...k-...zF...n..g....j....k....o..w..1p..'......;....r..\|..XW.O..YN_y.&...L....~....a...w...?.K..?.J.......F.u.\.#...b...\|..B...XC......<..'..fq.w.MJ..{...{...e..C.!R1....r6.....K.......(..b..Z.Q.....Rkm...R..Zi.....' .z....{.....=....c.8...f.u...X....VYu....q.M...m.=N8....N9......M7_....n.....X..V.....m..c5Y,...?.....D...l..b.X...8t..\|.9GYN6.=....Z0.g.Y.............i7g.?.[.w.s2....9...r.j...../..g E......d.^P"W..`.:;.S..i.-v..N..MX...[....k;...h.W....'..Iq.a...Gea>...........O.i.>.Z.dY...z8.6C/..]i.9\|..s.j{...Ro.kO.:-p......u.zW.X\|..\|......+a;..l..^.1.:...l2n..S.d..3.&...C..p..V.`.M

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_markings_blackdots.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4889
Entropy (8bit):	7.920754151984865
Encrypted:	false
SSDEEP:	96:LwL8TI7Tbc71wJACBu6sR98zjRHO+r80jWcOVKyULzTiq3molNTDpoCHgLWDL3:LwITCmwTsRyzjMRdcOV9ULzTdmWXowgy
MD5:	230C84F3C341864DEEA59CC48AE942D6
SHA1:	88EBF8179245094FCA31345330586425AEF93081
SHA-256:	55FDDF43140A35F8851E1792EAD2791051F38C2E47D7C82C1CBBBDE79D6E0AF0
SHA-512:	1CAE6E10152FA5AC1F8C44AE0F5DC05558629749311C8A47F8FE6A45CCE40CB5C89FB4F81917E924366E2D3D1F97457E60EF3B5F4B027C6498A8FC1B251A21E6
Malicious:	false
Preview:	.PNG........IHDR..............>a.....zTXtRaw profile type exif..x..].+'...YE.......;..s....LnU..)eS.Z.>.>Aw...9...QNW.5O9..?......wk.]?...'{..`.".x.L..........`....:7>.....9~~."..t.C>..yZ....%.:...b.FW.#...v.F..A...]3.../...c.....{/......W:..%F.N.}.v..gD..?..\|..K...>..HB.R8..X....".q?.P..E.v.(.%6..YQZ.L.hO..Th..m..)..6...y4..6.Y.&...."...E..>....=^#.....1..Z.w..)w.9W..]~....+.1.En.....'...Kx...l.A.av,.\.&Q....7..?.$\..A..B....Av.]..L..c6"....`...+..w..lbL....3F..of.-..1E..l ..Q.#..F...IM]....$M)YZgT.hbj..........={.#.0.)[.s....H.<].QJ...T..Z..kiH.&M[j..V:...{.......T.2t.a.G.e".f.2u.i.g..N.P.L.^.....j..l?{P...C..q........".....r..En1...P.5...."..2.u.../.......\X...ra.;.r..Z/...7...WL.8q..axa/...m...[.-..._..o...]...&Td.&......pLR.*.W.JC..y...j.......m...[.-....P.....o.}...e./....bKGD.#.......p....pHYs..........o.d....tIME..............IDATx..y...y.?3......l..,U.K....\.c..h..&..1.6.1.i.k.......xR.4.F...b..AT.1..2`@...fd@.a...\|.W2...e..y...3s

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_markings_white.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2129
Entropy (8bit):	7.779566246074805
Encrypted:	false
SSDEEP:	48:2txeczSrOEasdkYdA+IP6wacje5IWP/9qXPnCZtchzS82:2D6OHsCaA76v5jNchL2
MD5:	3D3AF0FFC08A7E06DC18318B8F6DF4C9
SHA1:	DAF3197D9D89250E57B167A9FBBDA25269C80CD6
SHA-256:	A94742F717ACD00A00BAF9ABA1FC1260217F867F8626C53C765CDD7CEF640B2A
SHA-512:	F27D41648BB476805AE7C17BA3EFA0B095856B4D0895AF959F4F00BBBBD05D694B08B06EF31641003FB8D56D8BF93FAE5FA13F013891B54EB114692D95B7D444
Malicious:	false
Preview:	.PNG........IHDR..............>a.....zTXtRaw profile type exif..x..X[..)....{..K.8...7..o......;n.8b..]4E...J........'..\.,....I5.....>.N>....C..?....k\|C.~.........+.\......f.h\........{-=-..7.......;1.....(..~\|....A....w. ....S..v..\|...z...?~...r.(/.]..?.n#...=f... W..y.Nu..:.k....E..[...e..\...m.W.%X..c.lv\.Q.....Mj...}.@.)....0B.}.9.06).....a.(.c....p...u.7H0.$...`....}..+.=..I....+..L.H..o..!...y./....Dl..y.,X`........q.'.Oi..+. ....@.\|........8..i.<..:....$..&..r$..x.i..9.nX....T...d....N....sr9.9K...XR....Q.#'.\.Y.r.(I..a...j....k...Z[.....n..Z.=..s/.....\|F.y..CF.m..'....n..-Z..J+..x..)..Q.f-.Z..Y.X....0.c..b..K{.?XC7.-...d....D`...3'......9.......Q6r&.c`0-.Y.......r..o.{.9..w0...oy.......7AV.....c.%-.F(.Yt....K.bT.1U.S..qM...D.b.......C..aHk....x..`.....e\|Kc.4......QkDc...v.:..V6.6.-O._........y.I..5...d.i.\|..;p._..(sv.Q.....r3. ...G....I.}de..g7..7....DC.s..3.R&.........@.#P_Vj^%..<.`I^.3..v.......A.....LPa^.N...G..Ui4.Y..+...x

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_markings_whitedots.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8340
Entropy (8bit):	7.9574294074424134
Encrypted:	false
SSDEEP:	192:nKBHi+H6gjDRQGYBKIIcTxIPwcNP+mxs0SuGVm7cmwFqF/SVTH:nKBd+GYBRIcTxI4Ommxs0JGVmImw/
MD5:	DD2F94B4B097FE43ECD34A7484117883
SHA1:	4025433AF3D8AF5A9F087DC1218166CF74AA144D
SHA-256:	AB0ED61186F225C0BAA275A959B247E20D8E30C4C221C1C143DEDC8E3B030A2B
SHA-512:	75177D2F0523D3F819159DE7099573C119F0C1E85A2DAB290F6B00CC736F6449ADCAB80553AEB3189EB856B5960DB0AF0F00A8B4CBEC22230DCD1BD637DC09E5
Malicious:	false
Preview:	.PNG........IHDR..............>a....ezTXtRaw profile type exif..x..Wr.8....Y..Y.l...].\|.d.$uuG..)E)3)..~s..f..............r...-6.yS...yu6....._...?x..^..1............qS.;N}.z..c..;{...w......l.{].....?...J...?.B0Vb.........f.Z..v.77.X..c....x.-x......x...c.{B.....K........w..Y]...}..Y......L..y..c)..'....e......r..?.%N2....g..'..E.\w...:.d..o_x.~.p..P\|..&%..._H.2...I.....\.o....r..8.;.s\......c.sT.....+..U.LC..o."!.1M7...\|...).............)...s.d..Ok.......NL...f......s.....}.~...._..r.B&9...\S.=.'...ZHD..V.j...c.~J..PO.<J).T...z.9.s.Y..K(...K)...k....k....o..K-.bZm...M;Cw.....#.8...:...q..g.u.._a..+.bV]m..6...N;..n..j..O:..SO;.#koV.f.}...g.YS..=.....K.1...$....xQ.(h....b..rf..).'k.)9.)cd0n..q.....?.I./...^.R.od.(uo.~.._dm..(.&H]...p.6N....Q3V.>.3.......,...._S..0....q.....}@l...u^.w..NY..-Q..S....-,W......w..I...._\|5.......8....J4.....}.p.:.q..lZ{.12.0CK...T..e..9..S....6.m.]..N._..1..g.7....3.Od:....}.7.g.kLn,..e.r!.q.H).9(.e)...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_markings_whitefield.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7661
Entropy (8bit):	7.956343740260979
Encrypted:	false
SSDEEP:	192:t6t1JRs00qD0Zsu8ZKu0b3z7oCtpStFufkHLk5:gDLs2UL8ZKu0bh7StOkHLM
MD5:	7970C030AFB985566E4DB273428EE35C
SHA1:	7D69B12F2834DE26740760B8B7FD035DB261E98C
SHA-256:	C76D100596D8230F6253057A199BB6BE29DA927B04BD08BFCC242255566C4D24
SHA-512:	7F521563FFAE5F2282E84A0CE1D2B845756CADC7B51596EA45130C633C0EFE5509C0C0DD386BEF240671AF3DAED85FE4CD96197DC107949A79D634A25328F589
Malicious:	false
Preview:	.PNG........IHDR..............>a....jzTXtRaw profile type exif..x..iv#7.....s...q..77....(JM..q.[$KU( 32".e....c..O...J.-g.Ol...j.....x......7........k..;...J\|.._..2_...@.?\|..tg..y.5P..q..n......7......B0V.`....q~W.%0..B..='.P..C.G..cg>?~...o...u<\|....uB....q.~........w...V....[..Y......L..y-.c)..'.B..e.W._.s.....I......q.y.}\t.uw...M.....w...X..7?oR.^..Bz.!#>L..8.?...}..t.;/..1.........>.:G.u...X1/..3.eN.9....i../.....@...se..g....l...`U...4\Y.....NL.tGg...eg...9.X.Og.@..2.R..CnB.$.z.k......P..H!.Bj( ..c.?%V0.SH..r*...z.9.s.Y..K(...K)...k....k....o..K-.bZm...M;Cw.....#.8...:.....8...:....(..W1....v.(.........p.I'.r.i..f..Ys.2..Ys..)c.W~d..\|..D'I9#c>:2^....rf...+s.m..H.....,......O.}..G..4o&..7.......Q.^..c.~...... U.bj..8.kr==....D...-...>.b.>..-.9..[....~ .cMf...6"..L...#.?,.E.......uX.ff(ci3.wo^].f...a..J.{.8.{.Q\|w._....w...Zf..P.TsH.6..B0}r3>C...3...........tiq._...u....>....RG@ X...Jcr...J..l.........=.b.NY.-...b.....

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_skeleton.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20197
Entropy (8bit):	7.977814809643083
Encrypted:	false
SSDEEP:	384:0pu6S2FcpdidC3pa5xD8N60nRqyU/7rawFdXerQ7fj5uVlZwq4yPR:0pu6LcudCZasU0MXLdXKWliEmR
MD5:	A165C62C0B7F0CFF5409D950BA09D448
SHA1:	2638DF0686EAC4095CB1D284B10C918B1F46E1CE
SHA-256:	78ABBA91E452252617C0C54B87A169365CB39D289FAF01DDD6C446F1C351F509
SHA-512:	3F7A7F95DDC8662095D508990E5A357505FF00F1562DC161D4B9290629BD1A58BB1971D60C761EF85C936F9676A4CF278495B9B7F120DAF90D7E8FB70DB423B8
Malicious:	false
Preview:	.PNG........IHDR..............>a...6.zTXtRaw profile type exif..x..[..(.e..l.@....h..A5..D..+.3"sT....go.......X..........x..H..r.r...Nw.........L...^.....?D^..~}.................:~..~..._...s.....].{=..~.?...............{.L..\.G\W.N.6.r1..:_...x..:.]\|.W...;~../...O......~.y......e.~^....n...G.~.........:w.l...0S..y._....Lj......e~.....#.Vl..........7.0C.oX....!..b.{.#^..v.x..%./...<..+1X....oc........;..;c.b.O....^.....B..p...qEm.a.r~.],Hx..4.......k.ka/V0.in<`?....g.m]{./..t..k.:....q..`.......J8k.5..>..c..a.B.q..em...8-zo>S.~o..{.ha!.U....@,VJ....aC=_9.9.kn..\%.\J.E......Zj.......[i..v.~.....].z....i..Ow......IO~.S...O...H#.2.h..}.yM...Y...=...SZi.UV]m....{...oy........y.._V._..j.X..../....A8..+.S`.+.AG..l!...f..q..Y..]..\1V0....~[..W.].#.....Z.....r.K..r..n..j..r.......z.6..'.-..yW..>.6V....pR...B.?w..]i...F.5.c../.q........>.o.s.2&.-o.<S........ Y.7.#?....=..`Z..{s.x.;.7.=...\|.<..d.:...u...;.xr~...0..-...Zm.9.m..%0[.\.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_white.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19183
Entropy (8bit):	7.979799331795542
Encrypted:	false
SSDEEP:	384:i4PMGdWs3KmLCTw79I9Ri6ptP3u+PCokggEp5EbjO6E6DCCWGP51:GetKmLCUMR7zPHSJE3YsGP51
MD5:	B83AFABBEC8F436E3C0B635B5765F267
SHA1:	9316B6736F468656644A989751135D917DD55333
SHA-256:	43800DF66037646A9428CAFB95FEFA0839A98BAD76E3D5DD102271F3ADF485AE
SHA-512:	DAE77C6DD7A063A0FFAEB20091BF95F26B8C4C0136A12D3AB68A714B4C0353120164D65F89FA636519EB6DE707E19BB8F46325138F7B09E6615F5BC32C1DF541
Malicious:	false
Preview:	.PNG........IHDR..............>a...29zTXtRaw profile type exif..x..i.$....c.Z..a9.........I.HQzO:]EffEF.....`pw...y....G.-V.K.u....G.q.C...{......O.....y).=}..........h......].?..?....o.L:s.........~.....f..v~.../.T~......`...Rt.<_....4..k......?.T.ZR...s............?..?......./c..z(.?v6B.^Q......jq._..:v....ww3WF......V.'...o4*....~n.w.s...;....va..h....3.p....K......wL.ZO-..mR......s\...f../..%.y..o..O..1p..'...........=.m...>V\WTLs..9}.]LHx?cZl\|..%n./....b.....w.....[..9..._j.v~...q.....9..R.5..c..q.....c.q1...x.{.MJ...Q..3-.{c...@..QH...@LV..i..C...])..Vz.e.Ts-..V.Q...[i....h...{....s...2.hn.1..tr..'.s.V^e..V_c.M......'.tH.SOs..q...P...[o...;.........o.......g-.e......Y.e{_.c.x......'Es...... ......s..i...$E..Z(...4c.`.!..~..?f...+.?....f.i.........?......(.&HY.1...lg.4}_...'.]...8....b^..p.............N....:.=.u..v7.Z..J...>.^.o.G.....<.......<....w....;.u.....[_....k..VH.).\|.<....^..v..H.%F#._o.4f.t...9.l..q....3.Q^....G....

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\horse_zombie.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20408
Entropy (8bit):	7.977872505851705
Encrypted:	false
SSDEEP:	384:xnqHcvsXqPzM2Xn8rwx7L5TuGhuygblcE+H2zXDnbC97MF5jT06JnvYm35D:xnGr2U+7FyLbl1Xzba7MF5PBNYm35D
MD5:	289DE271718A12C8C841CA85F7CCD739
SHA1:	5C903753B33B6F68B0131749D44A5D19F5E9D1FF
SHA-256:	B26921FE363B59D701FBCACD512AEBE2E688AC987E5DB5FD54219741EC765446
SHA-512:	B476B246D6C5A1BC986D573B524BD6932ABE0A3D1899BA6AD67DFE6233244DD0AF6A1C8C13F054176BE8FC90AB1D450041DD7DDBEF4FB9803DB1E2756E65BF63
Malicious:	false
Preview:	.PNG........IHDR..............>a.../pzTXtRaw profile type exif..x..i.$9n....s..$...L7...93k..i$..t-.2#. .p..t.?.......[......._.lq..?....\|~......_^w?..y).g........._.h.......u..B....`.#...../..........F..q....^*.....0..\/E.O...{.].+H.....{.R.._#.T..v.._.0...a;?........}C..F..C.{.=.................vw.{...F.X...C.x..7.Qsz...j.W.{{.._.G\..f7'....".!..F..?WX,1.....bz.....6%.W...=..,v-.r.....k.~+t.....>.O........B..uC....XW.O...~.]lH._..g.....7...M.`yf.<...s..q.o.........Fh.{.L.....s.5..j.-...v...`.1.8.PJ..].&.....{...{c......F...5....s..Z... z.+...J/VFM5.RkmU.5Zj..V[k.Y.=..K.........b..nfcp.......c..g.y.Yg.}....Yy.UW[}..;...]ws.o..+.\|...~...t.-..v..;~..wW..k...w-\|wM;....]...~\".N.....9..M;.CG..!..y.\....hsv.....Xn..w.v..7W..j...9.....9.....?....../...A.B.......sK....o<{....`.N...R.:.[Bl.5.B....>..[...\S.m......ge........:o.s.9v..n..dL3c..Z.Z9.5,......\3.......;f.c.tN...~....0>.yW.q.-7...aX...v.UkN....z..6K.<Rjw.......X.....X{=._S.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\horse\mule.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14960
Entropy (8bit):	7.966158735776266
Encrypted:	false
SSDEEP:	384:BU4pEBIcezHgGxHF0KWH5dbFMGQpiPtsAAXk4JUgRSi6:BU4+B6tpWZdbGLpOtUUkEj
MD5:	03FBD56E0CC98E0E1CDCBEDF0940C92C
SHA1:	65918A6B808F6035C84920C99954B9DEC46D46CB
SHA-256:	F1E3B90A23FB0F56C17714619B94983E5B83C24C4FE8F108CF7C3C6B28B77CB3
SHA-512:	F777EC82671D4EDDF59E795B9CBBB1A50F3ECCB7D47496A1B65E7A52A5EA84816D8A55F95611B3DFA00C368F458601BF371E8FA0EEFCA59679A77C9609BA54E7
Malicious:	false
Preview:	.PNG........IHDR..............>a...$.zTXtRaw profile type exif..x..Y.$9.d.q.9.6.r..D}.9.<.zD..]D=.4_.Q..nn.....,.-w...\......\..J/.._...7...}.....?..~...../"/%.M.........^..}...s..s.._..`.#.....\(......?...O...{.O.d?....b.m\/E.O.........._...y........m.~..7....o......WS8_~.P.f..............b........{..\.Tq?......o.9....T.........6..Y......9.0......b.9.X.7...{...{\.)Y....l...Zx-.r........Vh.y.............o.......\|.m+....2.9}.]8$.........7.O.Mx.....~~.._P.......3...R#..s.L.....9.....\|.........<..'..fq.w.MJ..{...{...e..GX*.....g.l.O....,;3+V.Y.QR..J)...FM5W....j.......jk...cO@.....>.7.\z...;.q....2.l.........j....N...eW...{.p.....r.i..q...n.v...~.o..x..^.....Z..<.....^..Z.]".NL>.c1.<^....\|.[.9.s..QP..Z09g.y........w.x._..Y.o.-.W.sr....\............ e.l....p3I1v/.t....z.=k..vo3.'.........iZ..].z\|q.S&[..Z....x.j..b:1r.i..h......j.......n..V..(9>..v...l........~..y].6,....;........{.6.~....b.8.]{..C.g..k..X...H..=.......[Wb.=.`..E..m.2.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\iron_golem.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2842
Entropy (8bit):	7.742074577564768
Encrypted:	false
SSDEEP:	48:3WiIyQ+qJwU6/B/onFn40GTa7UR53ExPZnPl9dLqLulfhqIp+2j:mLiqF5GTaW3ExtP4iLj
MD5:	2A7DF2D96F7EBC69438ED73F2EBE5DDC
SHA1:	6F744D07EBD1C0BFE15DFA97C3B80E74DDA8CDE1
SHA-256:	DD01E35CA9FF8968EE817C9C7F32A787486E08616F774F6023FD17E1390509BA
SHA-512:	27985E8E622B00C6C651E868375E8CAB15F5852938852DCC08C74C277F3F8E33FE10DDD47FDC3FA2918B4960C4C098D2303B194E2F5395A546289CEE37D34A28
Malicious:	false
Preview:	.PNG........IHDR..............>a.....IDATx..]M.]E.._.Op..Q.2.....n........B..dc.A](*.E4!!D...Ag..et..M.2..O\.\.....#3s.VA..G.~.u......V....n{{..q.f...w....ot_~tn.<.'.9y....;\|...?...y...W....GO....F....=..!._..e....?.V.N...........<.=hz...../........>.....7{..;>..x..`6..0..~........hy.....k/u..9..........9w.xZ.......Z...3'.../w.......rl!.x `=.W..U...P..........b..i.6..>.?....0;.....(H.k..Z..WV.u7..o.0...\|'..B.....74...1.Y.@.....N9.SH.g........g..J...0.c..!....0p^.......T.d...C.&.F..H.`8{<^..2..chS..x..I...2...km...yZ]...V./Y........L.[.....p...y4...B.e...Z....Q.....N...W...?}...}<S...8.q..h..@..x@h.....@.Jd."..G.......;2{..........&.....f..5-]......u..... !.....La.Y[...........>..>...2.Y.....Y...kU..j)h-...4..l..g.....s[...5?......=....RK......Y..C;...K>@3q....{._Y;6.8..k....A.x.@#......>...+.Z.04.\.{...=.7.. .x..r<......n.0..R .kx..+$.a.....L..V...M..":..'.6L...?/.D...P..9}.......xQ@........[....0.Ku({.)jt....h.\..=...z.%.ph.4...]....i..35

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\lead_knot.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	414
Entropy (8bit):	7.34867916001029
Encrypted:	false
SSDEEP:	12:6v/7i79B35ArUVN36dWPFxcC+LRBiQKI/tKTws:FjJAIN364D3OiQJ/tKTZ
MD5:	B7A8B4460D755CCD2377D2E90D13A55B
SHA1:	65D346253C64B2C6E790FDB039E7481231BE6866
SHA-256:	4133AEC220015BD66709408D7FD4479BBD2F4BC77CAAD2E8202F50419CC3789D
SHA-512:	F3F226D038E0529F574B6406F8D4460B2BBA50BDA355E9A2FA0337D02F51CBB1A84FA47AAF1BE8A621E6FDF07765B76AD030B3079D6E09A3D56C45E1D74D2345
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....eIDATX..V=K.1..oR...J.O.....Q.B...F+.-.....{..#...1.H..K@....{.{3...\]..{.0j.........k....K.H\|....hH.Q....n.p>.t_O....W.6?...%`.6G..@..<..&.D,..=t6....d.+...~..#jz.0G.u..f.1.V.`.y...W.j..u ...(..ICi.!\|.....;9...Cv.......i.]...9.o.s.3@.)...T=........5}...M.....z...;\.J....&.X4....E.[.9}/....`.r>N....Zt~..hN..o.>.w\|J....H.Yw.PD..t...........?..*p..#.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\minecart.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.628923288257611
Encrypted:	false
SSDEEP:	24:XbGLWcv2cRoB3xFs+UmGGD/Y20oNR0R7c5LN3O7mL:XbmWcvhRoB3U+Ukw2Y9c5QyL
MD5:	1038022143D1DEEEC892191F6BB6CA1A
SHA1:	FAF99932B8267B6A01D7D0F8CBDBB0583013104C
SHA-256:	4BAC59D4E8947DC3B500688422A19D261FBDA0745CD37B6DB1CD2C7C4A168074
SHA-512:	B64763F8D1C1E8E215E768882BFF33C4B6399E30B9E6E20841573C4FEF16B9AAE1144144552260CFD8922A9325D27E2A80BED2E9BF1504031B7E22BE38BCC752
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....tIDATh..]k.A...w(..Z..k.&...Z...j. .5^....&..".^...... ..k.;....~dw..........33g....~.f...i~..c.k.O.K;....\|_...>.94...o=6P...}..\|..)...vC.~i.......:....J:.!.......H-9.n..........a.\.6.....^..~.'...>P..<.~B=Q.y$..,J..I...@..d....fu.......}c.Ks..,..fan..(.S..!0..L...3q..8.m..(Wk..."<+. .<'E_.g..x..@..d.....NH..O.um...U.....Z...y...r-.\.....(........@.$R...3V..s5.N..x...X=."...\.e.KQ;DQ........s.r..*O..i{..1w.....{.3.}..v....x)Siy........v.g..7o.....4g^.V...J...J..m8?[...W...t.B..@...(..0..5...,....`q.:.Y..N.@.Z-...\.wF.`4%...I.2E.].\v. .....J.Q...p~g}.:.......2......@\d.f....u^C..n...9.zc1...p....~..q..\|.vL~...v...MZK.@pe..b....t6..R.Y1.@f.O.:.\|..>7..x.....v..Y.!;z.5.;.."XD..q...'.<...9..<.@h....iG9w......8.E.+...(....&Q?...."..`..m..3+..-.."..q...[.g.c...s...}.A.....b.D9K.R.%2..X......]...B(...Q.y;.j.....R.+....$.'.3..w....E.~Y.~]..7...crL..._(...A.[.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\pig\pig.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.5390315564637085
Encrypted:	false
SSDEEP:	12:6v/7AA+Lg4nYcmGpeSHLFrcBwxC9tuuEptU/XnJBJ68GHHCKWu+xqV0CM9:ZAYg8Ycm6RrCww9/aIWfHHWuTV0l9
MD5:	189F18A257D39249748324964BB90495
SHA1:	DA087EC75C827530290C7BFD0C5CF79AFB7BEDE5
SHA-256:	D608804AEBBF1A0602F341F03CE7FE768581925FC15A73C1B8901A57892B3B05
SHA-512:	47BEB686B5A75A362F763E31414AE5D73A3864E2E55DCD82EF346C2EB2F7C2BA983707FE887351954398C5DC1E716FF99B2B91F62448C85F6B28181C2AA9F1A0
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh..N.0.......3..bebF...X...5.. F$f.RGu9q..s/. J%.i.....I.u................(+%...b..]dq.T..@.......{.1\|...T.\|....]..2..t.nO...../mC.&.....`P.q.s.`......_.._NN'.....{x...R.w...`...A........%v..n.......rI../.D........w..'.`.....".V?J.r...Y.N..S....a..>.!\|../}......[ .Dc..0...[......D.4dM.&...kp).`....B.,.N...!...U(.....@.I.ff.......:..B `Kp.....w..A.....*^...b.d.\.0..u3aK7..nW..>.V..:.....s}f..3:.....r..m.2q...#.'.$...-..c.=7.T....$.J..u.....@..._...{y-..\.....L............/...s....Z.X.........<.`.q..K'{.q.s.....6..1.m\|.....3..=JC...h{WZF.1w..h.P..:1-..e.nw%.k..f..B.:....g,.......Y..j5h..8{.....W.....[..$V.n.!`!$Gg'...n... .yr.-y@...T..W5../z.&..v.5.........d....I.e......@.........X....mEu.=.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\pig\pig_saddle.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	263
Entropy (8bit):	6.609163019050459
Encrypted:	false
SSDEEP:	6:6v/lhP1/9WWwHhZd6QB/jr7qPrGr770Hh1LTp:6v/7N/9WWwHhff7q6SZ
MD5:	842359BDE2F0E2E99E29E7D75FB90AD2
SHA1:	8FAE8E21B133A6B2E3483F8AE2FC2321DD7D9DC3
SHA-256:	976D126DD780920C3475F91E034C70530462EDE1EB275CEB73A33FFF9B2C674B
SHA-512:	DC369DE2C62CA3DD443F36F17702A2B4BBF12651A5284BF1571F7A024C1B55BDDF00A93E00DC371755A3D32AC4114DC80C18CCE0ACD580D329325CABE5DA2502
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh.c`...`...Q0.F.(...`...Q0.F.(...`..'.....R....F..A........c.........a.(.a....1,`.$%..Rd...S..:....,+.>?.....D;....._.`.<r .H..B.[...C...[!.......P.g...R.+..d..*...2..e......M........y.......G....y.....]....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\rabbit\black.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	664
Entropy (8bit):	7.465146524215919
Encrypted:	false
SSDEEP:	12:6v/7kyt6fdVpkoWpGNUpPHZ/1kaR6BmJBTGI7Sugdj/tXGNuM6E9b:aKx+ZdkaR6UJBTGI7Y/VGRl
MD5:	31B634DE36D8308A32B83AE9BE48BCF7
SHA1:	57045A5263B9EB9F49407BD52A7DABC62E64CC6F
SHA-256:	7A658DB7EB740B89682277989DFE8FF2A4673FA57E3EB1A67DA4B809312DF124
SHA-512:	7A98A82548876D8785D74F761B848F5CFC829BC43DD78C66EBE1271092D8F940A8650020A749C3174734DB8B376054A0F81BB5DDFB985F38E025F28A246DE78B
Malicious:	false
Preview:	.PNG........IHDR...@... .......~...._IDATh...N.0......m...;...........+.}.j....d.mf..;....a...?.7l..Q..~.....H_t\K...x.N..x<NtQ].<3..UJ....~!..2h\|...4.@...<..@.X!H+.I_....).2.....J.....5B....(....gW..V..d...f...h.@}T............~..n.;....r.....X.Y..H_v`.....de....y4\......dw+...@.F...-........7 ..mN~.+'..3lK0..N...AT.....z......p.Je.50...l&..eg.]...l.\|.\|.._......X_+...@..sA...q[L...Rz.....eX.T..............b.0..@...s.....c.....v..fQ...y..;.s....V...r..{E.U..Nw...Y..V....V...Y%...a.#Z......`...8.@.9/o..#Q.Y....bgN........5..T..T.<..@..mmV.j....2.-.X.4.^.....=.....k.`.].......gq....F...+........NJr..>E....Z...\|A,..0.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\rabbit\brown.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	671
Entropy (8bit):	7.571310861639677
Encrypted:	false
SSDEEP:	12:6v/7E7ot3a+gP0GITqS2kyEEy8QeE3G5srGLbWEdSrJZqeiemV2:RG3aRMDXacv8LbWEeJZ8A
MD5:	F6FB0066AD3A871D96941671205FF8D6
SHA1:	53E2832F874CB5C8BC7346D661C8B77073786059
SHA-256:	345A114A33B9CAE6FE0382766441E4EBD48E73D53F196FB2CE710D5E394665E6
SHA-512:	32E11DE826F01DA419B928A8DBCA7EB68A7DE847C171234E4FC41F1951C10B01FAFC5F650058C4917B8064853A7F732EA86FAFE8ACF8D2BCD4CFB95567BF8748
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....fIDATh...N.0...Z..uA..X`.&X..b......<.#.'@.."..z../.s....tJb'..g.\G#.q...\..9....fz..".6.8.}....z.i...\.s...3I.R.....Dt2.\|.....@.7...d....A."<1i..`U ...y.z^.p'$.@e..!.9...$...O..*.g.`5...[i.......... ...O.,....%...E.l..'c........E..%;&vx.@...,T..p.)....w..b...hh..>.....7Y.......sJ~.;'....O..:..s.{.....&.2...w3{..r..SYyu."+I..@..cvgy>.Z"..?N.........s...._.:._&.a1.\|.N..`.lw>.b.RV.k..'..n...<J.;.A....:.[.....<d.B...E...f..8...W..k[s_..Yu.BN.d...DM.\|_w...[....E._..j..f4..:b..8.L.8....>......Uy...\|..6...`.P.u.D.....}..'..0d..q6.=bQ$....U.`...q.~....@.[.......gc..\.....Bs'^j..B....UW.5.....~..;.aVn......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\rabbit\caerbannog.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	700
Entropy (8bit):	7.4886740001312555
Encrypted:	false
SSDEEP:	12:6v/73++ytJ8Sr5MpJuFh1geGlljEktY7xGy/SZOolye7+egTPg4QlT:RrW+59FvKlloktY7xxho0eiP6T
MD5:	21789436FC6D1550BDC998F536D38572
SHA1:	D4B80BBF6821AC0C40EE3160D3777AE0ED381AD4
SHA-256:	CC249558FF61F23B58BD5F650F76583970484E51CC2B9DFD52CC588D34B0BDB0
SHA-512:	604D5F0FA336C2CFE6EE2DCD7CF20FCB08F1CFD6F2F87D7C2CD9186C1ED0B195468AAB2EF8968639B8BBDA8A557532A8EC0E93C33F18FF2F789932C72E8E76ED
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh..KN.0.....\..p.n......u..z.VU...M..l...hB....c..!.(..:3.=c{:2.42....r.h.....zO.N.M.....a6.MK....H.....Z. ..2...........z7..}.!...........<...]3._.&...rYB....H9....6.<.....3..o..Z).HK.<+r..>j.?k..^..IK...e:..#....[..+.......l...>Ju}..Y.u......r...~.'.....y....P...'Gf..K#.Sb.&..7Q..pu(.......9.u.a.DF}.,..@t..R$&.}=....S.....J ._.<.6_....}.h.\|.\|6.........k..{.$...P.....3>v......;.a>P1..0.0..F...G^. f......u..5.`...A..R,..[1RW.^...R....Mkl.9....+..........W.y.....$.m....\|n$....UD.0.....:.....k...#Z.Q...l..:.....W..F(U\|..T..D1.9..]wu.....O..$...o......_..;...]...;(.9....O..x....KG...r(...".pS....SdL....An.?b...\|w......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\rabbit\gold.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	709
Entropy (8bit):	7.504939646535669
Encrypted:	false
SSDEEP:	12:6v/7HJfZGFC04z6am9cR/USXFu3nGYOsew8q9ZDVoePyDArcglGg:8AF99/31/8qPqDAge
MD5:	A3259D45F05839021BF287A06E77437C
SHA1:	656D4B2F0BC503F1C9F68AFE32DE8FA55AD2F5A0
SHA-256:	70B857890EBF2DFCDBB43B9931EAA253B71F1FF678591189C6EC7A94622D8886
SHA-512:	80A28730E2893171FA92A68EEEE910ADD425EEA0BCE18F102D6B1D1ABB27C8CDD5DB922030C24D822C602BBA27F7E938A204DBC4F77058DEAC09327CDB069836
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh...N.0...8\x..<...kp...!.'...@.@\8 .1..`b@...r..i..c.`.M....;..3..B.................JBm...........1...]XW.g.Y..+......$..4>.....`ex.........$...5..l......<.=..@..Hc.\B....4]I.....^..../.=.V.R....xV..P.(....?h.QWW[R`.~).A.El......x{....(.n.m1..E.&.x...Sf.4rog..N......~?92#.^..<%...>.&Jk........_..[...K.CW.d.......1.M...7...I..Y..d........."...x.4_..]..."y.}..O.C{......<.2..........3>v..!...w..\|.bF.c.`$.....G^J'f..p......5\|c...A..)Vw.b..4k......P7..^..s.. ...V.......W.......".+...\%1..."Gh.....@&@....D>...uq$.x.U..bgL..W. T..k..P............6..r..v.<.c. ...Fw.....g....7. .l.............i.n;.. ...i..&%1..."cJe.....~.....L......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\rabbit\salt.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.551563669487349
Encrypted:	false
SSDEEP:	12:6v/7VWsdt4qQ6vltl3jkEZOq9MFBcVELPoBk1b2DlQbDLZE4lZxthYM//IV0Mtl9:Udt4qP9nRmBlsLDlQ/NfLYgsb
MD5:	5A93942A99A67284BFB32150ECC417EE
SHA1:	C8342469F2DAB59C834253367C89AE71F32B75C4
SHA-256:	AA4BD3B584C114E567EA818EBBCAAB2029DC907D5FCC466293D7617CA5A08AE8
SHA-512:	FCA2A67CC22F8278FDFC37E5934DCF15FA65E5051B43B3096D925BD8749960B95F7E177BF2570B34BD09F43378B254F6B13A937D3079BCB6625645A98027E155
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh...N.@..y-...H.....JK.). .#.."M.DJ.Ty.{...t...4..7.....a..].J1...].\|...Yo..6rdg{3...m....<-...H[.\|9=L9..v~.XV.g....e/...\|... ...s...@..V...v.%......C.......{_.......hc(!..0..^...f-..\..e.J.u.d]?/..A[.!...e/..ga.\|-..w...DC.b9..kmY.r.^..'.e5...X.).....(...e...j..........k..}.e....i.(W..,.Et........X.....}....:.. l..@.......5._.B..}V.y....C.-...(kI$.-n....}Q.d.. p \...`...j.......#p}.{j..........o.-..A+..#}Xq$H...W/.W........Y..DY...&..bP...Q....VT.g...{..<c,......!.A.......ut.Gxk.._...-.m...Q...rl.}N9..6G....\|SG.H=..j...xy......B-..X...=..S.K......."W.Uxa..a..^..IW...7xE..:...^....':]I..!.).e.}E....}ik.......u..WPYA...`.P2.G.}J.!.........t....k...5......j...B,....K..Oat.(qEJ-i.3.b...G)......Q..A<.~......c..}....A....O.k....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\rabbit\toast.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.5206529258615475
Encrypted:	false
SSDEEP:	24:oarGtncf4ZRLSomOcYEUJT0m2VW1jyNgX6:owGtnE5OcYNJ0VsjsgX6
MD5:	A77FFF10634F364E9B1FC55D18D57585
SHA1:	BB7CC1ED828535717C4D0E373585533323DB2791
SHA-256:	9F859BCDDF888083F231B78517A0B0AB6F637022E871E4F108C1D8AEAB4F184A
SHA-512:	7AFD1CA771E137DC627C1B3041F8C9F0C618B39D735FC2F4DC5526606878674C39CD0892B35C0642D02BE40CC5BF27A565DE0C36A08C0A99767BDE71FE00EA40
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh..=n.@..}.......T .5h......(e...(...&c.Y...e.&...=.\|;...9W...?....}..w...Jb..kI.?.N...5.p......]..Zl...(....__^.".....@....@.!.w.......E( $.........f};...g........$9.Q.8X\3.>....b....\|^...n..UVp.>..R..;.v8T...R3\|.VC. ..jU.v.X....F.`%p>...}.Rs6...O.....g$......v{u/Z..5[....Z...:./7+.r2...?....[.tS.S..b....h..W.~...oI..Vk.\|................h4...l.........G'J.8u..3G......8_....k.z....5Z*...r. X#.._.`..=...A..!..e...z.j.t....5(.....r.........)2. ..Z.......!..'.p.!....o=...P........o..w.n..~.m......w.O......#.....p`.I..&.....l....sKz..../Bx.....Xa...k...B.._.{l..^...x.#... T.....\|..P.4.. .W\..~o.@..(uV..O.......+.O..8ME...9.n.).G..s.z.\|....`C.iZ..@\|..y........zR.4'@;.Y!.o..{.6...m......K..%......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\rabbit\white.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	683
Entropy (8bit):	7.451779950577673
Encrypted:	false
SSDEEP:	12:6v/7WFhXy3+vmgvM13Nq9ISVSL0QaCEPy52FbJnMvi4HnDvPG18W3:nh0Hd19SVSrnEPFbJf6DvPG18q
MD5:	DDB386F976C2FD7ED8604CAE0A2BC18D
SHA1:	8F54A11EA7221739715AC2B46298A813BE7EFA39
SHA-256:	FDC12D2736D90C7FDD62857FAAC363554E3E1EE9E5AE293968357DCA93417388
SHA-512:	91239DF6587B7D68FCDBE20A111B2773E483CE63FD49272DD8AC1C3D4AA4ADCBF09489108175490EDFD84E56E38C24469FD53D8B645952F2C79910D8109F7DAA
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....rIDATh...N.0.......{.$....1...RD.'.......v>.....iS...I..1f"..tj..g.F..f.1UU.........D.}...;....m.M.J...`.......@...p..g.....-..b...........5..E.4..7..9.^....h..m.mk.~..s{..,.R....hV...\|.p...h..n..........%w....~.7..........\|.t...c.N..0.!....Y....Qc.-5.....~tdF..4.}Ll..>.&J1......./.......%<......D2.."....x6..6)p.LE..........b..$.F....Kc\|5.j.s.@}].........t\;A.,........~.2,.J3....F.......s...@...}...K..3.x..S..=.b.4...e....7..Ms"..._..../)1.........u...I..&.W.J...'9..+E.0.....:.....o...G..>E.....:...@*..k.P.......b.rdoSwu.....Msm........A.......T.<...@...r.38.Z.R#t.H_.@..s.S..nJ4..<EjRe...r...j8)........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\rabbit\white_splotched.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	850
Entropy (8bit):	7.58378164574527
Encrypted:	false
SSDEEP:	24:806UXWQdLaJl7LjdCDZntzQ4jPaBepMZ3VZJvwQZ4jgI/77hJ:8dGdLel7LjdMtzQ4jP8kMbTwQuF/JJ
MD5:	809A3BDD284573C6E11232FDA62DD669
SHA1:	CD5B03FB2D7BF0CEADAFE138542A70752496AB23
SHA-256:	3344131DE330EFA42F470E7E7C1FCAD6EAAFF982889B704BAC284C1A497B0410
SHA-512:	79E6A198CE5382926683E13EDCE49A514DEBE466363325C0D1B38A82604BA1A5FFFE5693116802235A8155919DD41C5EC6F8CC5A666DB33FB53D2CCD71B57EA7
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh....0....\.vo.9...y.^.WX..n+...U.^R....../.e2N..."}.....l..C.+.h..9..~.....eY.......-../n.B...k.Z........N...Qp... .1.\|....r... ..>..$... ......a....v9.....C.~y...T.4..;........8q....P}...g.f...>6...Q.H3....h.:^.}.T....a......`.k.../.....v....... ........s..=}i.E...9.i.x.3.....f...U.0z..<.k..S,.=?...%.....cb..".oMw..h>.{..f...V.q....pD@XqF/7.C.......I.....K........~.\|s..KR..3U;/."..`.8.kg.Fe. ...z.B.D??}..._.......F..+......<.p..=....cgJ.f......sp...X.x.:'.!...y....;.{.5Kt.g.@....i....c.......?.............R..e.....q...+...\|..{".uD/.I.X....c..)........J.8.f.m..T..0..vV';..........-#9.t..J.......!....%m....%.4..G.y....(G..N.qH;j.E.w].B..*.....U[.t..yb4.9...Y].~&..i.[...H_..L.....2.U.............`...Q...._.7.@...........a8..\|v.8)..F.Z...\|@."cJe.y.yB..9T.D.<......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\sheep\sheep.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	922
Entropy (8bit):	7.685382392124065
Encrypted:	false
SSDEEP:	24:T/dtAaGSDmBia37Q/xd4f1Ziug9y9ECpQ3:jdtjDmBc/rKZiug9y95u
MD5:	91FA163351724FA5EAF00DFCF72B24CE
SHA1:	FCE088BCB52313201106DED134493CAE94BDE88F
SHA-256:	192DC1036E41F1B43FC504E0A3738570F15B1D15D28BA963BF3FE636956DBFF1
SHA-512:	F74E63A4EE8CFF2793E0CF054BD2CAC909E1C1354899D97B5C7724E6425C2B097E67E8319D9132354E2A5E780A6FCA3DF37F0B15FE20EE85E91FBFEC48DD9259
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....aIDATh..Y;.ZA.$.L>.^.....[>.......8'.....8.eK..v..k..3..`.Z<..5.5...~.o..nw..v{.....`xf...~..o....vU;.9...~..ytX.M ...p...n6...o:.6.....7..R.@.i...C...^....@..........tw.{B...p.S .....@E..l`....7..:.1.r.......}...D..2..m..}...`xF..F....^...>nw........Z..E.N.....m.........\.....X..........]....N...b.J.<T..Q.-......`................).T;.9..s.P....S.AL....t....s...<.B?e...Y.Pg.9..Au..Hy..@M1.;.1.DO..'.f.p......8E............M.@.Tc\..).,9.P.t.@J...xw......Q.4.=..D...cwk.......?...}......A....K......$l...v....k.{..;.v*..H.....]pZ...j.2@iKG..~.{>.....L...z.Ugwu.x...XwX.>i......S...:...s...'F.lP."....!..]O.....z..w....d.c.....W..^6..J.].5.]..l.5.$...i.q..K..(..fxz.W....)Q.I.-..h.F.Ey=.....41rgtG...g...I..B.;......;%<<..qw...q8t...)..{......w~...CgS.'..J..n+.U.h.h@.Y.y...9..i=.[.....t6_".........\..w...^bBb...._c....C.....?....X......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\sheep\sheep_fur.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	573
Entropy (8bit):	7.511090877530333
Encrypted:	false
SSDEEP:	12:6v/7+ULxhbHhoW+0XmdtdG7J97ph+PY8tvRY4TJxH6ENVwVVtN:2N5hog1HmY61NuN
MD5:	D49FCE2351AC6634F5F09FD5FBB482B6
SHA1:	37224D7B3F38F24F762D67FDB62E081790641036
SHA-256:	8B68443A098A6218DAC0544AE16A9CA0C141088B78C3E71C34D270C4223981BF
SHA-512:	6F71155AFBD43E40876109797A6A2AB3D887BF2701F36AF8CC8DCE65346EDBA54928C94B46F6072F52C9E25172E45BCF92726C09787A22EF73B1E085BE8033DF
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh..Y.n.0.....;....m.dYv...H.f....g.q...r.O...H..x%....@......_..E.G..m....d.+..g..t....X.s.. ..........b....a...G.0xdB.....:....ry...H{..E........!............@.o...\..w..a.8Y.[.A..[..ko#.5b...Yk...1Z.;...)....&l.....+L.....F..VW......%..Z.uUQ....X.n.....@.~.1..J6.@...S....j...U.YPbBw.8.....K...@h..4Y.GD...4.A...U.(.e....w..9p.....~..."..ju...kGR@.......)..Wu.:?b....%.;.Bn...j...n..eF!..*9....j.`..H..... 3-..v....^.......]....7E...J'..8....,.........../HBo\...J..........1y..=<Q..f......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\sign.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1009
Entropy (8bit):	7.718810099208264
Encrypted:	false
SSDEEP:	24:JiYSXZI+kGzV4if+Q70tUZ3jsnJ79CxA56si23IYpxdV:JiW+kGzVnf+Q7i6snJ79COjk4j
MD5:	9E0990F4EF79FDCE3A544DB298017076
SHA1:	BE34B2EA1CA1A5EBE499879C5D3440062B0620E6
SHA-256:	E8A0E148D853670F675877A72EADFFA2DCD5F13C50225009F4ABD7A7195B185A
SHA-512:	3E25078C4DBD8CE66FC141BCF5E2511247A430A5673CD3794CB0EB822B28F915046453253B388D7F2A6B23158B9B014B30B3A71FBBDC1CA06A9AAF622E1CB2D8
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....gAMA......a.....IDATh..W.R.Q..3.y.}Q..$.\.."A...w...+O.@6..p..JY....k.t..ef..TQL..Sss3=3}..tOQQ.....&.}.3.m.s.d..?......m......U.........M{...6....7.as?>.J+.n..0C....o..5...K.......b.7.b.8...X.V.)l..X1..V../9!......:...s........."r.......=..3..../(...U=....M....P.cn..^....ha.....#... ....H../..i...}t.....j...kr..V.H....Z......i..Z<.\..,.@...(..nu.W.......k..ELj_.G..q'd.C.i..^u:_{W.....nZ.?..g.E?.p.......`e...8g.a...4...:E.......5 1..sd@..6..2IN... ..@+L.h.kD...~>sA6.........E..4..^&>'5...>.y. ..(..j.TE.,.Np...% .,..9.............&l:....<."(...ES@.:.[...sz..f......l2u@.v....6#.B"......D.F.................fqi:.....v\|7...7.v..r..m.bN......E.5T....g..T..k.{.....t.j9E.\|Twj............P_z......2v.A..><.D..G.~w...@...N....\}..... .dx......<4.........(..Q....s..9.'.."....L...4.Y.$.+?.}....u.<....W.m.3.T..o.f=.5...8.!..A...N.@..CW........h...D.............'....P.p..!.......8[v.......'.... J.....Y@m..7.....Q`._......K...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\silverfish.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1104
Entropy (8bit):	7.695385620400425
Encrypted:	false
SSDEEP:	24:eqv0tgXCHv30iyFe7Zn6DeQEm13Q+W6YhOdAT:e8Yv30iD7Zn6DxEmebhOa
MD5:	514BCF74BD75A360AF30C9B7F18B8749
SHA1:	002B753F627C5DA47F29F3D35404B7F9B0DBBCBA
SHA-256:	6AB3BD9C8F62C5DEA778D8D6F062D51000D855AC15E07DC1CD6CF3442015FE13
SHA-512:	93A0992672E3FE5D1665468BA650CF644794457D2AE7BFDE36E8E63657F8C4C55BA58C08B7AF002840BF4088C66E72B917B6A1B8EC981C6D3E3FD9BA5B594AB3
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh..N.Q....y..4...wq.7..E4))I....c0.q.....(....R.HRQ$U..).......7^........9g...f..o peKKK.O.eccC...exxX...$P.G...dllL&&&..<..3....!.bQ.GGG...ZgW.o$........loo+..z...t:-+++...e}}]AB...dRb...J%..r......6......%.HH&.Q`.rY..R)Y[[S..y...<.......<.Z..~...EB..X\\T.......>......!b.........`.?.w;g..+.+N..4..".^".a.S.........F..J.....^..a.j. ..4%.".v.$....8.\(.4....ekkK.q.._......V0.p..f......?._...6..H.D...g. ..kwf........y.zz{{{n.D4.U....R.^.CH..gXk...Y@.i.onnj..}....pX. .Q..?.<A.7ki@.E..".'y!.H..hv...$...@...P-.......q.4..{+...\..B....$tvv....g....r..p.....h.."..ZcJ"....V......_.+R.....e.`m.......6=(?...*..T.....@.#4...\6....^....C....p.B...........p..V.-.....?...W...>;;.`....3...U..VH.AZ.{..L......&...8@).......)..94F<.E...B.......%...........5.>7.Z.....k_L.@......hhHFFF.....z).$.7..?..-}......1+g.8.Q.,..7.c...p\|\|,......dP..H~+@..s..:....+=\|#.....T.T.....>M..w6<...p.'.....z.W.Cxnnn..p3...]..6<.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\skeleton\skeleton.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	651
Entropy (8bit):	7.493064945543756
Encrypted:	false
SSDEEP:	12:6v/7NSsufv8NI+GFlbLLd40XDMA2gn74VU8ZNjVjMW5n5bPM6FmnEi3g:YK8N8bLLW2DMg7aU8Zb15n5rKEi3g
MD5:	88910A4A570D759C9CC22EA557936BA3
SHA1:	5BD4EBCD4BD17C882D7A99AC0BDD62C3505F6B74
SHA-256:	9D467811493A08C4A9A0BD8810C1B6DF097A09B6C8D6F63FC631F93AAEC74DC9
SHA-512:	222E39F42FD500EA19821A2A5495745D2CADBC5D4B37A4387EA08C7E3003410AA75771C0C84CC69098B5E6B60CAF4D261F48DA89C11211E7C9F69DC4954313A8
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....RIDATh..XA..0......^./......h.<..);H.F^;.....J....c'M3.k.v......V0.I..?..u.p..>[..............r........]..ca4AP..x.`$v.B...u..r@j.....{.x.p,CT...=...R.\.[_...S..v{q...c).,.......5.y.C.....J.....`...4.y...%.\...`W@`.....S....)...Bd\|.$...?.Nn.b..`...e...U.._..KI...s.......5.ds...Q.K........z....$.0l,....{.c..~@._...\|N.Pl...Q[..R...+...GW$...RiW. u.....t.6.;4.E..Fj..n...}.:G.l...R..(..........S..\|Tv.~...N......<........]y.F..T^.S..c.Q.o-..m.!...N.......Z..<.Z/.._va..S=@o.t,.sl.L.."u@._S..C....B^..}...u...`K.J.T...~.._...3..U.)..).vHw..2.......soq..).5...:..M..5^...Nwy4.MKe....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\skeleton\wither_skeleton.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	699
Entropy (8bit):	7.544003657288801
Encrypted:	false
SSDEEP:	12:6v/7cy8pB8xiR11MscnexkRt4lfVPbrHqlD45L0Pyqw7eLw7Mngq2w9:Ny8pKu11M9FRt4RVPbcD4lGyPMnV2w9
MD5:	9B2FAC4757842EB8448347FD70C0DD7E
SHA1:	0E661782BBB6C3FA5AD0B785DCA5FF33B84CF5D8
SHA-256:	75486BBBFC804E5219A1D5A08EFC8CE6FA380C043DB2E63FCA998BCAC41483B3
SHA-512:	444B80F2CABDBE2E13890E8A7687C799C0D71E64639EB534502B572D33B8A1DCF31A72972923DFEC28D04317B8CA52B88673C174597895C9973E4C5D92D15740
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh..Y..0... q..HH.q...=...o.2....9i.4%...Ik...1M3.;...h.....\|..\|.......r..A.n..~.....m.v.....sL.H.. .....t:=Z..Y.i5.@X.>..j.D Vg..X..c..V.vug...9..~..g.s.T$.......`.y.s....{..X.......}~}u.[O.;..:.1.R@RyDU..4.S`"M.%...59.Y..^.Qj3J...H..&CT....u../.)5...A....CR..0.$.S......{.....^....6..I......!..=.^.9D/.....U...%t.......j..=.J.f..@ps..."....d.._......(. .....B..q....Oox4E......z.Z.?/tx;...0..e... ....}.........T..(...C......5.$..M..cb.I....} ..w...........OMT..L. ...!..h;..;i.{.PP.55&0.3.I.[.3..NLR....D..S~.w...Y..M. u.......#.-V.{.}=2...x..TJ.Kw../..K.,".r.....h.O.F..c..#..s..}......'...Sh..s......E..I.B.m.\....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\slime\magmacube.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1194
Entropy (8bit):	7.752400174358794
Encrypted:	false
SSDEEP:	24:z631Xt0MNtFeqVDGiW8f9u/m+ie8fS59/r/dI1BYjdcb9hIi/h4adZKjtIg:Y00tFeqVD9g/m+nZPomc9h3/h4adgt
MD5:	4BF9427BCECACC44B5EF9C76DEF17661
SHA1:	5D6FFA5567B3E3566CD16C89DAE889B90E6E4C6A
SHA-256:	CC1D41DEDEAAA50C2938732F2735533CCB5A69FE83407E878B35C7CDAF05EBB6
SHA-512:	39F39E89E536C51EB8EBC5441170551A6D6E33EE3ADF9748E75018201F93E84FCCE5D5A2B71737F560B5A1E7EE3FFC4C1AD4896EA123ADC218C31B750E140899
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....qIDATh..X.K.Q...t.U.D+..,.Q.d.FD7..v...A7...AEE...OQ.SA/ADD...e....z....C.!\|..kN.N3;.3."x.cv.o....PQ.U...h\|_U.......g.n.&.....W.H...$zY..I.DBt..U..%....>!.>..&D.'..3B.W%r...oDX.....R^...-...$...G....$.Rty..~..-.......P%.rf.%3`..,jY...&...^...P=..._..K........f....D@fu.G.-w\|'.....M.Ku..Pl.f.....7.\|.S.Y.Y..L.... .........5B.....R.Q...e..H<. ...V.1. .7..V),>w....fL.h..L7.,W~r.;.O..i..&..,.......i.Z....5..fm.....fC....ql<.=.../+...t.e{6..k..q.........w...0.s........9..7........G.!...kUh?....J.(...)..W.......1.Fi".>N.M...>Q@.[.f..../............T{).........g...}.........31..1;.L5...{....].(.......{.y.ph;4...Fd4...s$.....x)\|......%.....y#..N{..,.D.22.....).q\|..l.w[.~..j...F...d..n....-...(.w....ThZ.A...4...;.J.yS&eC......E..{...n.....u.....u...=..}m.\|.......r.../..B.N.M.......,%.Fjc.G..NK..?.@.>.ql.\|...z.UA....b(..R.4F.~f.]...<.8..T.5...t....T.,.B.t.t].........6...s......+.;.r.7&1Kg....xf....{...<_J3...Tjp

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\slime\slime.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	397
Entropy (8bit):	7.183392988353529
Encrypted:	false
SSDEEP:	6:6v/lhPyi98exMIm+QC4CEwqWyxLdOYLPp4WUuIrP4vM4fX7z7nrKgtcOE4XbQ7B9:6v/76ie3RJCEFxxOYTpw9DSrDDDuOc
MD5:	A1A4E9D64070975DD294E158150B7183
SHA1:	09099670C5B6DC96DEC28F6340E23D0D53D07EEC
SHA-256:	3550893FBA72BBFEA38762D67F060B05D4DE48620712D1DE2A4CF0ABE9472CEF
SHA-512:	B8F09C76476FEFF6B7F804B7547EF5A5F11F046E5F0DC8EAEFDF787AF17E47A31D5484E320BD1666BADA69579E2852A45FC4DEE17D61FFA7168B333BB0ECA37E
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....TIDATh..V...@..Q:9..~.....cq....$.-..Ep.....J."!\.<....BK2...{Q....O.N..*..rs]...1f.iCS...m..C.a.....@.$N.D..........i..m}.........&.5J@[?....5\|.x.p...ik.w......mZ......P.....!E.\|h...FB..w}'D...]ULD.\|_wB.>.....w}'D..]......h\|R.....8.<.:.,..^....D..$.'o"......$ .t.I.@."..49b.Ns....Gq.@w.D..u[.D.h.3..n.........m5D.C."8..cd....=.4.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\snow_golem.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	4.074766255517156
Encrypted:	false
SSDEEP:	24:XspIKbjTN74vYjnecgi+2fz3jtl4jZKqfPqLH:Xy3bjTN4enecffz3Rl4jBqLH
MD5:	174418EA7CEB10BAFD529B59597AE35F
SHA1:	6E0EBEBDB79B3587E6DB803425448DF42A6AE63A
SHA-256:	1FD7F7A8B7CD09CAFB854CBB685A7333FB0A31CA41E4FD74FA437C1C22DAF698
SHA-512:	462FCB398CBBBE44CAD571A57E1704DE89489AC2FC752E1871EE77CCB91B4ED287304F3C0FA631239913C17DF40B83A98178287669E9551180C682879DC7E25F
Malicious:	false
Preview:	.PNG........IHDR...@...@.............PLTE...hN.DDD.g'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.3m....tRNS...................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\spider\cave_spider.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	939
Entropy (8bit):	7.705082792702382
Encrypted:	false
SSDEEP:	24:8YxOcSEogG3/AGUU+uLHo/pbBF0/OIFhj7:8YxOcSJ3AbyHoTI9X7
MD5:	BDE7C84159F4922CB4841A9C1717F68F
SHA1:	375E0E2DDAD25ADEF309FBE0CE46B7F36F5E959A
SHA-256:	B5C34F78C47CE1669A1B569DB725F63CF85C6D77032C2D393D9B22B44FB68C9A
SHA-512:	52AA6698403720343FF8C7F17299C3C5E667FE685847EDC00315F61EE2EC57A2BDABE0C69BED2627E5A05B0AE9D0455B4E6C586F4CDF7107CC08EC8D2313FED1
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....rIDATh.Y...0...E:$....DAI.h.Q.N.HtHT<.o...&.Y'_.(.l......0d..a...qB...{./%./.........s.2...7...z.............t.Cc.7.?..o.....^..T#...oJ$..21.X.4E...J@...{.~..T.iHEdBFv..w..Y...6.{.uT.E3....s.H.j..~5..PI...{..I..........Q.@.>.Z..k..r.n!@......5...G..fp.>K<..XR..G`.....+..'......_.Pc...{..C.J_.......\7.Z..V+....<g........c...9w..-...?..B.K....p.>}z.gy....b..E8.,]H.......x7..z..,...........iH......@.v..z<A......N.s8b...IO..8^.:.o....J. .u.g...).{.-.&...-.n....B.Q.X...y..6W....\|...B... K.T.!.h...X......3o.R.S..L.jE..9.......}z..ye....?..7..4l?B..g...3.."Iu....4...4.C.0....>..a..B..&Ha.;-.0.........c.af........USc.V.pi.}UY...qP...{..O].....T..$....5.Yt..-8u.{..b:..,....f8C..x~..a]....g...f..q...u.:....[n...... .j..'..;.N......<.~..p.u..K.}v..H..UI..\.. ....`w..=s.4.\|..q#....0....Z.....yO....z..j.6.a'.vs...............V..9....e...\......'....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\spider\spider.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	927
Entropy (8bit):	7.7183604420137915
Encrypted:	false
SSDEEP:	24:L6AV75wEbH6NU4H6Xdq7At2ESNdvcdBTYMWEP4Lxmz:WAhWEWNUK6XMG2EKdEdBTbUe
MD5:	B133D8FAF80F34C8EA8FC8D315FFF57B
SHA1:	602E4DF9766C194CDC9DCFB147992E2EA0570350
SHA-256:	9D7655C3C25840F96CDE37E7AB840C1B158B0FD9E73FBF949C12A81AA8C02B19
SHA-512:	4BB9D7E2073166E3A73A1174031007BA60442EA48EDD614D42CD8FC01E86329F81D4CF698B3FE5B6B4DADD6D2813D581C570E3732D20EFCF41D7C5F93EE97B48
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....fIDATh..Y;n.A.\..&qd...K....!.H\|.nA.D.D.)...e.Z.W=o?..W........gv.........ad^....~....n<...S......z~k.R...C`.0.WR.....]..F.N}..._I:._.v%@'%0....EV.r.'.J...1.4...N@........p.3".2..........n.z?:.K^...?Ni..I..x~o....P..{..I.v..:...u+.../w'.9..&.E...JV_A..U.a......<...?{.\"......I..=..<.pc..M...\.N@j.......].b+.....d..........p.Ew,i....O..y....p..J..R......!i...J..f....3......B....<..$.'..FoICX.1.1u..8.#..B../..vJ..1IZIp.=........}}"}..<.+O....T..m....b.....#O.\|{}..)lv.."..jr.P.......F9..`.F..].W.,.....Z..wI....?....'..k....+[Si......Q#6'.t7J@H.(%...L.c{j@R.j-.5.o.PmHA.J=i..h...?..8..(.6$,.W...^ .V2...<F...Q3m...)Ei...G....}...g...}%.^.M{.....Z.\|..U..l....).Q.1F7...JP}.Zw..S(.1.....V...eg....Z@.....B..{......w..I.......s..ztu..X.)..k....y.8]..C...1y.!..P....F&.Zg..I-..h.Sv%..._r....z..i.....^...k@:....*_;fub[u.9.y.S.@[.Y......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\spider_eyes.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	155
Entropy (8bit):	5.847386414287663
Encrypted:	false
SSDEEP:	3:yionv//thPltftBHSC9/ehDjR1P+gSLo9O0+drXazH/J43eegS/Zp:6v/lhP1IDj3P+g/9fUch437ZRp
MD5:	F6D9F9704052259436D7CDED316AD755
SHA1:	114DBE060F1301D35C2F6F7D847914D54F1F245F
SHA-256:	5C1E64399A57C57EDD518112C3E095A27A589071C3DCCF22283EE25576C16AF8
SHA-512:	C1FAEEC37142BCEDF57C762BE002363EDAD3D70FFA929598A850FF0BD71F4A3A912F2F565B663FC0FD88D52F3F934BFDBD79FE8B3AE13F39A779D410CF2C19F5
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....gAMA......a....RIDAThC....0..A..0$.eMSE..A.....#...^.e.~.F.fS....2.Z......^....;F....._E....36.s!I..=1....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\squid.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.320319813968626
Encrypted:	false
SSDEEP:	12:6v/7PykUuh/1DDbRHdO9SN1Y8s3Kxe1GvbeZ3Uo6LvFGl:M9DDbRHMX3Se1Gvbgwjgl
MD5:	B83E71B8091BA05405F5CA8A562FBC0E
SHA1:	C4B4039D6B8582797C75F5DCDBB8697138F41C68
SHA-256:	70AB1CF798E1CA29F8B59DB7A7B4751B87229C0C9B298BAD35739CE8FBF465C4
SHA-512:	C6DA66199D1DF4E968AFA655CE0D0442EF5B6F54F5BFD8E6328EF90608151499200EB615C3F02290068FA72309AFF213723C408C66F00A75AA7C7961942303A9
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh..N.0.......V...Xx......x...<..O{.\...N.@-.j.......ap.......%...P)u..E...Fi@....{....zw......(.......B.y.J.....,..........~.D...Z....#.:.W.....0.b(....Z.K..M..............>............rk.....8.......P...]..A........!Y<.......> ...Z..........}...... o&o..D.W....[......5A...d~i.l...Pz.S'(..w.g\|O~..R1VAS.`)_~<y...X...:...GA.y.....C....O..E.Y..8..W.....Z........yk.[....2.....M....qj56.....X..y.....\|...[c7....[......6.[l......\|.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\steve.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1350
Entropy (8bit):	7.745771879677308
Encrypted:	false
SSDEEP:	24:y1w6vOBg63nr/3AtNpE5PfqkdUEJcYPCXdEuyoTkBis0GJQK3T6xcbzU7Y/Zcz9K:y+6ZK/3oJiCsRFvesTMcbzsY/ZcBY9
MD5:	E5A2E67DBA2C2D6BB80817A1C9211036
SHA1:	641094577EE247344AFBFD7DF3BD01E8B291A5A7
SHA-256:	4C7B0468044BFECACC43D00A3A69335A834B73937688292C20D3988CAE58248D
SHA-512:	9C3974D6001F3C20318131658360F23D0E209A7D746B08F14F7A87183A679EC5BF7301DAF4EA301C5D5F046E32170A60E5B45AA7B53CD764907737214C7E421C
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx...K.Q.....,.(...mZl.=h...(2..0.(.t.".....PXA.H.=t{.{.....\|..o.......s........~.e.z&..I.....a.<.yh..J.q8..D.'6.^.HI..`.o.6z\|..Be.....TX.$.I.PV.....i.ee.@.....t...L...t.......r..c....T6........L.V..S.j+.....u......].R++.B.X.........v......mY].............Pk.2.. ..:(.v$..}..P....5.c..=]..92@./2.wt.&.g..u.\|.<5m\.b..:.Yx...&...GDc..8CyU....T@>...>.B......A..\..#...vL.1.E..E.m.M.......p...J..OO.....Z..#u....w...#..b..:..6d.a....pz........F/...s...... .}..y:@......G.bQ.u....\.m..H..xP...4..;Ao...~..js..[.w...k..?.b..:..6...N..}..._olz........G.4tp....+....;...]J.#...{.U.7....l{.R.G0.....O.T..)...I.......VX..w..<.....5..l[..`.Y.m......g.)P0.m..Au.:..P.G..=.~K..%.....NJ.~M.w....J^<Q.$.!.....WW..-.c..\.5..0...H}ho.+.....<..@2.................f0.....!......L.e.&.2f..`... /?...2[<.......h... c0.<#,<.4.y....@7-.cS.z.l...C.e2F....6'G...4.......S.T';.M.F.:=.\^T.9..:...r.......@.9...&..<.3.....s0...-`....{X.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\villager\butcher.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9232
Entropy (8bit):	7.969989285448097
Encrypted:	false
SSDEEP:	192:E+SDxQYq8n/O7uSP7HbTnnlGnp8quwnNpkyRZ9D870YjKDkYjF8:VSDx3q8/mjlG4wnNpJR3D8wIO8
MD5:	3FEB85C02346E192B2C84564FAF2FBC7
SHA1:	5C41150F52D2EC030662E4B269A9BAEE1ED7AC2A
SHA-256:	35E75789A27A73C04824D79FA52F0090AD73DA6974E0E566BFE578597E528A44
SHA-512:	2AAB6038E207F38FE288E250DD29AE8B0B010BA2313E876B22078ECFF4425F531A48A8C62D05C608EA04F607982A1DCC135DA16E5D56A60554C596DE431F6537
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq....azTXtRaw profile type exif..x..gr%....c.^B#..A....\|..h.Cz..d.%.....N.xf.......bB.%......k.R.....O8...>....7.O8........7.._o...l.....Ny/d?/\|.y.Y...+.....oS.....v...x/.^...!.....w.-o.....xV.o..w.vz$.{......\|..#x..........P.'./H?b.>n....m...;.{./.._.....g.{....T2.>.r~.P...W.....\|U..[.dl....0.ZG...v.f.]..%..\.s...X..U7NR...v..LC...d...\.=...~...<-.t..Y..._.w.........)..b]N5.2.9}.U$..7....\|._...%...........%z._..O.=..O0o;.<..."..Y..d.I..M...ek.c!?..;.\'.6F7.....Dr..yO.....0.B".O>..Z.d......5.....S...[.)..R.I...!.r.%../..J........5.lj....M..n......{.^{....#.4.(..6.....if3..-.(..V\i.UV]mSk...N;..n.Y{..=k.G..<k..2....W.x8.KX.IT.....ge..v..Sl.N.S..h....J........g.2..y31....?.Q....3J.....o.6.a.....TL...6^.Js.................pq..R...LE.KqD.TL...:A<...N~......G,#y....ov.W.....}Q.m.=.c.@.y.6..q.n.Z.Q......7...SN.o.g..du...1..L..yAD..[O..o..tk...i.Wf.h>.ImG.\O...Z%..-.^.n.k..V...V....H.g.d1.......NJ

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\villager\farmer.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10652
Entropy (8bit):	7.973293070471353
Encrypted:	false
SSDEEP:	192:9YkPrYWkSmqOTGQ94rbaI814yVUJjVphIkSrtJfenKfVJ4ADLkugM2RJvq02k9:9YkUWkSmybU14y+dfutmKfVJ4nuR2T6a
MD5:	0E8889152264F5DB5F211A271441E6C0
SHA1:	29B2CD7D3D4B9FA53F0BD2453B873A7B62DA9824
SHA-256:	1F635EB6477662AD632CFBD70E3BB593A4AEA2245D987CCACDCFABE3FB18C39E
SHA-512:	9EEAE2A8CE8B409FF312F688085B4A46BF83547CEFB3498CF08AB4583097CF92EB51FFA6A6252858A6ABBB521F5CD2CA4A30997BBC7D227CE8C8F681F4C1CEDD
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....zTXtRaw profile type exif..x..i.$+r....-..a9..h.Z....QY..5.U..!...0.;..Y...........b...../.P]......}..~...-...u.}......^.x=..@~?`..<....F.{..........7..n.M}?..............b....3ny....=.3._}...+../\|...}....?.....k...u..R.'...?..}..?^....Fd.=..7B........=......J%.N.3....vnuW#../.{>_.......D..5......;m...s....[.....y....'(A_v.L`.!.....y.}.b.s.y..'O..r3.'..e......{.....>.V..)..."..\E@.~.4..=_.G.<?..`<.\.`{..E..Wn..g.u........%...XO..Db.d..\..u,.1r..D...5..x..Nqz6...\./.-."..3..t.V.....C-..L.1..K..%.B.)...Q-..r.).\r...J,..RJ-...XS..Zkk<.q...W..].=..S.... }F.q..G.u....L3.Yf.m.E...J+...j.\.~..w.y.]w.F...Q..D..}....s]..5^..s.+8....s......N1{...)r..S.E..Q.Q..V.#.aY.....W......Wqs.rF.....Q....3n...l.Q....Pk....q.*.&N.?w..vP6.6v..LN.....J}L 2.-\.#.J.Y[...c....g.O..{.2..{...f.{..}rL....f.?F/..w`"....V.%.uk.Y..f......[...0Y=0...4kL.3.xy..h..s.V...M.[.5...L...g?.....:C...\|j..W.[.^......i`.z$..E...f.Z..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\villager\librarian.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9947
Entropy (8bit):	7.975784209282397
Encrypted:	false
SSDEEP:	192:BftddOhSo6kIQ1unXS/o0sTDqOxnMQE1yIvGdMgWf2BpzJtLHbuYU5+NTIZ:BftddOhSo6ksSUCQnMd1zvGdMgWeBpvQ
MD5:	66BFA93F0418FD004A8E61C89CF84023
SHA1:	EA49B6DF6E611BABB1E6E8521786EBE89119E113
SHA-256:	9AF42FD4194FC745050D4CD938BF1CA0A7B09581854CBA75B80470CC8651568B
SHA-512:	E796CC78539BD619A0A7D215C53CCB2B967BCF069CF1B78A540D9E6D0915456311FACD22418238918F0910C102678DA4F1FAD1376AE4EF44FAE19227511B9C01
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq....rzTXtRaw profile type exif..x..kr..........X....../.CR...v..i.==h..Y..<.......~..'.Rs...'..\|.M}..}uo...'~>...?..x..^..3...........7~......~.r...O...s_......>.?....Y...a?...w,.c%....;.....S.3.-t^.?.{].v......{...a..w......wS<o......K.\......<....v........9.......Y..R..7.L..k._E\.}...oe...-.9...k.c..[...N7.b...^..>...o~..~....'T\|3.Z......6{.t.'/..1.....}.v....{.s.....V..+...<.......i2....K..86..df.,....1....`~....\|.........d\..ov!....}q.;V......<.R..=...qN.z6.)......@..H$J.5...1.?%Vb....R...Z.9.S.daT/..J....J...j....jo.. ,....jk.w..........?.#.<...>...g.y.Yg.}..........&.v.i.]v.m.C..p.I'.r.i..{............xM..v_....K....N.\|..\|tx.........b..\|.6OR$..\.s....`...}....'..+.....#.....#.}<.O...k.[E.. e.l....q....t_OO..P..>O.$L..5..c. 2W.....R}.j=...1.2N...1........!.pX..m.r.....p.9.G..+'....[..K.:...w9X.@8.p.......s.g.g..sV./...8...[....h...lyE_W>.h....$....i+.....z....+c1....w..v......b....c..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\villager\priest.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9250
Entropy (8bit):	7.968778749130135
Encrypted:	false
SSDEEP:	192:m5jFqRMPkJ9KxrMXg+iukez+FhQE/J77X1Qt5jlWHG7SMTrDRhuR1rciF3d:kqWPk7KNmiukpFhQO77FcVlWSX9K5FN
MD5:	C214F3643C1A5C5529499FFF8F245987
SHA1:	1EED0C8AB67345B609B3F1EE32C1C4A3D256DA6D
SHA-256:	D971CCC1476A85272A7E38A11E8213E26049C4917391A745A9B32B451078BB9C
SHA-512:	775AE9054C6E9982CB313A76E9A95D34CA3EB34BD74C9C05D54DB878CB340D51109678E81A9A5B5607527387153035FC4B7668BC3031AECB8129CB295CA4195D
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....zTXtRaw profile type exif..x..ir$......s..N.....`.?.#R....g#YI................*1..rm....z.a.=....?.~.W.\|....?......?..\?x?...~n....]].q.g .=.}E....g......o.?....v>.........S..;3^.......Y"+.=.~.'....y.c.g..c;...7.}...v.....5.{...>......{........`._...~....{..T.Tq.M}m.^q...n+\|W.e^W..\|7........\|..k_...._....%.pB.w.+D{...zX.o.C.1....^......m.n.-.y{....<w.........{.{.]..m+...i.!..'W...?6.f_.v?......f3sc....3......u.I.........3....<.`...B..;6.3Xy.)L<.s...ob,8....=..!..m..G.Xb.5...J)......9..r.%..r..J..."..5.Ts-..V{.-..r+...z.=....^zu....`.....W.1.3.<...>..>+........;n...].n..q..J'.\|...~..k7.t.-..v...^.x.W...<..^....c..?...~..E'Y>.c!y<^........<'.==...?..r.....L.\|...~x....r......sN.....>...o..=,.Ds..P6}.....PNz..}..l.c...Z.E.{.S..Pdi2\.+c....#....:o...97..]....=1.x..=}_b......c....F..&6..q...yF.YC.Y.......W.lVX.&,...Y.yv./.....Yz...45..y..Sh.\\....qs.a...N.c........X,x.,.3..Cz.{d...e....B'm._.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\villager\smith.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8481
Entropy (8bit):	7.965516723204107
Encrypted:	false
SSDEEP:	192:HdSXvUfUDGybt19Vr0mNd2D5CDusGtbnuNNUMm9hpdQPNmSkA8UFCHk:HdSXveUayp1qP7DdyPNmJA8WCE
MD5:	741E7A1B3BA4C523551153323C359304
SHA1:	AF386C35DCC517CE458E600C5CC86C6EBE530F8E
SHA-256:	5465E41F61A036DEDEB7D40A1A912F9EB3B64A62C660AA8CA8F748EADEAE8B19
SHA-512:	3D9ABEFF5C2BE0C736F0B1614E61859AA018FA055BF79927EF0B7A580317EFD2171772EF9CCB0509D6CEB2201BDC8B31EE0F37EBECF851E73F51DEE9322CADA3
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....zTXtRaw profile type exif..x..kr.8.....{.....O.....?..T..fl.wKVR..$..............c~L......PCu.....O.......[......8....i..7.........<n.x.S.....?.;..{^y/..=n..M}?../.y...^....L0f.z.........Y....S....H:G.........-x.W...i.q.3..I......m......X....7Z.......g.{....T2..r^qb'..\|,...y..W....&..\|.c.uD{.`.mv.u~.;Xbp.e~:7.?...q...e..$f._.. k....{.[...-.yZ.t..Y>./....s...]k....r.4.P....H..oL...2....%...........%z....'.....[.6.....{G.c=.x...&.d..............lr.}"9...\|&.s.....ZHD.P2..tHV....P.P.>..cL1..kl..bJ)'qT.>..s.9.\s+...K..RK..z(,.T......7m\......u.}.=..s/..6...#.4.(..6....if3..-....+.........;.....'koV.f......5.fM.....5...u.+:....s.....h..=...9........L........~r.....7.....W.3J..G.R.f.y.C.f;........o...Vi.4...s.hk.e.nc.A....\....."SQ.R..(..fm.N.....u.>....e$o..1.....sS.`L..ph3.........g.5...j.F].w..V.D`O......d...).=.Ycr....s....[O..w..tk...i.Wf.h>.ImG.\O...Z%..-.^.n.k..V...V..V.....b,..+......f~..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\villager\villager.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7586
Entropy (8bit):	7.964349935065721
Encrypted:	false
SSDEEP:	192:R+0NaTFiDcwD9bXFA3dEsi4f7UAu9fMwmp8tlPcWS:R2BLsbXuNwAuGwmAlPbS
MD5:	5779CDF4A9FA4D0DC7EE5C09233D4FA2
SHA1:	244F64FF6E1BB3CFD4B46C9FAD1754B18A556262
SHA-256:	9400F2DBDAF59C96AD44285D49DA3425BA5B119CDA90360A7018FE58AE32121B
SHA-512:	0188A67271529F811AA16F2325307A6F720B2B3343DF8494CCA11B45053D21E10DCA79983ACE5DED04D4927AC29ECCAA22454950B4D4125CAF9CFA4C58DBBE10
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq....+zTXtRaw profile type exif..x..gr$;v..c.ZB.......\|}.f5.~fb.H.h.....$........C.\..^...S..'.y....I.....G...}..A..c\|_..~.~..B.\|....wu}.i....../jf=.\.>....?.].\|o.......3.g.?.N.`..x1.p.....f.. .8x.o^..S......_..}=.C..!v.......{....}......i.o+..3..AO>>?......{..T.Tq.M..=..I(.}..S..y^....."c.lN~.....>......%.pB.1.....b.=,.}......b#7..E.._k.6o...o.=W..`.o.........@..t...W.XWPM..eN.......i....Q7..F2.-...g.C..k+Z.#..'.O;..?.."..,.G2..../..!T.c#?.....$.>...&.BrZ..\|.z.6......L.TRC..2.SS..F.9..s.5...(...K)...F.5.\K...^G.-..J....F.=.a..^]o..1.t0...+.a.f.e..f.cQ>+........;n...].n..q...N:..SO;..K..x...z..w\|e.........5..2....5....^p..32..'.U....r.4.RP....".....2F...!_..........Q...e.)u...sJ.'s..._dm.c.h.R.*.O.....6B.......e...E....B..2.."KS.J^.(57v..o....yK.......m...9.........~..a.z.\|..h...F";.9.:.(>k.8..8....#.t..w6+,^..r....<...vAF..\.,..u`.MM.G^.........>e..F.%.....a?}.4{..1...=+:..-.8....,.vY.":g..I.. .

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\witch.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	7.645270146589167
Encrypted:	false
SSDEEP:	24:Q7VliX+Iqe45G9+fY68iV9h/PHWQ5qAZ/WfvgfpTYwYQZ2Oj13OhqQRTmbAuq7HK:Q7aX+7SofYn8PRZKvgRTYwn2wiq2TrA
MD5:	20B37A0C0905592149BC4EC2A41807F3
SHA1:	B67D5E08962A3731E5058E0EB9DAF98477798B9A
SHA-256:	BF0059807A85014D81A37FA649BC94079A384206BDFAE4AB6E8E6D7AF361A1B4
SHA-512:	AE8ED101ED85C26F504C2B38DF363A9081911FFE63AC149092A30B0E067E4BE2EA58AD0D7758D12AA68A9F6F836ED4147D1B0B91F75050E161740AC25E0DC96A
Malicious:	false
Preview:	.PNG........IHDR...@...........oj....IDATx....E...hrpQ1,..,..6.%.......A.......k!.@.....A.Q.D.U..J..w.........y..].]...O.zU].4...>..a...>..........S...K]<..;.A....So....7]M..}.ax..G..7........}qdz..r.........r...g......C]..J.X.!.s.)I...`........`..8....[.X.#...h7.\|L..O....V..@.{..`...9...S.P^:...\D....\Q...vM..@J.....6......>@4.........}..W. %....@..=<..\...R... ......X........>i.\.{%=..>.w.....4.... .........xy6..e>....r...hg.....K....e.Ok.xfl...7.o....P>.c.O..f.WK\D.........'.I.......{.$..z.p.9..t......o.]m..k;[...I}v.....$..IY.Y..x.......n..{-....:....@........!J..C..e......~.....`.d....Y....Y<."J.@O.p.........".q.....EH}..k...e..D</q!4..N...J..}.].9GX..M....o3.....c....=....9/.u..x........-......U...z,#.!.`tna.<.PF.....T.,....yl..^..`.....y]....!\.@..!...?~....xL .....I.cpx1.#B.).z-..z.pxxx..........i..I].@.e.c+=.b..+.8....]DA....\|\|..X2.CI.vVn..}.s.Tpo.&...@^.r...3.....DB......y<d.....K...e..........`-l,....?SD.%..Vv..........x..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\wither\wither.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.6908814594504795
Encrypted:	false
SSDEEP:	24:8BvjCQ+AUvEMrKCChWbQS7X2ZN39P0ddJ5iJvRp6JAklMwvRM5Hj91:8Bvb1+3rkWbqZ99MXiB+JAklM+mHv
MD5:	1D664E805B9184F85E7E7E2CB6E7C487
SHA1:	4CF60948058DF915F2E9AAA17C53323B6DD25D32
SHA-256:	3F63635C3C61348C78D821954D9F0E19206D7C51A87DD9AC2548629CAC7DCE70
SHA-512:	2C402A5AAF979BA9ECA444F541B3F4AF7BBDF5297883BC8A73D3025E7F1FC202D1676E21448EF90F8AF42BD36F9C4F3B4C3CAE162AF0E8AB06B7AF75AE6EF130
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx..1N.@.E}.D..A..H...7!^!.3l..X.t3.n.A.....\|Ko.U.e{flc.....v.]..WO...Z...\|%=>>.....Z..^...<.....?<<\............::...S......z/..o0.b.\....S..pqq..K.%............t..`....\.X.....qU..%..J...2...v........S....3...3o.= :. .S...~.........C=.Z..<%\......~.....]..U.y.......O....M......Y..i..._^^j...c.m.y.m...D.D@../...`.Z.....F.m...g....K@..f..c.Q.e..b<.v:.e4.H.\|....BK.......{@.TV. y.VG.x./.0...\|..f.w.$...Q.!.Gi.."-K+..&.@.....7.Mh...bo..My..cFq...6..$.....G.6Zz...-...A..F....{...6...E...g...q..../..`t.g.J.:<}.._.......8h.md..N..9&....* )..RZ.U.............W?..V.c......0t.f.....x..,ezaB....h...i..s...q..hc.....F..K.M.../.....M6......ojC...........l.....8y.....Z.'......U.~...+...}E@777.z..v.......pg.. `..{...V....0 kY.Hs.!x.#0...i......Az:DV8......Xy.,..&x....Sa6..M..0N0.X...vw..pt.Sdv. .<-...g.^.....V..D&..h+.............U.T"...*BJ%2.b@V"SZ.RmP.....O.......f.e.W..pj.".1...6R......e...(.qG..VR..h.&...3..z.....M...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\wither\wither_armor.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2344
Entropy (8bit):	7.891816846053528
Encrypted:	false
SSDEEP:	48:peHMWmeL7vRezZelIJNw5siKak8eHXZe3BSV6viC5wNwbwylMk+ow9:peHMK5ezZeM+5rKx7avZNp+ow9
MD5:	637C4B7E01E616153293497352309047
SHA1:	7D92F1104A997D2D3DD6F02B904FE196FBFD596F
SHA-256:	5EED746766E4B18FEA7A774A3AFBFD9ED7865FE0E5E9590B7FBADC5C827CFD73
SHA-512:	9C7DFC21D93AD10098F96D3C4A7D2027C50014C7D50ACD38A676F3D626CCB29563AE659CE82850D6F215A921E02457368A32D9F505D785AE7B77024B578866BD
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx..[{l.E._....F..H .F.T..XA.........Bm.bE."....RQ...bi."Q..E.H....Qb@../$.. .B....n....{....z...sv.3.S!.hX..P..~!F.2.<..1..]e....[.Rg[O....}E.T2~0U....&..dP#..y...v.J.[..;.y.&.....J:N...shpQOthtz.bgG.;v.}..\|u..I...C...Z.ggg.F.....].t....vT.Z.7/..C..+H.o"Q...Y.V.....x.n....h...7.........J...Q].....Vp..]WWN..."..G..L....?...+"..y..0uv...@-..C..M..U..z....P.....p....y.NQ-...!..g.6...DgXI... V...k'.jw..E....:X....\.eQ.u...7.v.....M.......G.0.S.y..N....t...,.f..M.@yyy.gm..g.>..L#..:.9...h.......}pu.3.T.C.....".J.....T....j....(...DL.....B(( ..J..~F.....B..zp.^.W..~R0..?.2..Z..#....g..m.....81.[.n.U.V.z.{w~'.O..m.....:..6./..!.....-dl.v..1Q~..c.Y/6......!n..Y.x....S.\....P.......y$..K.3...Xr1g.....b..`}.nJ...Q..B......>.}.........x...S......b.o..>...5a0..{...0P..E.vG.%. ..**......&....V7..U...N.....<.<."..d.o..C.,y.F]<...9/.mL:.?.a..c..........l.../...Zzio..<...e0..f..........0Cuu..P).=&.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\wither\wither_invulnerable.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1018
Entropy (8bit):	7.66038045133577
Encrypted:	false
SSDEEP:	24:6rgzjZiLkkOEnilnlC2ibavW/mupBiWqrntwJEiijkOz:6rIkOlUv1fiWTJAjnz
MD5:	0F848D48EBA3B38349E0558088292A39
SHA1:	80B6A8B17F704C8CE045107F09AAB537E7A36168
SHA-256:	B61799CC41320190F37BBCDE3C03CEEAEBC0CD983FFDA03A71CB240FC63732F2
SHA-512:	EBC2CB4D4A7B6F83A45CFBC32D8860FFE6C96647B30720DC9E64715B19CFB184FDDFC2180FCD825730FCB5EB852AC0A332C02BE0C38C3C763DE981EB0A6B9E27
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx..Z...A...X6.L0qC..E.."../Q.A/320........M.3...?..].MLGj.-...wzz.g......z...g...Gn......]t....N.k.6...<z..S..n..7.=.T.O.>wm.K8h....J.....P.).e.@..c....T...%............c......8.bl.%..b....=+....R.@.b..\.I...9...s.....q.1.&Y..3..sJ..=...z..W...n.iE..S..[.GO..M._...._.r.. p.{....N..V...Z.......-.... :.>.^mC.B........P`..#-..8+R@T3n0.l..6...- x.={..M.~...w.Q;=...i...zFch.z.........T.8..3.m..^....:xo!.Y$...(...^.4-...kE..CC+.y...c\|-.&p4..^>z...<.O...;.Ru2...1D.{.z^e.u.:;..SV.\...A.uM..s.7t?..,.\k...k...l_\\|..cHl.....J.Dq]..>y.e[...P........\g.-........hE..f.Ui-.`....sU..?. ...V.daB.=......._^S.C..A...........K.].......4.&..............`.X4..r.\|.Z..Kd...nB.wA..~.^'.....;......Z"3..xmj.L..0.A}fAj..,...%...%2.[.........H.N.........-..j..Jd....}y..=.......k....v...B........X3m..y...Jd...V...k.c..N.~_...ELS.......f...;.2V.Y......8.Y.Z5.`......y.}.......r,...u(..l.G...~...k8.......e....<m.T.R.J.U.T.R......#

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\wolf\wolf.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1392
Entropy (8bit):	7.748192577275866
Encrypted:	false
SSDEEP:	24:dU3gXBYfSGQz+Kjxb6Cdd9wYqyxYooGt7mlmTMb088bIWI6N1aqL:OQYOz+CbQYqyxYrMmUTJ88bkUYqL
MD5:	99924611DEFCDCDEA40733F049E7F489
SHA1:	85474F940605E53C2A4C894937039DB2724965B8
SHA-256:	57FF1FFBC07F5C202D8E0668CD255154B01C862976E8292BB1FDD04AFA8E8FAA
SHA-512:	CD206A4D4031591A2241464F67B6EC14783D833D551CCD3203BFC3C962F4F7B6CD807FDFFCD26A350A5091FE68CC6A8A596A142B9901181798C69817D5C3896F
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....7IDATh...k^E.... ".....B......q.FB........E(...(H.V...P.VP.%.B....X.hl7...7\...^..an.y...a..9w..s..t...7ou.\........\-....KM...\|.P..>t......}......c.9.~u..\|.t.O.>t..T...n.C.^..;..V.omnv.....>...V?.ozz_..8$,.....)Q[.e....Z.N...k.$.........t..Y.......d~~~.Z....p'......p...D.T...&...<t@...L......./..O.........~'..>.@.].M.M1M=.8...0T\g.M.k.k. .j7.d:.....&I...J...W-...Z.......T...........8....<....)1a.Y...H..j..f.p......+'>...j[`n...t..;y.P..r;.'.k&.%....w.8..-...~....v......'...c26.]....@..?B....`.iY.......2&$QM...o.`.....O.{.W.._..I<....%-#...H.$).+cN.....7..h.5..~............ w...:..i.j.4......q..Zu......9I..@...].z.....s....4.........=~......g.<;&.^..r.+.....R.......G..i....gR_..]s"$p.{...h..g..-$j...mP....Z...Z.@...Z.t...........LD@...!...-D...Dm...H..{...D..}..Y?.e.K.............~H...5.._.P.......={bD.W...$...J..<.1.R.......r.....v.W. ......`c.".@..H.....<..8......(.)...~.........<sd..,/...x.r..y..C....3.#.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\wolf\wolf_angry.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1651
Entropy (8bit):	7.773652977040129
Encrypted:	false
SSDEEP:	48:X+8v72DaAJbpwlp+HHJdUE9KUAgB8SyVDrc/:OlDaAnwl4JmE9kIyVrc/
MD5:	39BDACE7FBDCEA9322B4EF8F95C824E9
SHA1:	33424930CBE394DCAB4EC41349E3D4F6051B800D
SHA-256:	9B0E2B1C6D41A1A2B36A18A59CBA4CB66E8BC245305A6A017EDFDC550E9062CB
SHA-512:	B78519A4380EBF0D0E96CD2FFF0257ECF9F70E3A27F5FCBD8514B221C633AD5094CE37C6E6BB4B9472F8E85663B29C50403D80F8C2598016BA8750F496C4571E
Malicious:	false
Preview:	.PNG........IHDR...@... .......~....:IDATh....WU.... D.6(.........=..MB$...E.~..Q..#..B.i =.A!eb.73.H.I#.^.N..4nx{....z.>....{.>.{.:{...v.=W/_.~>.....?z/.>..'N..6.?.......&.7....{w....#...8..\|.`.O.6...RI.....9s..n.......].j...A.........j...m..C........kN..Z(..Xu.zwr.._.$....".2...'.`...:..v.9........%..X.w"...~.......l_...)..q'.M0].q....m..asw...\|...O.u..>?.Nx.. ..E..d...S'......w<..?.........I..).L=...6I..+..H.I@.>z.\.E.M7..D...w3MW.8....{U1 ...........rA....u..-[....m....?..S..f.[ZZj.b..J..H.sU.....`..X.......'.C..m....G`....t.<9.m..o...G.8......\|q........p......I.c....sO?2:I.H..]OP9..dlp..8N.HH..6.A.....G D:.O.f.~..NHJ.~.eLH...u.B...g...-.wG>.?x..^../..N'.l......Lx."......9..I.. 9i.I....6.+......v...Jy+7.. u}.t<mV.NE.5]. ..p.......K....$....>..z........@}......]...< .P[{.}........n..0?..H..,.E...`WXX.......F.S.G..p..h...G.......Q...[HT..zV@........B...Z.J.K...."..\b.)@..Z.i.V.....1.........#."...e.s......"..\|.t)..........G...v...:.].....

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\wolf\wolf_collar.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2807
Entropy (8bit):	7.9037066962412785
Encrypted:	false
SSDEEP:	48:ia0tnXGIg2GX+Ird6gPsvYakBrfjvhUXluY0UanV1t3Xk1eb3VyLbN4sEu7xQ6wj:iNnTgLX38gPsvQBDjvGaVPHk1eboLbN0
MD5:	5293B485E97FD92955F3C1D3E9700CEA
SHA1:	8A6E95E13F65CAAC6C290A904702C052AA156666
SHA-256:	051DE7C803C55DCD2FD866D424167B265F3B50090592E71B0E4BAFE5A38DD1B3
SHA-512:	978D18A654E8296E3B03E2126774BB7BE836C1C300539776816F50A366989015029E27B2E188556AE9CF9597D755C42936137347B298E6DCB5E4DB8A159F694B
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh..Y[o\W.^..!....R5.R."...B<........T..q..8T...!...g<......c;...e...c{..K%...<...3.g.LJ....}f.u...n{.!2..S!..t<A..,%..X[.....bq.3..d........[o~E......\.B..}.BfggO...O...O..........Ivg.b.k"...\|.......>...]I..>......\.7u...=>..y........}.....F"!$..q..k....p..U..wBp......u....T...5......-..."..o....{.....G.#<;."._...K.@..x.W%./J20.s..'XD.....A.M...\.\|...Q2`......&M.....o..1.....X[.....t.-p&x..l...SV.@..>O ..A.@.8......w..:.....J......9Gg..T.6.F7.....x.....POc..t....IB.....X^....).K......z....xE..C`a..K...b.$..udaQrAZ...`..,.L...j.!p.Z.=jj....K5,.}......v_(Hk....A.........^..x.W4..&>.>99.....1...n...4.#BCI@.F.M.......Hs.....#..}..>........wV....+H[...mm..q.3..V.....1.+...+..t\,../\|.K...["....O..n./.<,U..3?(....5.........k.G(h.@..........U!;.....p\|xt....$>.0.s.=.ei...)p..+...D...=...N..S.3vBs....p._..v.v.}M..+.FA.C.r[..jc....R....:.......C..hm.`[.....Z~..{..GKe..*..6.w...Y......cn..YI..0.?.{[.$.:..d.:.>.....

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\wolf\wolf_tame.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	7.800315169612279
Encrypted:	false
SSDEEP:	24:aUr+EnPN+JysxPxUuoavDXqiGYlUnzHJRKbpJ0XvtYqz5bHxKhbsgGuB+iutPkKj:VP6dPxWaf3indRK8Xv7z5bHMhFB+iut/
MD5:	0ADEFED560AE972AA77196E283C4A0F7
SHA1:	3D7A9B8E9927C844E292527F73ABB249D7C0FCDE
SHA-256:	8FCBD2CA7494336161B91CCF9093E0E8B88DA4FD222491BAC2D9EB5455277058
SHA-512:	C129527B9A26F95B48C476701A06F13EA8729B99C4053EDF0CE29883B08937A6A51CF46642050CE8736095EE5E4813DA7BECA985D3C8FB6E80468E35723FC946
Malicious:	false
Preview:	.PNG........IHDR...@... .......~.....IDATh....k.E...AD...Q...B......p#!...Aq..B."..X\.D...A.J...J...va#V1..MA7.]..<.{9.y.1B..3.\|=s..{..t...W.u?].<....._.p...=........v..w.2...~....n......<9.d.D?.\u...RN.....x.....k}~mk./+.>Y?1A...C....!Fu...:D.!aqq...9%k...`.....u.\|..$..?...!.I@.OL,.ARf.^.:'.....!h.d0V...j...9x.$...]...r.w.\..$....133...tw.{y..G....Wc}~..=.@...H........}...S.h%.3.&.U{...I9.....LkaJ... }..t...6..U..l.\|....k.c&.....D.o..\|.H/C..O.X4....w....K..v..{...9W...........W....{...UW..y<...Ls..m.......w.....H..8..G...I.c......<:r.$....r....C.9. .I.@...i...&L..<5.qBRR.._..$..^..$L..?..-..}{....o.4P.._..I<....%5#..I$x...>'M"...$.3.?...A+.....J.(..9..(.. O...s...f........"..W.\|.V^....=2&.....Y..+....~.8..sy....?.`...4.x.;FD...:........O.H.....#..............T.=.....c..X.8.....Pt..7d`...E...............h...-IS...L.r.AZ.T.Z.5.H..<.`.....`.............f..Al....K.0........%..K.[.v@W.`...2..Nh!..=0....p.\|7.#....5...k...zjj...KT.T..U.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\zombie\zombie.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1007
Entropy (8bit):	7.650875963852855
Encrypted:	false
SSDEEP:	24:Hr8LXP1cQMT0oFIKRqpDECB4+/uezzR6XGmcdCw6Bk8nT7UB:Hr+C4toCB4+/uezMXnvUB
MD5:	F0B45F9301735B6E43DE3901DAACA8B5
SHA1:	EA11E85009F93A27F2F44C864F97745749729EA2
SHA-256:	08A223ECA3451ABCB170C12661B4A70ACFE967C437DC0B5FD99413D8B74B53B3
SHA-512:	6E8416239742F179EB58990E3FC35FC5536C1710C5378D188E6B477C46B4CCEF6EC62AA2F9A425D03330E4F15496DA722D666902EDEB408B584A8542A52A240D
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx..X=k.A....E.......D]b.."..V..BlD.....p.R)..Cp.p.?....[.....$"..<.....zogfw/.j........Qm.S._..B0{.O..h+.....^.m.@.VR...).[C.T......4.@3BK E@+J .. .6.......O.......P......t....tk.no...6gW...v. A.m.>oA.....vK..Q..GjlT.X.$...A.t1._.}.....8........j_i\.k.c....F.T.a.-.6H.-Y.F.......N.........Y.Y@.m..*..u.g.3...zQ/P..4...8..Vk..I..g.~>.9...[.......i.k.vuRg}.v..Tu0..m.`.7...n.../.N.........e....&.'...........>.o..F.=a......;....;.....a..f...u8...U...N...>..b......[.//o..!..N.`'.8<.U..2..E.....x(..$...qu.U...k.P0J@N...j<. `........".>%...........\|U..m.....u.e. .E...v.v.S..xf...irT.....j-.\I%@WX.......5...V.`....3..^.0.J..X(.[...e3@.R.9@6...(.UD...x.`..c.<.0.=y...^.........vum..,C..NsuI.}.....Vj.U..W.#....0[:...9.....,.X..z.^.V..<...qI.@z....R.....&.%x.ao...t.......N&....4..C.%......"S.p.Z..s..8..e..'.........Kg.@....C..4..T.Hm.ZJ..(.1Z...........~.f..................................y....9....D....I

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\zombie\zombie_villager.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9346
Entropy (8bit):	7.972849676361079
Encrypted:	false
SSDEEP:	192:p3iFGYCea3OAN6ihQYPJimYxFyHvVGFcpU4FP/H3jLkNVEyEm7:pzDea3O6OYaAvVGCpU4F3XjLkNbEm7
MD5:	5F882515CB24DCC291DC16810FEABD7E
SHA1:	FA0B1A3395605D7CBF06DD45B55C8AF879D7E31C
SHA-256:	DB55C9E03613201DC13332C5A21CB1EE9F8674861A824FE0F827AF26F5AFFC0B
SHA-512:	4E10ACDB60633C5FAA87FE193FC414411731D13385CB7D6BC79E23CD7E949BD3E6F9CC2C9FA8A52034BC43DDA2F53976D6946898C50A2095F39B55BFEEA487D9
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....zTXtRaw profile type exif..x..Yr.E...^.1...h.;.....H........)K.D1H..;8...........\[.<.K=.0..=...?.......r.}.!p(..._...?8....~....]]...>..q..;.~...>...=.?...y.H.....].....T........9....DV.{...;.....x\|..>v...?...?.......P..\|N(.......E.....;...\|y.....{w.........>.......'.....W....j_.......ds..>....~....Xb.'T^CX!..k.aYR......l...Xd-r8\|...}..o..........r.;..\|}].^...O.....@....;g...?1.._.r......H..........3....-.....}...".Y..d.)>f_.SC....F~.+.1.I.\|.a{w.M...{.....{.h!.9.XI..C.R..OM...9..r.%....QbI%.Rj.F..k...Zk....[j..V[k...z..r/...z.cp.......1..3.4.,..6....Yi.UV]m.5v.q.....v.}....t...z..g\j..n....n..+k....5....}..'k.X....q............<............2..==..9.5....12.............../.-.U.R...S.>..s.~..=.Q.%H]..>..l.p..m....s..7...N.L6{.:u.6K.w.J$.{...\..].I!...V..\|N../.&E.........&v...N.7..k; .pm.k.y.88.......";.;p.C....M..I.....~.O..k.....,..w_.....C<{]..N.b.~.7u4.)[...n....a..Ur.#oD..2..T..<gq..a..5F.....H{

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\entity\zombie_pigman.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.770513262993788
Encrypted:	false
SSDEEP:	24:2Ed/Uy4dYfzaKB2L1SOA65UxOlZ79DltwVKVlE2MqmB38V1+9/DJUynChFxvsRm2:2iadcz+L1tLfZDizqmBsM+ynO4mYbi1W
MD5:	47F136C6F4722E3A3CFDCED45FF7A9CD
SHA1:	8E9C08A8B3A518F9DA199886694402E4A1222E5A
SHA-256:	D745F7CED8DA24F67F2977F323F6D2241F9CF87086FD6827AD784DDE6DB81F94
SHA-512:	3E1DFF700C073102670DE47A1C8D765118E5849D561EE617981559A5F9E034C4938B643D2C58B22DCC206874B320BE8BD9CAAE9D928713D2F8D695EFF6960242
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx..M..E.....w..."..5kW.T...t..4&+..........,...LFD..0."d..d.B.. h@.m.....}...Z.........s.G....?..tgg..n..]..gC:5.so....^....i._W..~...={..}..G.9}...A...a}...._._...;..........{7...~..n^}=...]..s...5^..H.....H.." @.....h1..J.".N...{.bRHX..,~\|\|\.V.z.o?..C.,.I...%.....(..]..7.%mIX.......R.......K..nN.@D.:..U.X..... Y^m.T......?A.,-.N...pBf.$H\c}.......9)...li...s@&.....1..>..G@.QH..!.y..}.....[..<..>f....;~b@`<=X. ..7g.Tc.@\>.`.A..........o...8W...^'H...'.j@ .. ....'D..5.......\./............V..72...3Tc.,z....w/.....}$....o.UtU......~ ...zN?....<..)..,;....$...:.!.S....8..<.K.Q........2h.qi......Q...Ej.6..S.1. ....../.............JV.8D..c!..d..R..&(e...)^..^.e..O?.......5...U_v...<..w.w.......Km. .1.'A[...C....^.y...U.h<.!.O.,.....4........P..E. A...$.....>z.G_y....4.......B.6..m.ja....3N$.n............P&.......M...n.......Dh...1.p..8....._djcY.8$x..R...'......%........gR?...#......C...vw.[.^../....^..hO..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\font\unicode_page_00.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9213
Entropy (8bit):	7.844498869073628
Encrypted:	false
SSDEEP:	192:owriVMIwPuEHw3GU0aNiUzXUzOwFpRRficx1f1Q26pp3EhlV/YmHLBeG16Np1jdf:cSxDQ3GUHNR49FpRRqqOp0hltYELBekU
MD5:	EFA8FBF3FD6BADE13982E3154437695D
SHA1:	045CC609033DF4933C269113F6C16E4BFE35524E
SHA-256:	A35C1D9E0B498F76D5E2AB39AEC4B8B2DE84B4E5B30DE26983B287AA6A110EFE
SHA-512:	0F88302E40D36A6DBDC41FA9FD2648038E26378A7D1788F2CB36585C14D52E89B216D8E06B73D33018229E82579F82F13DCA1B7E08BC0880EC325FDB1D6C79E2
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....tIME......9..;.....pHYs..N ..N ..}......gAMA......a...#.IDATx..]=..7..Lu9s.h#G.m....r..(r...F.m..?....)...O6...R..&...l.H...../\|..}.k_..B.H.....K....7..?....=...o.f.......7....._.......O.\|...x...g.\|..3<.<zO.$>w.....AU.i...`..6n......?.#..O..4...r..I..mn.V~.?....[.Z...[..s..........Uz...3>~......\|.w...\.{..2.3....w......J.e.........._......_./xk.+..........u...\|.........q.6)./...~...W).._.5....q..1....8gx^4>.;......h..?..../.....3...C.[...._..4..C.....q;..lj.>.gj..o.Z.\..3O^4.R.....Y...3.3~d.......x.......l......_~...x6...~...O....O?c>.....%...vf\|.G...j.?..g...k.&.....@......q.Z..%.......k.........!n.4><..N.....S.....7....>~..r...7.3....g.H.....S..R....o._"..7..[....k_..d..z....]....o...%.h~....%...o~....z..7.....LO...gzt....>w.&....K......0.s\|k=.i.....S...g. 8.......l.?.O........?[c3.[.N..g..\,g...z..z.R.......z.Z...Id.!...5.S....:....?h............cN...g..?...Y=.._..S....sl.....}f.}q..7.c.......

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\font\unicode_page_01.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5359
Entropy (8bit):	7.872737663100234
Encrypted:	false
SSDEEP:	96:9xXnS+MeaMRf0SR/EGYVRisV9iJBIMSbG810bs4EwrvAPskvsvWkh49vpU/t:9pVaMHKVRiiQ3IMGG24rvf7eksiV
MD5:	4D91CD3C894B1E2DD2545BBCE4FAFAEB
SHA1:	E53AACED93A6ED5590BB9FAED42B83BF3A25118A
SHA-256:	EF553D3A0050241361DB6352B7066D92149516F2B849886C2F57F08F460B0B30
SHA-512:	4D09C52C436E079753C478B43D204679F61635139D4C7DFC5DCC443AC52FBE0288E95996756F558B4A3A49B74412C806F2F2280603E2C1FD7380C2D6ACDC09D5
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....tIME......&.B......pHYs..N ..N ..}......gAMA......a....~IDATx.....D=Y.....g.}d.."QE. .~....x......._~\|.._>..T.......W.Gl.....QyT.;.D..../.H:....,....W.V"".e.Pu..l..2.W. ..U....7..G..cYU.7..L.w..u%....F.......Q......Y...[.fg.J...........W.K=....Q...s.?.~...z...g...[.N....50.....W>.....g...]..u..~...?L..Y.....o..+..=.,..?.c..5..Gm.1F.....k.b....;..N.....5......W..lL.}I......d.2.q..u.D#..YA.#..S....g;GOo[.#!.#rQy................+.3......xPy.o.,.V'..1.j...Y>...(..:.F{#3(S.......iC..4W`..;f.S..#KNE....D...<~.n....X.t9......C........Q............@j....1:....(Y..u.P%......f...7.]..l.W.J.k.^}u..:l...._.4+.....~5..K.[...E...O....{...1.?....I..,G........lM..+.c6&.........{.U=..x.`.ql4..U.f..n.V...Z..IF...;....fC...IOz.<;.!*..EF.G.~....Q...#z.......W.....Pv.!..H<wK.=.m1.sQ.1VF.rF..$.j.N..t...$.\.2.6k.ot.P.e........U.=Qx....X.$.........6..ad R."..L._M.....qf.G..ZvD..YEs.P.C.......c..Qf......Q...:.....oF....1..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\font\unicode_page_03.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4874
Entropy (8bit):	7.871809521554855
Encrypted:	false
SSDEEP:	96:gasSqL4Pej0bTl8FHC7kqFuyitMdevjAxZ70NVFcb+qix2l2DU0DUK5OoY0Ziy:gyKGTp8hVq+mdJxy/TVxc4OoLZiy
MD5:	8BE6D6F821D2279EFA68621064EBA155
SHA1:	AC9170B63C48EA82F1DB6FB69A054B3EF424CCD2
SHA-256:	C4FE0269D1436ECFFEB51A1377C229C38822A888824BA1E52120D661F1C2BFAE
SHA-512:	5BAB734F68AD471950BD75F1CCA737224B4E4D31148E4DAB3CA271C7C08D35D44D73B7E45547C95DB046AA8F779773397AFF2EBC7237EA82441EBBC05F5B75C4
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....tIME......3...\....pHYs..N ..N ..}......gAMA......a.....IDATx...v..D.d...r..Y.s<..AUP...3I..B.C....._.../......G.jm.h...1.k?..E..r.e .....8d..P...-.a.....nv'...............T...GdT+ ..&..........!..IQ.A,oy...1..<....-.K...;.=..-oy..1..c.1..c.1..c..?._....OoA..C....D....g...W.V..$..p..RD"1./.l4...e..*.q.V.ED.A.......0.............V.......\|.?.c.-oy.<.uP.7.......N...;.=..-oy..1&9....+`.B..:.K.2......FH.....g.\|.+........]7[....aM....md.Y.O...c.1..c.1..c....E...-..7..:....N...;.=..-oy.<.$.B.{VV.h3.........._U.....k..}.....BF....qC.2..P.......VqfG./......c.+.._...oQy.qT.-.QFV.m..,..Ma....;.}&...~..;..e..S{...G.....1..!.......[..V...+..0f........ay..l..=.c.....2...d&..E.<W..d...e........(w..P.". .\|..#...~....g...P...-...[...+...@.. jy......W.......]...o...\|......,.6/...{...T>...F...-......\}.)#"..w.T..a.$..1.jhO .@....8z'..<..f.....zc....4..h.......6 .4[.F....:.Q.l....lt.....4....`.]T...".a7~.a4U..c.@' ..l.....e.2W'..KS..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\font\unicode_page_04.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9709
Entropy (8bit):	7.8489563669759805
Encrypted:	false
SSDEEP:	192:4Cxbzc+EwDvpoSpklyjeBgeqpK4dfrnJPdibDCunPqgSRCN3Ec58N/3:ZbzLd2lyPeqpKQVdWOkPqjp/3
MD5:	461AB56329C2001076A9972A6DEE5365
SHA1:	1563604C367E0045130FD27529B1B05C03C5CCE3
SHA-256:	A289958010863FA772091CC2EF5B43D525B238905C0ACA3C5C3B50C35BBFBE9F
SHA-512:	B1B5745C0BA6AF69515138D5F568D7A0A2B7436E84CD4340447FDF61F5145A5715D9F0E3B688F05615896A70FD6B6CBB363DC83930E87849FA0F4EB1409EE975
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....tIME........,.....pHYs..N ..N ..}......gAMA......a...%\|IDATx..];..5..].........._N@....#"2".U\...j.[..Uu8{F..{8..z...._\|..^../... ..99)..ib.\|..d.qj...F.%.J......Co....?pc.fP......p...?......,b.........L<.@.......]...o...g.D. ....{.M....k.......g?.a<>\|. ..7o.....c..._....9{.........k.O"K...C+G.oy..Y....^................[H^yo.........R}V.c...?..........e.....g....k......h..........._...<j.T..vo..>........o..W_}.........#.R..~TnF..X..:..?\K..O....e.x...g........u.l....&.(v..,?v..f...=.........a.@t............o.,{...7.....G4"6.>.....C?.>.v.@.ho.%sb.w...........l..~..i.x...p..w.#..@:~...v\|....w.>......X...k.t.0.h8..}.....U.U.........w....~W........Tn.\|... .=.g.H.....'...........@.~W.......m...m}.s..;..7.xQ....>j......i..>i......R... ..H.....-.?...cf....5..y.?^........^y.>.....~...?..K.:....~.o}?..,.O>..G.>...?[.Tf..%...5#]......,....\|.8";...Q.+..3]+.#&....1~.>........W.s~{e9...\|v

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\font\unicode_page_25.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5939
Entropy (8bit):	7.742797008028106
Encrypted:	false
SSDEEP:	96:MQY3lkX6t7FxWZJRlPyzMdQ3oqsTpBmHuhkNYM95a5/XACLjHWV8Zih:Dglkqt7FQZJv4MxFpBmO6NBa5/XrL08k
MD5:	CADF5842FAAD82BDDF58D82744BDE356
SHA1:	0B9E67874D5005C57A864AEA4791B6B64F148E1F
SHA-256:	F1591A8944E5C8033394F3018CB612C4CACDA5F75558E02A4593561F65BEC5D2
SHA-512:	52543546B15661B28CCADC0CA7D5EB5FC5ECC7248A33DD834A262B2888E95DFA2051B27F78F28788EDCA0B925A0EFB8867E7310E72602F7C8EA1C43061CB274A
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....tIME......4C.[.....pHYs..........(J.....gAMA......a.....IDATx..s.7..-.G.:W.R.J.......J.*U.T.TE..>C...........3#.w.....g...y3)..H.7.....~.....?.......D;....wn...v.....P.l...0.i'....g.n6nooU.dZ.l<>>.._...N....R.n`..S..?.._........O/3.U_...I.!.....O..y.[~q...../.....;.;.VW._.n\.z.}........]...x.>..l...=.^..:.V....6..O.G....[i.(.%..5...../.d...h\|....g..z.o..`.....+M......Vy.]..i?!...^f....\|$.!....?Q.W...[.U.......`..`...\|...e&..........g!..^.'j.J..N._.~.....?..^.[..i'..7....;..nW.....`....G....^......................F...mw.?....c..`M+.Jg.J.E....L..V..._..._.N..@...Y.5.'.............?)..[.9h.5V=.R........5.nt.....5:..Z.....pi.k..>./)Z.F....m..4......Z.....3..y.^.....Wt=...7..d...y...._.g.2/.W.J.Z....r6.Q..m......Xf.....D.8...V.!.Y...X....:.D.U....&z...~.....`..`c^}B.z>v............1....W..D..am'.........`.t.h........:....8.{.j....^B..>[>\|.......?..........=..... .G..g..l.........1D.[.o.....>z....X....vf.G........'.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\achievement\achievement_background.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3074
Entropy (8bit):	7.383545106071537
Encrypted:	false
SSDEEP:	48:TwqNn2SGJ3uIDiGQQiQq+u4nUtkdoxFdoxFdo6KWH42CMB/W0rHPc5ihK6:D2Ziuu4ULAB/zQihK6
MD5:	162CB04FFF139BFC67B088A64A815770
SHA1:	DDEB5586162422F6FECAFDAE06274E63BC4D45B5
SHA-256:	B99EC87194C344874949BCF3DCC40745128800C82DEF4A75C48B6D38E1694575
SHA-512:	9D73045131BDC19B7EC5A84F229BBC2A3B772C82A76FF03999A22A0529E7D844A1F437B3EEF9AADE1F0694978E75EE0266F7FA31D139AED6773E1CB3B9BA4CED
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:734288B8FE1911E2AC3FEA8AB84D254D" xmpMM:DocumentID="xmp.did:734288B9FE1911E2AC3FEA8AB84D254D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:734288B6FE1911E2AC3FEA8AB84D254D" stRef:documentID="xmp.did:734288B7FE1911E2AC3FEA8AB84D254D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>:N.....vIDATx..._n.X.......4..).:..,.B".....\...$6..H..1....O..\'.m..I..H....6_....:/.p..d.. +.......@..e."...?.e....

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\achievement\achievement_icons.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1439
Entropy (8bit):	4.116631353273349
Encrypted:	false
SSDEEP:	12:6v/7FOXqb/gzSCGserkX4bI6dPVOkXL8sYCzpVoire944OtawZrwi/z:z6QGtwX4bpVjL8sIfa4Otaw1j
MD5:	35EDB9FA160189F05FD254A2F51124CD
SHA1:	BBA2D331806B7A44CC9722436BA25570C6C91695
SHA-256:	6040AEA94A72E932E06C66439B799B17719ECBAC05E262BC27A779AFFE8A79DE
SHA-512:	82D4B694B8E712AC44B349B360B75EAA45CE4F6A63AAB5FDEC22FE231BA3B265FAC63E329663CCEADDF2D9D6D1D27E871B8AEC5B7B162FA4D82D40D0C0730845
Malicious:	false
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....PLTEk?..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................3..\|....pHYs..........o.d...5IDATx^....0.EQ{..) $rF......k.v......w.....{..7..R.1..$.`....A. ..\|@.....7......s.5_...N\...... ..m..^...hCB...... ..dP)..}L.F.d.v..J.4>..F..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\book.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9908
Entropy (8bit):	7.847263947549729
Encrypted:	false
SSDEEP:	192:GFeYP4MFTkz4j6LxN8rAbR+fz+k3QSEGc6PUb3+qSF3+UBpfyXIC9Fn9x5:EeYPViQWR+TASEz6Po3+qW3+UBtyXI0J
MD5:	3BDC824D6119C1411AF9EAA85751A533
SHA1:	23483345D16F726922D3312A9EAFC42353B3174E
SHA-256:	1114DDEB75EAAAC945E2184D3C70E2C0E25A30587588BA7A735B1712E93A8330
SHA-512:	2248AB7CDB5ADB56CEFD0B302AE579AF6CEBFC0DCC5328B1E5B3620ABEA7AA13BB4A9E6B5072E8696659F38082A6393C2C79947C3E36C9C0CCE12E8D8DA2704D
Malicious:	false
Preview:	.PNG........IHDR.............\r.f..&{IDATx..]....u.3.u_......0.J..pm....mB.H.E[%.H.....U...R...h..P...)i.V..B. ....(II.h.vJl'.`cl.......Ys.>g....3.g..=........^km.s...('.......c......>\|s..L...p..N....\8...D..}.....1;.&.56..Z.....^1...]-...l...:..Z..c..Z...ap...........`.Z.T.m....a..]..N..m~O..j....du......MNx./C>7...f....eu.....I.{.....n.<.K...c7...s........n;...+B.\..,....>...7OM0]...Z...V....".a#..$...a..e..Z....}&.Q.Vm...;e...V{.u4..jO.,e..W\+]..-.....U...-......w[.!.o......C...J.J. .#.a....<.vGM`q...:-s]...}.._..K.5{......._Y.^I.."...m..............hR.a..zO.....9.LR...A+l>.. Vu;m...V.......}.V......'*..^...;.......I.f..l.t.4._........E&.._MZ.Z....m.a.N]q..D@......@.F...e...o....m...q.4.7.n.Z#?P......\....w1.......MS.G.....zq;....."..~_...%~R7B.......1....(;.E.Of.....S........l....V.wb.1Q...V.....o,.?.."!..,..6z............../.%..../.d....;...f_:x.5.OE......Ml.u7...O..y..K.....O...n...d.......o7....O?...?.............{......

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\anvil.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1900
Entropy (8bit):	7.113648442647068
Encrypted:	false
SSDEEP:	24:omgH1zqaeRBRAgQFlgxLO70f6BBJwwxWSHMAVTUmWkWdVIC4IxQ9iux:WUaMLQXga0f6zJUiUmqdVIgQ9iux
MD5:	A0AEE39D1DF17F4554597E2CEA43342D
SHA1:	0333D32BEF9233091E084FEC861D9A34D72E5ABA
SHA-256:	1541221DA9EABC1A4828E0FE2A85FAEA5D4973E81500DEEE78419F36D40974EE
SHA-512:	822487C08E0BE831B2DCABC22D96930A85A28833A1F4C499EA2D613C9E6A75FF10E55B451E0CD086B171233EDB9FECC8CF1082A158CD084C306EB21B330EF334
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....bKGD..............pHYs...........k.....IDATx...1.[.....k..`(&.S..L!...H.....]d..:y0......{)xP..<.P/.......z......H......fj..p}.P.N..N...\| ..........=I..y..4CQ.MY.+=o..n.M..SO..2.i../......._.cA.0.i..,.._...:.9.KZ..ppp..F.Qn...x\|....^...r.x..$;;;g.=..0..JW._z1.....^.\...[..:..9\|..."...r.R..=o.._.h}..+.......L&..X.......:SYK.f'..3...-..I..m....$...I..7o&I...l..N..........&..x;;;V........J`..o.J`.+..+...GI.;w.$I...?%I.....Z.f.i...r.....l....`[.6Y...../....l.._Y.N...^.zt.w/I....$..~.N.._\|....f'....h.....VN......?.....@.t.~._...W...7.]..........,e.OG`z%....._.~w.U.;`...J.~...3..V.p.g.l...h............_[.......$.../O]..~N.'.......W.....A..<..O.$?..w.$....I..\|..c.}.n....o.&...]...X....~+I...H....y..p..+..I+..{..+............{...~w......&..^....W~......8.=?`..4q...{~...h...=?.8.M.{.p..................@........`-V.I..`....~.....m.....%..I...p.......m.......R...A@....._".V."..8.".. ..."@.t.x....7.=.eO..d.}y....@.Z...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\beacon.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2094
Entropy (8bit):	7.301138705956719
Encrypted:	false
SSDEEP:	48:jRomJzcMi1bg2wR0z0EUpSG6ENIcKj7FnChUex:Km1cMiNTw3EI4GLK3FChUex
MD5:	0D7C3D75CDC86A2BA86F35A7131289AA
SHA1:	1B95A9C2C5C0ABE2F2C1B147559F14BD1E1F6D49
SHA-256:	B2879EC7D92C6BB1745C013233F88B152789D30E05094CD4A92D9EB28602CCBE
SHA-512:	45D1FD2AB8312EE36875B4B2648725FB2CFA4FC9D3540C5DBF7E8ED7B2085CEBA88E69A85EBF6400F4A6FC42E645D7325CE5C328BED548BD9B93EBC58658D528
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....bKGD...9....e`....pHYs..........(J.....IDATx...1.[....\|..=.C...mi1t.e.!S.`h@..%tY.Zm.Ci.........u..P(...pOC.S.N...S.S...V......:I'................=.._).2""....0O..z........U.0..T.EQ...L.3".?$..j.f......j9.0.[[[...h4f.....4..G`...?q..U..Z..)(."..8..avj.ZR...I~.....`.666...8>..H..8..a6R..3...K...... ......@........... ...p.K.......... ......@....X.....u.8........W#".x5.....q............\|.....n3n.6.'O.Xy.B.<~!n.6......q...........x..o.....}.0...#.3G...2.......q......X.<.......?.X;...~.[...8...H.....\|.Q\..r.~...W.D\|.Q...c.......`!:.'.;..i;.....k..y'b....++..?G..3........_........+..<../......vv.k......_'.`..H3.N....:...`.._'`.?...H...k.....O2......'.;...O".x.{.>../.E.[..?Q....v.n;.......Kc.........?.W.../..?Yv.....b.~.~6.O..@.........:.=.......... ......`y..F..........=@f..6z..;..=@f.`.......d...l.f.0X.... .Y....2..l......A ...1.,................t...... ......@.....6........l...2...1.d.....2....@....A ...e.....w.#..:.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\brewing_stand.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1650
Entropy (8bit):	7.0803649232020085
Encrypted:	false
SSDEEP:	24:c50kgHey00aWIgo0/In4AxSj2MZKPLSZM6ELlg0RxX+Sw6ZPNYxAMx:o7g+XWIgwpxy2Pz36ELlBRxFTZPNY1
MD5:	6EEB86B3BB37E7BC0B2BB6C802AD1B39
SHA1:	D8FF82EE09E9D6F2F0916BA0B47E9EA8E4505F03
SHA-256:	839D5F6C56AC0E3067D4C433A7691A3DC952FD6A913A56B19E9254F3E3945DAB
SHA-512:	0AC5602AD8AD6BD6390390C00AFB46C86EF3CCC2F0E14D9F37E76E48C148087623C6DDC185FD34E524EED5F63EF1ECF0E9AF30B8CB97CC5066814FC8B6B947A2
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....bKGD.........\....pHYs...........k.....IDATx...Qr.H....Vv.&.l..=..b.V.......<u. .TT...5w.wz(....."...`......~...j..\|...:..&R.....Q.e?.>....m.ea..<....?......?g....t.DQ........]..cQ.e........O...`..2.P.$C._.......,.%.. i.....I...T....}......$....~.MA..5............$.Y.Y.%{/.. ..@.......~.........v.f\..B..a....^.,..\|.b..X...O..0P\|-....).W.....EQ...b....h+....v..;.......:.E..x...k..N@...X.w..\.........)....G_.m..t.v.>@.......H_.a..N......$.......,..........n..o+...O3.k~.<C.l6.....L....:......xB..:f.....o._...,p/.4.).f......-.^o..@\;.......(.S[..u.-..U................R........OJ.~..S[.+..Z.VN.%.pK..>.@.....@3....-....@..<.....y8.......B..,-....K.>w."..p...?. .i.}... .5.d....)3..<...f ..T.e...x.......b._.{V..y.......B..<...x.7.....`.03S..O_<....#...q#....l...W..?....".=...+......F...^8m....C}......m.9n......x....C4..."}TU.L..A.<H.Ku..~..!.^......~..i.].3.\...!..r......w.......s..4.... ..F.i:f.#.,.?A..........E..S...0.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\crafting_table.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2719
Entropy (8bit):	6.844351351154247
Encrypted:	false
SSDEEP:	48:pZPptEqKl5MS7nyKIBihIs8SvskLb+Gd3lY7MnB6yt:pZBtFKl5MS7ny9BoIaN2mlr1
MD5:	CC263A1845CF7ADA3B1000C8BA1DB2DA
SHA1:	B1531EA69A3DDF9518F62A75931F50795F2D9EFC
SHA-256:	8B49D7695958E107AB02405EE97B0640FF0429747131013F6FFF5763A58721FC
SHA-512:	ECA0FABE7E58A46CBCA63985ABA7FB4C15B9ACC64F6BE897C3701C9260D3F6E2305AF9C946EB32B7E1AACD2642D7224897690DD58F10AF3BA0C333DB499B2585
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....gAMA......a.....pHYs..........(J....AIDATx^.....:.E...+aU.m.q2.B...e..o..7......c.?.......>.d...v[.F...A ....U.~...........k/E.....o?.....}.x<^...@@..{.=..k.)]......... dB.a. ..0L.x.F..@....@......S...c......S... U.... ....(.s.....`.^.........A.p.`.0.....6=...;.......S.jz.z...Tz....\....R.9.N.5.6D..x4..f......\|&k]..K..a..f. .............\|.......}.A.hr..d.>-k.0f..:g.....V...6v.jO..j..L....`.`....C....J.%..G.m...J.!@..a..f. .C.C.C. ...........%...... 6L........dLnP..`..(}.r.....{...A.7.... ....K.-.............e..6..\../}%uou............\.K.s..9....\|.b,L._..~..4....r..Q..,...@a2.Y..:..p........0H..7....`MO....1....D..J...Ip.f.@".\|"..(L. ..@2.,........$...0wUc..s'...0..,N.I.0.. .A.\....T.z.n......`.........K...D.c.5. ..........x#.....`i.. ".c. .$..$..0Fx#.........@D4.A...`M..`..Fl%.t,...'..h.Qcs..6.OT{J.ZcYW...p.Vn..%3......._.N....c.&.Xs...2...T.3 .1.\......e..M.^......N..uncn..^.e.. V...S...W.e.....d..A2.yM........w.x/@......6...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\creative_inventory\tab_inventory.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	6.098765960842274
Encrypted:	false
SSDEEP:	24:omlBZ9xjJY/WJGquz1iP82rQQLtBQjGyN:NZ9M/WJGP5iP82rpHyN
MD5:	0A71CE3F2B055A1A8CE1404F2330770E
SHA1:	CE215E156F5BD032AB1AD3B1BC5625E6D2CADC7C
SHA-256:	93B7F26BCED1CA041F70AE6F6F0843AC71259BEB79856E52F3FA354A76ECCD96
SHA-512:	7B5A8A1747335E4178491516097155A9D1B59FE74F2D5FEE29BB3E32A517202E7BBFC56F16843CEB024DB5C2C91DA6EC0456C1925F702172C7404EA775E48A55
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....bKGD..............pHYs...........k....DIDATx....m.P...9.UA.)......D...:.T.}X....l...\|..J.lLr~aG.J\|j..)....;...kw.Ix.Ki.#...Of.......5....o.i...h.&.M.N.....?.\|...j..?..*...]f..{.f.d.....Q......x\|.......r.......... ........ ........ ........\|.j........zr.>....R..ah.X,..\z1............ ................./.h.!..`.......@........@........@........`....`UU..p...h0.(..v..h.....h.&.M..n..3..3...<s..c..X....t?.>..vk.9.....[.@........@........@..........@..d.....s...KAm.2g.s...(.RP........<......@........@........@........H.F sF1....Q...E....@.6..w..@....... ........ ........ ........$c#.9...c\...S.}#.[...... ....m.6g.s.....}\|.....{......s..P.....`.[.@...z..z.........ry:.?...E.H..._.H..._.H..._.H..._.H..-..@....\.........K......~.....~....K.X...._........[..j....y.-.wc+0....x.....{...,"J)...v^.H.....s..)5M....x:_/...@.s..5,.g.h..[.@........@........@........@........@........@........@........@........@..........@........@.......

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\creative_inventory\tab_item_search.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	5.810011200859929
Encrypted:	false
SSDEEP:	24:omFkDysoHTVv46NvBXlKHHzEotg5oyqZ1O4:LgeVw6NpXlKHTEo82O4
MD5:	9051FAC4B74F832922E689A7890E5658
SHA1:	26294266483A6AD3C66073BF46FEBF4BA300A500
SHA-256:	49F9C8988914B32ABA50DB6734D18729A7CFA46DE0069B569431A322DAFAA6DD
SHA-512:	8E28EA2B7E4F75464DB2C04DF431F85054C446B787EF9C2C1C3BD8C5FA13B143B3B78E72D23B4AB266F4C167433345866B5CE441B9D5F5BDF5ABF99C8B1D5557
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....bKGD..............pHYs...........k.....IDATx....q.P...}...A.A#.....u.....bGQF...D..n..G.~#b.K....._.@.w..._..W.).c.....'.eYR.....\..g.i.....)j............b;].E.......................@........@........q.... .....*.o.N.S....!.y6...\.2.#..9......8.1.9.<<..].g....?y...... ........ ........ ...............KV^.c...DD..F..?.n#.9.0..F..X...y.i...Z.....ha.9.sl......@........@........@.......... ........a#.9..c#....7...7....3.@........@........@..........@..dl.2g.s..@..b..@O..X..6..:.F .........@........@........@.@........].a.6....96.=..`}.Z.xcN....<......@........@........@........H.F sv1.m......F ............m.6...\o......-l.5.u...>...... ........ ........ ........$c+.9...]s.....l..<.......gv..RJ..8 ......GG...i...@<...]..d.....K..3.h........... ........ ........ ........ ........ ........ ........ ........ .......... ........ ........ ........ ........ ........ ........ ........ ........ .......... ........ ........ ........ .......

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\creative_inventory\tab_items.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1052
Entropy (8bit):	5.58087591173512
Encrypted:	false
SSDEEP:	12:6v/71ltS07yWY4Q6deho2bgiW9lkyjxeuUHUHUHU31Q9xHyrx:om0OPd60a2TElkyjQuiiiSXl
MD5:	A81E15A829DAB6DEB7CC17935320C055
SHA1:	FC85F88E4B6BD058EDFCFE998DE712893DFCEAEE
SHA-256:	8178189966AF1D2B8DAB84E35ED81E6FBED5D74FCB7FE4C2CB6A658261E435F6
SHA-512:	7155106ABA04891B1036FA5E6C25B06C54B3F6B5C3B70D1E323647B4B795682E505039EF5DB0FDA6CD94663E1C2F9C86C74991BFECA58B26C0149A1ED949EAFF
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....bKGD..............pHYs...........k.....IDATx....m.@.......7..>\.].)k....CD\..x5...).....2)...S...5.)p.\|.............Of...-...\.>..1MSDD.....tW.o_.p.C....... ........ ........ .....}..\|n.!.0.,...9...syk......b..X...s~=.._..t.ws....... ........ ........ .........Cw......86. s.a.JD.ZkD....6....9.6.... .4ED.<.Qk-...9.-l.1.u.M>....... ........ ........ ........$c#.9]..1l.2..96....`;.-l.1.u..@....... ........ ........ ........$c#.9]..1l.2..96....`;.-l.1.u..@....... ........ ........ ........$c#.9]..1l.2..96....`;.-l.1.u..@....... ........ ........ ........$c#.9]..1.n..=...-. ....?v.!.....a..V`..........9.P.......@........@........@........H.V`s......Lj...........3;DD)..u].!......G..).....@<...]}..z.l..K..3.h..[.@........@........@........@........@........@........@........@........@..........@........@........@........@........@........@........@........@........@..........@........@........@........@........@........@........@........@......

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\creative_inventory\tabs.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	6.563901532219716
Encrypted:	false
SSDEEP:	24:7NTupDA1UAVFBpRo2loz4mB6/LSJBEtDw4QDolwXzSMoAlFVMcBYHLBNljDzsO:BupU2mG/guBUw93uMPvVM/H1zDN
MD5:	5A62B678C8CF08D16BB72287BDE5C94A
SHA1:	0354523043E13AB725153A95D155868916F97C8E
SHA-256:	C004104D6CE81F04DA299BC7683020C7C6F127ADFDBB9BF8F032F6BE14E76A62
SHA-512:	9194E325FCA3C4FA19F5DA74D29A848B752D2356149E123799392AEC0D317963A5BB0DE6DB2E7A8275EFAFDD9A2A205037CA9350C3AF7679DD0D9D447A00D021
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....pHYs...........k.... cHRM..z%..............u0...`..:....o._.F....IDATx...mN.;..Q.b......X.l...Aa.{..Ml..#..^......M....R3go..U..S...n.[z..7.b.}Q...Ko)....`.*1..o..1./_...._"..]..@.......c.1.....!.g.nO.._...o......7..4......m..~.g.^.^&..7.J....+.....b...={?.@:.f~.}W..`o...I........o......=.p........W........+.{.....^..N@W....3.]......P............@.t`....8...@..X{.=............7p.B.......=.H.O.)=.W..............7.3.]........../..`........7N.J...3.....k.......'........p`....8...@..X{...._...>{5[{...>B.j..x5[{/..>B..U....^.m.............H.QzuY{.J{..1.-....d....={. .......'..`....=.....'.. ...`............7x....s...=...{....'...p`..z...f.........].....[.Q..... ....X...8..F...~..........@.......p`....8...@..X{. ...=.........kO.....'.........~A.^..=.X ....gO.&...O..<x...n.&r.!...Ko]...k....B.B..X{. ...=.........k.....O{....y...{._...\|_........ ...... ...@..........{......7...r...w...=O..D ..'.. ...@..............{.?.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\dispenser.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2084
Entropy (8bit):	4.899446455734399
Encrypted:	false
SSDEEP:	48:AtQbfd6CsUlKwRccCCCCCCCCCCCCCCCCCCCCCL:AtQbfdLF7W1
MD5:	BC88845633CEFB3D8935CB889839003F
SHA1:	80EBBA46A2E250ECC88EBF74294C8FF49115D6E8
SHA-256:	E9D40A52017A10204C501A9FDFA21833E461578F33D5AC6B7D578B42C85D625D
SHA-512:	8C1E25DB050CDC34A74B7FFEA9A4B82AF2F21672207092D2B82F45E55097ACDBEE9AD956130D5A6BF8F05E246E65E9A53CC185621DAE63A9F8A75D332542C160
Malicious:	false
Preview:	.PNG........IHDR.............k.XT....gAMA......a.....PLTE...777UUU..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$....tRNS...................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\enchanting_table.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2973
Entropy (8bit):	7.145283767240712
Encrypted:	false
SSDEEP:	48:i59rJXJXIynJXJXJOWc78nR3CoV/ySwXRBEFXwXwXRhlllLgAAAIq79I9I9I9mvU:k9rll7nllwWc72h1V/yFBAggflllLgAE
MD5:	95DD0C8CD457ABAED3E44400B880450F
SHA1:	ADC1BD45AF73ADCCBF86900EB5E32DFFCB9CCD94
SHA-256:	8405D22F8E31A1036234854D52E13E3903238687325EEDCC7A50C8DCF5F2B319
SHA-512:	22FB74BD6A24045A2A9186AA4D020F45ACBCD436A5F94183DFF995B2643C2153B875D1ED48EE2BAB9BB58B23DDED7DBCC63AB0C0BC4A73748B158506CCBB5463
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....gAMA......a.....pHYs...........k....?IDATx^..On.U.....E$.....BN...R..,.@N..UN.N....x.S.....~..8....zU..K-.......=.5...........=p.m.s..{_.t!0.P.}.x.../..\|-$....N.>.8??.p.....`a....V.....=.....d]!..^.J....j#.C.....".g=......Z5...u.^....`.g-.@..@.n......6....'..VJ..2.@......Z5l...k&.. ........%..O......v&B..p...{.w.`...WW...... .E..........n.o]m3......._...... !....\|.w....G...&..8.T..Y....D.......(yY.. G$.@...........@.h..E..@.9Y+........fNQ.@...........@.h..E..@.9Y+........fNQ.@...........@.h..E..@.9Y+........fNQ....9...>......'.M..8......[. ....7'...z...8p\|.......{.9Y+........fNQ.@...........@.h..E..@.9Y+........fNQ.@...........@.h..E..@.9Y+........fNQ.@.........`\|.......\|F...........D..F....=.v......F..n....%@...TI..@.!..(......jH.....`..]..f"PH.?YtS.0..H..H..as.0....F.....p. 'k%w!.. ....).....r.Vr.. ..(....... 'k%w!.. ....).....r.Vr.. ..(....... 'k%w........1.......z...@.\O..`.....@n.z.F...\...jH..@...........@...TI..@

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\furnace.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1488
Entropy (8bit):	6.890000070144556
Encrypted:	false
SSDEEP:	24:52D7TDO1btZhppXFfNQDeR6fE45cQIgfWYxuf1t91zWfAmkBCzm24NZS1e:cD7/gFfylftGAQvvzWfAH0zmdNZ7
MD5:	E9BA26453D2EFE3B0B8C9E24E6EB2F8E
SHA1:	DC5A9E7E53453DE1D2AA61052EC8AEA02EC36537
SHA-256:	A4C43643C5B195A7AB8527EB5EB8D1A64E084C1C41512536AEA55F312E4E3F2F
SHA-512:	3F1ECB5037BCCA2C7E7C8DB317DB7D4E9BE89860634572DD7DE3867CEF0ECE7A0CAB96E73796A4E9F4D260A9D4D757A4AFF1FD1ECFD591077D1FB2E9B7A9F954
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....bKGD.1.1.1.u......pHYs...........k....pIDATx...1N#W......@\.TK.........i.C.4iVi....(.!..Q.......T..Qn0).......=3............3..'E@=.....8..).....?4..N..2...M..(...._.....8..i......b4...R..............qty..P(....&.d.\|.x<6+TZ.............0F..v............v.+..)...?.U~.......+...PK'...t..i...qrh.@..$../.7..n.~.......I..4.......,...cg01..w....k.#n?..6.'..}.~.=l...<.....d.........g...uL...i.O.g.....{...[p...&M...O.....,.m.S._* ...Yk?.....fE?......TH.)....y...#..%...8.....cYK..<.v..._.~.%.i/!.m.@S]]].=F..i.@..z.L...^o....ERB...,.....K.hn.....@....%...,....zss..x......`..R.[.@../. .....p......./.P.....w.jm.W;...!S/~....^.J...1....`..c.e.eH1....<...z\|>..@....@..m.E)...:....xO.nw...........N.$.U{)..+......`.E......:..@.....o...K............ .6[.#..\...@..H...u1~.@.K....X.o+..?.......k.S.....@.l...&...._..{jn.O..K.@.....#....c,......@........... ........@Z.}1... ..p..X.............@........... ..&y.b.M}..p84.q.<..g.Q.L

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\generic_54.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2758
Entropy (8bit):	6.642466103931799
Encrypted:	false
SSDEEP:	48:aCpBRM9o+AQAeyaiIjiaiDMGia2lol37xk/o1xdOytPqkZez:aWy9m0yBIeBuxYcMJzZM
MD5:	2644D45500174827ED80DD07C83CDFE5
SHA1:	CA02AB17AA4E7A0AE3A7AF15298D0019F4D3074A
SHA-256:	346B0CBB74E395B7C2105326DEC973F85FB5E49538E718E6A9C0AAAC37186F66
SHA-512:	22B925F5BBA434DECB8D0299014D6CC3D370863FF6E35BE0922C71864C9D5E11F46C2028664086A46ED3055DF14B293FC05D665BAD06E1A88C841AEA38F6AEE0
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....gAMA......a.....pHYs..........(J....hIDATx^...r.I..P..p.k1j.`d,ZcuV..."...._.)...........G..4..>.l.1....Z.x...7c.....8.N.....$...~..C.3.....yy.........?tg...5..L./S.W.J.d......m...........B...x.25\....@...c....+..........g......W-......M.....x.2.\|...l..B..&......25Ns.......@.......NUM....p8o}...l........#.._.......k.c.~).9.f)..........H.................m.#.n.+-W.c...............-...@..@..W...\.d;U5....@Ue........T.4....U.......@.SU.....TU6{X.....NUM....PU..a....d;U5....@Ue.........9.).g=......v.....@.o.y..<[....N..A..l...6..K..k......>......&.7...8.\.c....44u.......W.X.....M.tF.......0....@CS........r5........Ag....0.\.c....44u.......W.X.....M.tF.......0....@CS...F.o.=..g.MG...j..X....o.Y.c#.zf.\|..........EM....,.....d#..@...&.7...8.\.c....44u.......W.X.....M.tF.......0....@CS........r5........Ag....0.\.c....44u.......W.X.....M.tF.......0....@CS...F ..~K`.MG...j..X..l.z[nrYp......w6..-mr.[...n...*..............H6.l......

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\hopper.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1202
Entropy (8bit):	2.772491882223449
Encrypted:	false
SSDEEP:	6:6v/lhPktk/uwI8dthAuiaCtdomBuePkFFXI2j22r9A226iLfLF2Lev2eqNnozlps:6v/7FJdthAuUtS6RP81n+LAaSnupfW9h
MD5:	95DBF2F19361F686905B489907CA7A26
SHA1:	5D9CDEED7814AA8695C32A222A7FF3035FF70CD2
SHA-256:	D1DD33AC5D4A078202D7DBB05A6F92DB0E560EF9276D4A8671AEB8F86D9DA1DC
SHA-512:	4985A74384FBFC189D835A81BEAEF65BEE157A42DA9C7BD52CAE7FB8E9D85F0ABCD444A1010EECD859301F6E089633850396CD262ABC561036BC6C6937A50FE1
Malicious:	false
Preview:	.PNG........IHDR.............k.XT....PLTE......777UUU....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..m....tRNS.@..f....bKGD....H....pHYs...........k....>IDATx...1..0.@Q.$...mW...-Hyo../!........#o..}fO...m..S....@....@....@.....q4.VV.0.......@....@....@..........U+Fb.. .... .... .....

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\horse.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5654
Entropy (8bit):	7.742444526624302
Encrypted:	false
SSDEEP:	96:/z5ewS1wkSChhi+9EQoP6bJ624KpQJTHmEa9PGKmFqDZH5BcUL8h+GI/kTdkiP+B:V9S2knhP9FoKVAJTHFa9PGKs0ZHDFQnO
MD5:	A8E65566CF3779BC75CD293FC1DCF089
SHA1:	4400F9746F6E13DF06A5E41A5288B6B5E8F70EEA
SHA-256:	3A7C8943D048B45363BFF9358A5DF0B2A2B9E9F6B2672764E18C08DF5F9FB412
SHA-512:	B8E3020728F43515A7ABFF331C8A14CC8787618398B250EE927D16769AFFDB23E10530015946DA85829E197F3C0AD65F851F64EDDA6907E74315FAE83FF740DA
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....sRGB.........pHYs..........(J.....tIME.......;.......IDATx....t.....W.&.....H.......N.".z.E..&P.......Yd.s....#..cw..n..y.......y-0Z....W.H).&..4.....&!M...>..p..m.I.._.\|?I>5..!..`b...4....E.5...^b..q..k.#.^....@II.{..../. IZ.v-#.^..........@.. ...................@.. ..\...m\.dI.o ??_EEEq.......y..............i...q..JKKUTT..h.i..)UN.....p:.r:..Q .N.bi\|I..l.../.......m6[H.0...8.....gzB...S...>..2..4.....t..>.......9..g....o~^...,."..#59..... ..?R.3....9.H...o......i...=N..8..h....8...ed..?..#...\|..........Og1..S.............@.. ...................@.. ...................@.. ...................@.. ..........0.$^.....Wiii....\|M.6.G...h.O.......y..{.S.............@.. .............@.....K.,........:..v....}.........**..u.]..\q.....@.. ...................@.. .............P......UPP.....u.?.$..aH.9./.".u.C....^x..I..k..a........+.P..uX..9.............@.. .....................v.@....X..:.....V..N...@}4.....`......+.1.....@.. ...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\horseinv.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7767
Entropy (8bit):	7.360048776958285
Encrypted:	false
SSDEEP:	192:SXBYCp0nsAXXZB1515U+2ntYnnIurJerkhY:aKnFnjJ5U1tFurJMoY
MD5:	A56B18AF6D072871CC659088D0BD2015
SHA1:	2E16EFA5E272C0E527CA79DC1F79A30971371309
SHA-256:	EEFEC498B3752805EEC3DA779B6CB09BCF14590C4CE2AF4BED45257D69FFE808
SHA-512:	48D25DBA0F370B63503EF1EC841631E520D5938F23E0F81937C2CBB556871CEBE4114A959BB508E748283C2C4690AED214CD468BB49F2EAB4BCEDF6B48462510
Malicious:	false
Preview:	.PNG........IHDR..............x.....9iCCPPhotoshop ICC profile..H..wTT....wz..0..z..0... ..Q.f......Ml..@D...E......H..b!(.`.H.Pb0...dF.J\|yy.......g.s..{....$O../... .'..z8.W.G....x....0Y.A..@$/7.z........H..e..O...O.T...._..lN:K.."N.....3"..$..F../JP.rb.[.}..Q..d.[..S..l1..x{..#b.G...\N..o.X3I....[ql2.....$..8.x.......t..r.p../8...p...C...f.q....K.njm.{r2.8...?......).L^6..g.,.qm."[.Z[Z....~Q....7%.."....3......R..`.j...[.~.:.. w....!.$E}k...yh.y...Rm..333..........:..}.=#.v.....e...tq.X)I)B>==......<..8..X....9<QD.h..8Q.yl....sy....0.OZ.k.(...5..H....>.....yP..........:.8......p.........Lg....k.k...$.......t.!0.V..8.7....`.........2A....@.....JP..A#h.'@.8.....:....`....`......a!2D..!UH.2.. .d..A>P ..ECq...B.......Z....:.]..B..=h...~....L...2...........5p.......N..........:\|......@...QC.....!.H,.G6 .H9R.. ]H/r..A..w(......Q.(OT...JCm@..QGQ...-.(j...MF+...6h/.t.:.]..G7....w...7......Xa<1...:L1....s.3....b.Xy.....eb....~.1.9. v...G...p......+.5..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\inventory.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19881
Entropy (8bit):	7.749049962114549
Encrypted:	false
SSDEEP:	384:vOWOLv5qixpwpwq6wpw/jf999999999999999X999999999999999h9999999994:v/O9e0nG+mVTrjr
MD5:	85F35C795482DE888F60CC6B6685412C
SHA1:	41495AEAAA858E16F1ECC69BFDA4EE823F5E8ECF
SHA-256:	3A271C1993EFB1886FEC0FE4A4307BC62AB4A1524CA764FFAF09F7727592B52B
SHA-512:	F9CB3B44ED362C5B626EC5DC3AE0BD81615696AD9531833B86176A154D0302C265F6A1E3FD557126677D5514B21D9522EDFD5822F2E2F8D29811BB93DCA1A9F5
Malicious:	false
Preview:	.PNG........IHDR..............x......gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\stats_icons.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2667
Entropy (8bit):	7.814553090267005
Encrypted:	false
SSDEEP:	48:9OllD6Aqa4g/Diz/c6zHP0k3O/y5YMwn0IDhACgB/kOJrfx8C3KIKYsOo49:UllD63dg/INe/AYFllACocMxh3f5ZF
MD5:	2FC8CA1A9168032361E0BFED31617A2E
SHA1:	F81785EB4F1E3C39AC2B1AA59C6B49E5E29CFA9D
SHA-256:	5E312DDB297B10B336F1255AE044D9C786AD2E9942380C57DC6712B98CF54AE7
SHA-512:	49E073F74386DE0DD262F99371CB30BA39442C7F8F23688AC05238B4E89302F21E784A351A0E6D8121A768460756033D959FBE07339C42C5ECF196BBA3FB461C
Malicious:	false
Preview:	.PNG........IHDR..............>a.....bKGD.e.e.e.U.^....pHYs.........j......IDATx..klT....9...%Jd v....5%.vKb#E.R.n.!..G.?.&R.(.n(....f-.....c...".mS.7...#J.6....V......N.^....=.g..l....d....=.;3.\|.Y}}........f..v...z....@.....12...h...... ...A...J...O.)..`..<...{..Bd.r...t)....!...E..0.H'rww7................fZ..8.`.........h%(...j.s%(D\|..M.6..............L...7.C.U.......8KiV?By..s... ..d..xp..b>...).!...&..........4...H^Y......XVUT.............{S..1~./.B.lp&].^...p...k?t...A..'....r..YD.....).Y..D.!^......g.............TVVb...B..............u.w=.W......`.5}._.z8.~...Xccc...........O..3........o....../U.W.G.. ..........b..f...6..)...N&..W.{.._......O.b........Ue.../h...eUlC.lC....,q3..;9...bh._..3..B..v..\.B..*...l...?~<e........./.....?.K..o.M.DY..h.,..u....W.p.N.\|...".$...@g.8F\|~v..A...s......U...[.7...i..f2.s...,?X).WLc..M.]..3...SS..../.._.\.#>?.. ...p.=....1N........=+F\|~... .r.P...........4....=.2.}.......ow.Bg..Zeee..n..=.b.........hll

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\container\villager.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	7.46823920135897
Encrypted:	false
SSDEEP:	48:L6KAQdvCIiweFJ3ENjH7nhbzgPcx8AWLIfHh0T9rVY1M4sunI4j4x:+RGvCBXzENjH7h/gm8BIvmThVYx96
MD5:	93A9BF0700842E3D5939769BAD11B8CB
SHA1:	0CD90F1AEA7E2AF4878A6DADB69D0495BF61BC5D
SHA-256:	B2DD3AC9C976C9EDBC8CEA21ABA55EE39FDC5F73FDB2C46295DA413024C43C96
SHA-512:	CABD415C593D6E648A0BA4106D4E2711462BA9F0135DE6C37353ABA2B84AA6556AF2C1AE7066A986A23571BA583E020E617C9C8CC5E4F41238DA027D57D24C02
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....bKGD.Q.Q.Q."x.....pHYs..........(J.....IDATx...].T.....3.q&k.%.KB.E.R...M....I`..^.a..DD..\.xUB#H0.. .@(Bv/.ThS(..1XJ......i...N.2g...s<3;s..........<g3;...?.y..}e...2.1777...\.g.s..).r..G.T.e..!0.Z.[....G_...S...C ..E._7n...aB Y...\|.g.z....m.6MOO.g....?.>/..R....`..\|Ug.q.FI...$.q.I..../..wq.J.<.^......xS.i5...?........i..W.^.y..>...$...$.+..'.Z=WN&.?..\..8.d2.</.....tq{.RA_..........%x.`...e..<-....o.U.PP.X.y{S....ZG..u4.M+u....y..e...u#........w..........O.` y..w.yG.422.5k....d.......0....P.f.v..T..m...E.......C...%..(L1.;vL.BA.B!t...&..^.r._.7..r]WKKK...;w.....D.....Nm....G...D"Q.c(Ut..._k..8...'I{...8r]._.l'.....!..A.......J.....h........7o..g..}h..>.......?8...8........3g.HR.E.........7o....ww..;.F..W'@.` ...S.VZ.z..f.`...#.>... X..m7....\....uz.........)..F:..8.....vb..4....szs........b....7w..'^...t....0P...N.<...E.J%e2....k..W..4.....B..".m.r]./.r../.6......Z.@..O...r......J.t....

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\demo_background.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	672
Entropy (8bit):	3.97193559927994
Encrypted:	false
SSDEEP:	6:6v/lhPktkmC19gnFGknPgkqhPzBFYyOmIdIi6m3bp:6v/71iFzPgjh9S/Si6m31
MD5:	9520790CA866118A787598E0C1CDCE1C
SHA1:	025B4E3D6AA2083E63195EA53CB60F4956E77820
SHA-256:	0A07690631DD9ED1343D978189D92815305FEB0DACF8F4515E0822DB4D3F0CC0
SHA-512:	0550E1967C1E93D442B50A3DC83A5CD26B4482A2DABDACB4319B6798BE086C744F4537BD1FE11046E48F9A3D3D6A555026F66BEBFDC4D238E4123717F272E47D
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....bKGD..............pHYs..........(J....@IDATx.....0.E.O#SyI..=.2...]..u....Ty..VPw.........#.9~X.....}..p.....k.%Iz./.............@........@........@........@........@........@........@........@........@..........@........@........@........@........@........@........@........@........@..........@........@........@........@........@........@........@........@........@..........@........@........@........@........@........@........@........@........@..........@........@..........[.$UUs.q.g`..@..n....{....y`Z.,.............................................................................................=...$M..u.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\icons.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23822
Entropy (8bit):	7.877840524610152
Encrypted:	false
SSDEEP:	384:kFAM9xiVrGNu+cxCoKCdTuOBXQ6fy5RyAN4CdsQDcHBRM4f:kFAM9xigg+nQ1uItq5wAN4CiSsf
MD5:	AA904A69EFF1D113BFEC62413695A968
SHA1:	5606B6A2E0897C6801EF4E6665403A9DFD8F3699
SHA-256:	E256C66770A394BF23FBC8E6008683548F5F7EA5F23B011FA084EA4EA60026C9
SHA-512:	0CC9ACD0DC2EBAA6FDCCBD3A8EB9270758217199029476EEF1613BE64C83484136B8F38DFA0CED9AEF40BB5E4B538C619C977F5857703963301BDA407060D19C
Malicious:	false
Preview:	.PNG........IHDR..............x..... cHRM..z%..............u0...`..:....o._.F....pHYs.................tEXtSoftware.paint.net 4.0.9l3~N..\pIDATx^.g.5Wy.y..`......!.,.$P.PD(....H"..M....D...."..$.M.1.l..6......{..f........,....<....zv.:u.s...Z.....9..~.9...n.Tk6el..U..5Xq...<.n~.iE.,G.+.bO....+.X..B.)C..kh..t.w.-Q.X...Kyn.....0_VkU.x.r.A[.jaO..U...~...Z.Blo0]H9.p..Y...?..F...-Q.T n...Y....P..>.Q...:..[..7.x.r.A[......}N..Y.@....V..U......Y.T..lE.....eH...}.FE.......nT..m.w..ZQCW]..]...........!m....w..5t..i....QQ+j.K..gmT...`..r...Z. <..!-....;.8..#[mIZ....l<......:..r.!.c.. ..Y...m..}-.d.a2~y........5x.rjU-..\|....8i....eH....u...b.Um.1.U..c.U."N.i..K...&.:.....R........j%..!m.x....\|..6.Z.....ZU.8.....4..8..C.....DX..B..j.6%...^I.U=.....Z.v.a......}.W.S....uu8...ql..Z......s...I........uoh.8....Q.n[~.....!.c{..&E0Q......w....^.kR....~.. .w..!..;.8..&.{.'...'p....r/.5)../..m/Y~.....!.c{..-M.".).P.5....`..O.6%.g.^]..G?:..G........"..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\options_background.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.437986602182961
Encrypted:	false
SSDEEP:	3:yionv//thPl9vtt+NTlpC9/gm6Kp7GaYwV7a0GaOx9flye/jp:6v/lhPmNpMC+kjg77G1BlXjp
MD5:	5892447224D293B46C0E30291BD91BD7
SHA1:	25271734B482CDBF7B9C96CEEAE0BCE4528CEA54
SHA-256:	AC8C2BAE71347951094BDADF9EA1623A3E8BCCBD937CAA601504EA9D99603095
SHA-512:	C51D395301209D30344A27362B75B9C5E2C64CC6490214B473963596044456B905CE457CC1600EA64892A8A35865DA9B89AB957D63397923996731515303828D
Malicious:	false
Preview:	.PNG........IHDR...............h6....gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0;..i....IDAT8Och ..j ..j ..:....%....X......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\resource_packs.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1083
Entropy (8bit):	6.602429002290844
Encrypted:	false
SSDEEP:	24:R/6aZz9Z3e2WiChegBLTIrRBqJV3Baa16OAbWSRT458Mltat0AnJKpaHjQI:R/6aZT9qTeR4NBa3fC864ZsI
MD5:	7ACBBC04130BDAE84EE0D77B500A942E
SHA1:	C4378799B9ABE108B55A4ED3A9E22FD863106A93
SHA-256:	E5A94130A4821E015B24AB2D5E024BE45678A1729CC03C48D78CAD83DE558923
SHA-512:	282447922DBD5E7D15F0210077B849959823EA89BDFE8EC577D28E16B499299BE4617656C99AF781B925AE7FDF188EAB99A2D5CDD6A5D8EFC6DB4744F7337225
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....bKGD.......C......pHYs.................tIME........H.o....IDATx...MN.@...q.......\..G.d..5...r ."M..`...L......x....'!.........l<.g...8.A..../.`..?..`... ..Z..1........2.........4./.cG.So..&.[Q......._0.D.......h...._...]0.._.e..f....<,.....^.....q........@.p:.#.......G.>.....t.<.C..Yl..b.!.e....$...:...S...k.Y.!.E..I...._.$. .5..:..$.ZC.. ....>..f.y...:..'.mO)VU.n=$...,..e.M.....?...}#n.:......8...O.\.....c...T...>.....<.1..._...g.?.H`...U...........`...z}..........8...m......'<.Wo...L..\..U.q.cl..1.?...c..]\|.+.....W..!.....0/KI...~%.........Q......^s`.}...2<..5..)..7..e.fw.:?.;..r..../.M..-....=x.0.....9E..<...p4....p..S....\.~I.......:?H.@J...37...l.....@......$.[.A..R\.8..w$..5..$....j}.w.s/..w..$.........&..%......o...b.....o....?R.Ou.=.^.L~R.*..I...M~&.....O.a......x......E&...........................................................................................................................................

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\title\background\panorama_0.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	763
Entropy (8bit):	5.213224541633047
Encrypted:	false
SSDEEP:	12:6v/721OkFf7hqEiZiZiZiZiZiZiZiZiZiZiZiZiZiZiZiZiZiZiZiZiZiZiZiZig:hFqEYYYYYYYYYYYYYYYYYYYYYYYYYYYc
MD5:	8793420FE18C3A1420FACFAA0924D383
SHA1:	42A256965EA5278724E97913DF5D78030EC354A7
SHA-256:	E7463901B90327E785C946901342F693675A273D37A030C8EEB2B03CC2FDA5DC
SHA-512:	15ED2A7CEBDB06087DDCF5A56EA82D329F456D43B9DECB862BDB327CB98AF9CD40248D1845F4091129712CF1404058A3AD41E42B043861E42BEBB4E6551032F9
Malicious:	false
Preview:	.PNG........IHDR...............?1....gAMA......a.....pHYs..........(J.....tEXtSoftware.paint.net 4.0;..i...{IDATx^..1..0....O..C.,y..=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R..r..YL...*.r....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\title\background\panorama_1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	777
Entropy (8bit):	5.222029869620968
Encrypted:	false
SSDEEP:	24:QUkQEzeYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYds:Q9QESYYYYYYYYYYYYYYYYYYYYYYYYYY2
MD5:	960C5FD59CDFC6DEA7631ED6DCB30960
SHA1:	E7C965B33137EF1DFDF97E25806C06F73D7881D6
SHA-256:	58568C6A92643423F16CD3DFD4BB648EBDC3913DA3032BF97C9519525CA52D3F
SHA-512:	C87C54C063488AA9B22AB22B9D11F2C0222080795C1F17636BF72A3DB27E2B499126EC734D91A266AC642539075A4DDCD04579E2C91A4DE8698F1624BF2320FA
Malicious:	false
Preview:	.PNG........IHDR...............?1....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0;..i...\|IDATx^..1.. ..1.+...o.t.y.......=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C.=..y..O!......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\title\background\panorama_2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	778
Entropy (8bit):	5.246334946139402
Encrypted:	false
SSDEEP:	24:QuCYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYZ:QuCYYYYYYYYYYYYYYYYYYYYYYYYYYYYH
MD5:	81EB3C9FDDD84AB41489A7523243A61C
SHA1:	EF0EF5FDADB69FD14221B899798A3A81D8E7FB45
SHA-256:	A9D297E412A0AA068D3DD092A559007280AD6F1803B1098972EA24C45DB84E87
SHA-512:	A8468FC3D292CD7B830DCF349B9DB09895D3773F6A896105C9A4C23460082F583D5D89964B820040576831E1AB19267ED5B9D25576828785CE0DE3C9277A0023
Malicious:	false
Preview:	.PNG........IHDR...............?1....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0;..i...}IDATx^..1.. ..1...!.o.t.9.A..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){......,........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\title\background\panorama_3.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	808
Entropy (8bit):	3.556674728511144
Encrypted:	false
SSDEEP:	3:yionv//thPktkl2158Lts7CX9/gm6Kp7GaYwV7a00fI2hlV1za5PhlC5AAAAAAA/:6v/lhPktkU158R/C+kjg7732h98Phldp
MD5:	4E402E8A9400D655B82707C2CBCED265
SHA1:	14862CA97CB147CB029975C327299AC6150F0CA7
SHA-256:	531E83AC2902D4D8CD74C50B051BE3606B2D9E8136D41ADEABF974D61BDB5361
SHA-512:	161BA8C66B5297A54638FCF1D95CBE6C4FFA4B453ED603F54DB862DAE32B2ECA4ACB844C10A82052F8587928F0650D6EC1E798961245B1B35FDA074B0551C08F
Malicious:	false
Preview:	.PNG........IHDR...............?1....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0;..i....IDATx^.....0......^6!G...v.%.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.i..&.a.......o.N....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\title\background\panorama_4.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	778
Entropy (8bit):	5.260697516878283
Encrypted:	false
SSDEEP:	24:Q3YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYnV:Q3YYYYYYYYYYYYYYYYYYYYYYYYYYYYY4
MD5:	369DD8FE6A2097DD43BD4BEA12B34F90
SHA1:	E1DFECBF626FBDA0EC236874C1F6A4D8640425D2
SHA-256:	7AB287E48C9256F5272755B7A5ADEE0E66E1F6EE74C310E078EE3E66FEE7C099
SHA-512:	C14CE894159EE4336E417886CF311FF404F867BA5C5E22A7355A758E5DA62BAF5E192C04561249CAC6CFA5D2158292ED843D5E2E342C7DC9E9F28CCE9E0EEE39
Malicious:	false
Preview:	.PNG........IHDR...............?1....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0;..i...}IDATx^..1.. ..1.._$.o.t.9.B..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){.x...u...-.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\title\background\panorama_5.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	776
Entropy (8bit):	5.257965219030048
Encrypted:	false
SSDEEP:	24:QFqOYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYU:QFNYYYYYYYYYYYYYYYYYYYYYYYYYYYYe
MD5:	70950F91EA16AA2BF362E2CBD88863B4
SHA1:	633E4A95BD7FFC3A23BCF7F0FE4897A7944C850F
SHA-256:	A164DDF891D4A3B166EBA7B98FA911240342AECC35722639AF0A5294CF70BEE4
SHA-512:	3EC478139CA020032F7D966A52102065CE3262DB5C5D97B47A93AC22FBB921DA2C3FFE5A12B3B7FB9BCD346110E72988FFE2D8DA0B046426B88A96D58EB2598E
Malicious:	false
Preview:	.PNG........IHDR...............?1....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0;..i...{IDATx^..1..0....'..C.,y.{w...=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..R.....=..!e.){H.C..:.>....AO......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\title\minecraft.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5987
Entropy (8bit):	7.364696616325555
Encrypted:	false
SSDEEP:	96:/eTKMb/GBER1pzdSDF8qgIyMgDVPLAE0em7L+sJm4AVv:WOU/0qHx2vgIyMKV0dem7L9m4AVv
MD5:	C3CBDC1B181B67E1C68C71C4BDF8B31E
SHA1:	954D6C310B9CF889FF9CABC912BB9571A39BB120
SHA-256:	1926DA21D33AD0941FC5575FFE2EBF31F924166EEA4AC64432CBCBE874E20587
SHA-512:	AF141C03B15AD18EC53581A30C640F89FD492CEAB7DD6201BE9191B5BFFEA9BC0637ACF2593479AA3B43E88122B5B8F477592FAC86B259CD7C6572182E688A5F
Malicious:	false
Preview:	.PNG........IHDR.............k.XT....PLTE............#..EBCSPS.\|\|.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................M.J.....tRNS.@..f....bKGD....H....pHYs..........d_.....tIME....../.~.....IDATx..]...(..A....;..=..{....KA..$$!...3...........kzW6t...b.9.......V.:]..p.k=*.e91......f.&..VH5...........

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\title\mojang.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7656
Entropy (8bit):	7.784377749522484
Encrypted:	false
SSDEEP:	192:HIPFtx6UgEENjbzmkvjdgBgcX+RbxTAO5K9pRNYYYYYYh:HIPFtjgEqbjdgBSbSRNYYYYYYh
MD5:	96505659CC34A3E42F55787C48F1DB8B
SHA1:	DE9B659A0D60733D8787EFCF36C6BB2612CD2F22
SHA-256:	35C9003C3E94C45F2F8EF2ACEB06DE2A0E928D1B8D05A9D0C4A724554DCF37C8
SHA-512:	0873CB0A3CDB7FC4CA49C63DEDDC85682913B44A773E438045D77496CDDD9FD11023EBCAC53443DCD870DF27F7254A6A0A6201DA5D7176494D093D0529EA7E4E
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....gAMA......a.....pHYs..........o.d....IDATx^.............qI..5......5h..%1q..1*"..........o(n......&N.r.s/w..g..z.y.....wN.]..S... .`.L..r.N.$.(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...P..v>M'...c...&@....4..(........ `..t...0.H `.....O.I.... ...4..^W./....T../.F>.W.W.];.sE%R..v.....s

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\gui\widgets.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	39760
Entropy (8bit):	7.858853920024884
Encrypted:	false
SSDEEP:	768:v/O9VxaCD8dQZFeiVWXGWbEsPgbpBjpvHqEQ0E7gv6MJbU:vacCcQZFeiLi8B1vHqE1meo
MD5:	25BF2FF41B694F1A7073A77728C65C57
SHA1:	79C4618C0988450A60573260C4146CAE9961BE03
SHA-256:	1215978EF76ECEE3B620DBDE3DC468DCA0FB38C89D430D9A745D0117439C99EA
SHA-512:	3181BE924BD5ABD275E1ADC29EFC351E7C1CBF7F1DCBF753A6FE85EAF9007DCB19E26B515F7A28F5AF6E159A9EC3A8D96CEFC1031A50742C121FEB8F46E99796
Malicious:	false
Preview:	.PNG........IHDR..............x......gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\item\desktop.ini

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.6427741506984646
Encrypted:	false
SSDEEP:	3:dCoVMEhAdFWKCAYuIAWKCAJs:qBLYyu
MD5:	9DA26F73B0F4694B106943E534462FD0
SHA1:	F79EA1B9EAAE9BF4ED879EE61D82743DE507E7B6
SHA-256:	15F4EC50106F15A171E569F032BD5B125CAD9B8A4C606ED25369372F9BFBBA0A
SHA-512:	75CCD192667061EFC18A60FD2AFB397D596BB0D7861344F892E7A3CBD550640B6EF1844888D651479232C59BD59AD901EC3759C01F403E680B8B16F4C208BCFD
Malicious:	false
Preview:	[LocalizedFileNames]..totem_of_undying.png=@totem_of_undying.png,0..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\item\generated.json

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	3.712159384914819
Encrypted:	false
SSDEEP:	12:b7V/FJkJcOqKnkbPJfJkJ3TmddLPekUGNW70KXugAbL:nV/FJk/qmkbRfJkBQPekty0sAbL
MD5:	859D6AA55B4AA794002A64B761CA2C82
SHA1:	D3A53264D94126727883D881055641EE12DC8629
SHA-256:	4DA974BAAF158CCBDBBD5AB4FF2B19E2846ABA831C28CA91D96CBDE6BD9D1283
SHA-512:	ACF08D6366171033FFEC3D18A74ED99F1ADDFDADA07EE8E67763CB64ED0C8F66181766EF25231EC2CA12420A982C39496007EB3938551DCEA7A909BC8D2102D4
Malicious:	false
Preview:	{. "parent": "builtin/generated",. "display": {. "ground": {. "rotation": [ 0, 0, 0 ],. "translation": [ 0, 2, 0],. "scale":[ 0.5, 0.5, 0.5 ]. },. "head": {. "rotation": [ 0, 180, 0 ],. "translation": [ 0, 13, 7],. "scale":[ 1, 1, 1]. },. "thirdperson_righthand": {. "rotation": [ 0, 0, 0 ],. "translation": [ 0, 3, 1 ],. "scale": [ 0.55, 0.55, 0.55 ]. },. "firstperson_righthand": {. "rotation": [ 0, -90, 25 ],. "translation": [ 1.13, 3.2, 1.13],. "scale": [ 0.34, 0.34, 0.34 ]. },. "fixed": {. "rotation": [ 0, 180, 0 ],. "scale": [ 1, 1, 1 ]. }. }.}.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\item\handheld.json

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	3.9374056759909135
Encrypted:	false
SSDEEP:	12:b7VmJfPLkEB7GJEVkEB7ndLPekUCi7HdoMkUCi7qL:XVcfPLkNEVkyPekJGqMkJGqL
MD5:	370836C9BCBEBC39DEB9F29B339130C2
SHA1:	5EE49ACB425356872C1AF5876C0D78A0A7B32BB6
SHA-256:	82E8E99268ED8EFD6049C44ACD2877A91E1ABE7C1DDFD63C0CBE4222D213A26C
SHA-512:	6A6E67AE4D9A843D2DC9D8B1511A56653CD7704FC6C00809ADCB2C888EA798A184C66DD5291C6902CE602979FF822A841527407642084F690B54618EEB4118DD
Malicious:	false
Preview:	{. "parent": "item/generated",. "display": {. "thirdperson_righthand": {. "rotation": [ 0, -90, 55 ],. "translation": [ 0, 4.0, 0.5 ],. "scale": [ 0.85, 0.85, 0.85 ]. },. "thirdperson_lefthand": {. "rotation": [ 0, 90, -55 ],. "translation": [ 0, 4.0, 0.5 ],. "scale": [ 0.85, 0.85, 0.85 ]. },. "firstperson_righthand": {. "rotation": [ 0, -90, 25 ],. "translation": [ 1.13, 3.2, 1.13 ],. "scale": [ 0.34, 0.34, 0.34 ]. },. "firstperson_lefthand": {. "rotation": [ 0, 90, -25 ],. "translation": [ 1.13, 3.2, 1.13 ],. "scale": [ 0.34, 0.34, 0.34 ]. }. }.}.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\item\shield.json

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	3.8052689750999074
Encrypted:	false
SSDEEP:	24:z5mQ1cfjmkcuAPEjmkXAQPkEcsPk4wcPg0kvmkmFJkhk0snr:z5mvf6k2PE6kQQPk6PkKTkvmkmFJkhkX
MD5:	F3FE5724228E8EE56C052866A67BF9E0
SHA1:	75FD87B48E7C221E326A710BC16EFE3EAEF53DD7
SHA-256:	E356D0D4F4B094705FC59543C57BF6EBC9F6CF56D2EBC275B62507BEF208DB5D
SHA-512:	854EBD747EB73CE76BF4523533ACCE634AB23D5FC7F9C0E6E192AE91EB893D015B19FF584CA162F2204F2EF08592F5F004DE41E9C7053970FC0DB11EA64A3960
Malicious:	false
Preview:	{. "parent": "builtin/entity",. "textures": {. "particle": "block/dark_oak_planks". },. "display": {. "thirdperson_righthand": {. "rotation": [ 0, 90, 0 ],. "translation": [ 10, 6, -4 ],. "scale": [ 1, 1, 1 ]. },. "thirdperson_lefthand": {. "rotation": [ 0, 90, 0 ],. "translation": [ 10, 6, 12 ],. "scale": [ 1, 1, 1 ]. },. "firstperson_righthand": {. "rotation": [ 0, 180, 5 ],. "translation": [ 5, 3, -10 ],. "scale": [ 0.625, 0.625, 0.625 ]. },. "firstperson_lefthand": {. "rotation": [ 0, 180, 5 ],. "translation": [ 15, 3, -10 ],. "scale": [ 0.625, 0.625, 0.625 ]. },. "gui": {. "rotation": [ 15, -25, -5 ],. "translation": [ 2, 3, 0 ],. "scale": [ 0.65, 0.65, 0.65 ]. },. "fixed": {. "rotation": [ 0, 180, 0 ],.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\item\shield_blocking.json

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	3.9160346200645444
Encrypted:	false
SSDEEP:	24:z5mQ1cftkWXIAPEtk5AQ70kXcs70kAcPg0kVL:z5mvftk+/PEtk6Q4kz4kxTkVL
MD5:	10C3D6347E1C2D782827FC59F6410039
SHA1:	6834995F8CEE0A74D2873ACBAD3810248EEE7652
SHA-256:	84C6C13A6C95566DBEBF84C3D137E3A9184134276E50C6E3A4125282AA6657E1
SHA-512:	1E9A00F98428B82F67928F249A85FC16A657A902632F387138A709F909D7C2E8625AE7393E8F14E79BD3FF71D561BC5F4B51C472C934EAF03638BF24EC5E11D4
Malicious:	false
Preview:	{. "parent": "builtin/entity",. "textures": {. "particle": "block/dark_oak_planks". },. "display": {. "thirdperson_righthand": {. "rotation": [ 45, 135, 0 ],. "translation": [ 3.51, 11, -2 ],. "scale": [ 1, 1, 1 ]. },. "thirdperson_lefthand": {. "rotation": [ 45, 135, 0 ],. "translation": [ 13.51, 3, 5 ],. "scale": [ 1, 1, 1 ]. },. "firstperson_righthand": {. "rotation": [ 0, 180, -5 ],. "translation": [ 0, 4, -11 ],. "scale": [ 0.625, 0.625, 0.625 ]. },. "firstperson_lefthand": {. "rotation": [ 0, 180, -5 ],. "translation": [ 10, 4, -11 ],. "scale": [ 0.625, 0.625, 0.625 ]. },. "gui": {. "rotation": [ 15, -25, -5 ],. "translation": [ 2, 3, 0 ],. "scale": [ 0.65, 0.65, 0.65 ]. }. }.}.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\item\totem.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.6515937647699515
Encrypted:	false
SSDEEP:	24:qkDPXGXiqcvmtjDZVPncuL1LBx2f10eZIVkOkDJsbbA:qk6Xi3vCPvc41LBxYGe61kDJwbA
MD5:	CF5F118F5AD9FD1573F6FDC3B5DA523C
SHA1:	E5646951B1633EDF0A83030CE04547245A85524B
SHA-256:	3C3DAEC42EDA4CBD9C0120FE38BE37EDAA16CA391DB34F08C068E272CACDA13C
SHA-512:	23A040751A3989BF88B98D181DA63ECF07D490B92876054EB0701D8756D4644E7386EC9FE32D11CC8F8AED5A7A0F7B8905C2234B199F26F05B07EFCA2FCDA71A
Malicious:	false
Preview:	.PNG........IHDR...@...@............cPLTE......... '''(((+++555.V$....\&....]&....d)....).j,....k+.l+.m+....m+....,.......t/..A..A..G../..v....tRNS.@..f...IDATX..W.v.0...Oc.....b..?.>I.!`.[..)'.q..Zb...O\|w+.&b..X)..@..A....N..@.....A.D.G$H.k;...[\|W..M.{.r.3.E...V......^..F....<..qT.<....s....2....#.. ..=V).0...e............t:>}...A..b.....H9'...l..-.{.?.`,..x<.>?....h~O.7^J..X [....g{..i....(...o..?4.b.&.....)....A.-.....>3..[I ....u.J.....6............d..>p.....\1...g}...@....A.%P.......y.H.(.5....@.......d...J8.-.h\|....T...`.Y..=...l`.D...?T..........p.+U j...LV.;(..$..V...t..@s.lJU.R..a0.@Ve..F............B.,.....X..hp..........Y"i.Z(...n.I=..@.......[.I..{...<.....4...H+......9..u....@f...].......?%..F.F..{W.D.....@.e......z<...E..U *.p...O.x...'.A..x.U(x.\X....+.\|......(.B._..".p.r..t.W.0..M./.=J..J#.F..I%...]..LdJV4..5.....}.&.}...o........B....A..}.F...y......:..........>..>yy..>!.W.a....&..'..p....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\item\totem_of_undying.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.6515937647699515
Encrypted:	false
SSDEEP:	24:qkDPXGXiqcvmtjDZVPncuL1LBx2f10eZIVkOkDJsbbA:qk6Xi3vCPvc41LBxYGe61kDJwbA
MD5:	CF5F118F5AD9FD1573F6FDC3B5DA523C
SHA1:	E5646951B1633EDF0A83030CE04547245A85524B
SHA-256:	3C3DAEC42EDA4CBD9C0120FE38BE37EDAA16CA391DB34F08C068E272CACDA13C
SHA-512:	23A040751A3989BF88B98D181DA63ECF07D490B92876054EB0701D8756D4644E7386EC9FE32D11CC8F8AED5A7A0F7B8905C2234B199F26F05B07EFCA2FCDA71A
Malicious:	false
Preview:	.PNG........IHDR...@...@............cPLTE......... '''(((+++555.V$....\&....]&....d)....).j,....k+.l+.m+....m+....,.......t/..A..A..G../..v....tRNS.@..f...IDATX..W.v.0...Oc.....b..?.>I.!`.[..)'.q..Zb...O\|w+.&b..X)..@..A....N..@.....A.D.G$H.k;...[\|W..M.{.r.3.E...V......^..F....<..qT.<....s....2....#.. ..=V).0...e............t:>}...A..b.....H9'...l..-.{.?.`,..x<.>?....h~O.7^J..X [....g{..i....(...o..?4.b.&.....)....A.-.....>3..[I ....u.J.....6............d..>p.....\1...g}...@....A.%P.......y.H.(.5....@.......d...J8.-.h\|....T...`.Y..=...l`.D...?T..........p.+U j...LV.;(..$..V...t..@s.lJU.R..a0.@Ve..F............B.,.....X..hp..........Y"i.Z(...n.I=..@.......[.I..{...<.....4...H+......9..u....@f...].......?%..F.F..{W.D.....@.e......z<...E..U *.p...O.x...'.A..x.U(x.\X....+.\|......(.B._..".p.r..t.W.0..M./.=J..J#.F..I%...]..LdJV4..5.....}.&.}...o........B....A..}.F...y......:..........>..>yy..>!.W.a....&..'..p....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\item\trident_in_hand.json

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1375
Entropy (8bit):	3.7531637575901335
Encrypted:	false
SSDEEP:	24:zHt1cfNrk1IAPENrkWkAQPekr6MkxLg0kvmkmFJkhk07Fr:zwfNrk1/PENrk8QWkr6MklTkvmkmFJkp
MD5:	0BD121C87461785D4316F0048DE8C559
SHA1:	B7F17A2417BC8FEC7C27148C6B3AC8DF9BDBC4BA
SHA-256:	528F6EC9059ADC02A4D673C8511945EC094982B7709D3EB3E998FDDE88CB6077
SHA-512:	D16C68631158256887DBF2471C2FBF162E0E61FC0A65542074EDF731D3FDDD48E8A389B28DFA77B2F033B7CC9BFC3F7B453F802350EF2537CCC492FAD74F3B1D
Malicious:	false
Preview:	{. "parent": "builtin/entity",. "textures": {. "particle": "item/trident". },. "display": {. "thirdperson_righthand": {. "rotation": [ 0, 60, 0 ],. "translation": [ 11, 17, -2 ],. "scale": [ 1, 1, 1 ]. },. "thirdperson_lefthand": {. "rotation": [ 0, 60, 0 ],. "translation": [ 3, 17, 12 ],. "scale": [ 1, 1, 1 ]. },. "firstperson_righthand": {. "rotation": [ 0, -90, 25 ],. "translation": [ -3, 10, 1],. "scale": [ 0.5, 0.5, 0.5 ]. },. "firstperson_lefthand": {. "rotation": [ 0, 90, -25 ],. "translation": [ 13, 10, 1],. "scale": [ 0.5, 0.5, 0.5 ]. },. "gui": {. "rotation": [ 15, -25, -5 ],. "translation": [ 2, 3, 0 ],. "scale": [ 0.65, 0.65, 0.65 ]. },. "fixed": {. "rotation": [ 0, 180, 0 ],. "translation": [ -2

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\apple.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	429
Entropy (8bit):	7.033082130529662
Encrypted:	false
SSDEEP:	12:6v/78/eFC8fu3hZ+XTzveyZ9JolcUHhyqWi11:cFNfmf+jzj9JecU8qWiD
MD5:	2CD4E5BB30C53473165997732047A1EE
SHA1:	1370129FEDD238EA93636722C3FEF7C8F15777BA
SHA-256:	42BBF01A4EE54BB88684808ADFC9372282A7E98E51357BA0008CF023504C8286
SHA-512:	4B3B67CA8EBCF065917E4C80EC1F97AF708A3A1F95B379877AD9C256F38B23809A91696BA527597B25EA1B0745F8D92AC183E45544B7A0501393B4CC3E72EF33
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...BIDAT8Oc...X..?...0Ai....L.!.P...4..r1.\|...w..T....y..z.#.>.(...\....x........k2h0.2.........<...0CP...'.U..a..4..o...4o...a..`...N.iN.ga...bx....O..T....b...N.......=.......j.......a...D......A.pd. ...C......~..0... ...\|....7....\........f.H..._@..M...$;..n+H......z.........c..}?..5....3T.@1..@..2....Lj....i.ie......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\apple_golden.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1855
Entropy (8bit):	6.537866195533038
Encrypted:	false
SSDEEP:	48:cdzzBw/O4knA9WItL5C/cjksTqsTMAsTn3ksT6dHx2skM9f:cdeJknmWIp5C/Byqyxy0y6dHYskM9f
MD5:	80257116A1927CE07D2D63538D7B37E8
SHA1:	07B840CFFE7C45984931D76DA83351A4B8DBE994
SHA-256:	3F51BF1C1338E2263D2809274AA08FDEC192A360B17BD83127E6032EF3017E5B
SHA-512:	F9D77149B73B6E5F5C1BD708387D7317411885EFA8DE5E82EC9C2D57F334DD32C70340334B0E8BE5130143D6D67E19D3C5C18EBF819E16DAC0B1D0CBF7710B89
Malicious:	false
Preview:	.PNG........IHDR................a...&iCCPAdobe RGB (1998)..(.c``2ptqre.``..+).rwR...R`?..............> v^~^...v...D_....@..J.(.....(%.8......../)..3...E..... vQH.3.}...K.....I........ ..H}:....6....KR+@.28..T.e.g.(.ZZZ8..'..W.....+x.%.....%.....B..........j..d.2.....9....bg.b..\ZT.e22...#.#.......B...a.....T...!...>..9...O..F!\|....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Windows)" xmp:CreateDate="2022-04-20T00:56:40+03:00" xmp:ModifyD

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\armor_stand.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	197
Entropy (8bit):	6.3847668182578134
Encrypted:	false
SSDEEP:	6:6v/lhPyyYkkqjLEgvk0IIivXCNJnTU68XPolljp:6v/7NfL3vk0AwnT6wl7
MD5:	CDC420AC9454F18D6F44198B3CDC80D9
SHA1:	1C37F2A98EB59C955F21E6ED8B3ED18EA6A5264A
SHA-256:	AA4A7E32811F88EA1ABBA2ED5C978A06719CC58304C2E50F102AD336DD84CEC2
SHA-512:	2A1F35C9079E7482AF36A84504E6F7D47B5C2996147C3EC881014D72DBEEA8ADF1471E268D4F4A63794A644CDEDF6B4EA1573FAF18A1D3F18CB0182617F55408
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`...=5.3..@..5...5..O..[&D.n.H#.....G...l.....A....."..iB.I..r.......( A6......a.@$........V.....$....`..s..)q..`<w.\0.a..8MRJ.....g...........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\arrow.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	148
Entropy (8bit):	6.033862575633127
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lPVJWk/Jm3CGWt6tvVReeT2FzAlk3KGrHB1p:6v/lhP//JOVYlAlk33Hjp
MD5:	1E364AFD20F56139367A518F77EB4439
SHA1:	F01CC26798545C151FFD50955FF81987B28B312A
SHA-256:	9DFC345C4AE71A7BAB003D3D15F420376910162A000A99832E9CA63A51BC85DD
SHA-512:	8F8C8A6F94E377AF9A0BE45EAFB8A41CAEBA8CB6750D9BCF08B68255EC3B39F3049D0CC5A789D5BD9C2A726A6FCF2728420051071A793C3A0A4BA3EE54AD350F
Malicious:	false
Preview:	.PNG........IHDR................a...[IDATx.c`.r`.i.A....?..o... 6...4t.... Y3..4k.q.g;L3.%dk&..CH.....;v.2. ...t.@...l..3...CX0..{.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\barrier.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	157
Entropy (8bit):	6.063204093558325
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3layxdxD9tmFHWr6z7jCbiCdiXw/hVaK5nKkpHH//sup:6v/lhPPlD9tmBLzyGs/zargHf/sup
MD5:	FE169992FFA8F22D0A84C88CE1867290
SHA1:	CBF57578671EBAC0913606BBB1059048846FB09D
SHA-256:	E6F1C3F50634B55C0C91AD5D685C0AAF47A1B0811C7F8FEB13EC656CAEBC1929
SHA-512:	064FB5C7E5A69B090DE80F2D3B9E974EEDBEDDCDF491934388F18F2F8C8C4AC6FB05211D4124611DADC0DFFB38A6D06FBF8A7E472DC183FF13919E67FF3996DB
Malicious:	false
Preview:	.PNG........IHDR................a...dIDAT8.c`.&.....1..^.R.U3!..x#.....h...B.f.eX. F3.O...\G....F..............V.H.N..(NH .....l.1..9........x....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bed.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1624
Entropy (8bit):	7.846119372928076
Encrypted:	false
SSDEEP:	24:G/uemqynw+3Ax0ruvRBqyzfiadFn9jlvTnjkRpVwf9vHoCFXHn1zxjqPQ7:b2kb3AxHAedFn9jRTjk4lHJ3n19qPa
MD5:	3ED28944F665893B373ACE60D2F6230A
SHA1:	D624B2B405477C4A7F8E3B6A9D9AC9E1904114F9
SHA-256:	DABEF4171B747CB04553CA65AF4984781AED68F42875F32AF3558340B81DBE76
SHA-512:	F953EF1900726019B94DBF6F823F796E9CB45730E6EC40B688C7CA4CE47BA81C2B7EF13912A8D98CCB246A868B0D7655B39150DEDF1FDCC2C6F9BF3B03DED1DE
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB.........gAMA......a.....pHYs..."..."........IDATXG.V.o.U..ffgwv..m..z.RZ1._.._.1^c4>`@.J\|'.?.......bb.`.../H$.BH(... ....e..;{....;..W(..^.&.33..}..}.7..!.0.V.........<$..qy..f...4.o..."...k&p.....~........&g&.{...C..W..u./....D.....m.hm.......\|N...X.A.e.L......).....E. .ix.....=p..."..!....x..?.D4..#.D0.C.. .....a<>....6b...ZZ:..>.\|..\|_]........:].......N.'.T=...V..G%.E........ ..F.....@$....(u.....+.....D.....^Y....=U.....M.D....l.+..L&....Y8\|...{z>......a.C.I.L.Dj..la#........0......N......$b.(........_..[.......;.{9.Q.^r._..'....7d.U.H8..ER..../x...0..R.....M.w....cph..Z...6.."...............i...h1(.\C0F..d-.3.\..V$Pr.hV[.......c"#.2.z.....phW.B-h.tb.V?WJ..../..Fm.X....L...%...C.S.(."m..%.y._.kR. ........(s..\.(.Z.r.4.O..5Ls.iY....5..J#.K.4..u..X.'............E......!.r..m.<...b..[...U@T_.o@$.%..0)..qp....`.G...Xp.4..`..Z.<.)..K...$...."h.....S@.....P.p...Me.y.%//k....6...G......Q....F...

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\beef_cooked.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2025
Entropy (8bit):	6.4426982339958
Encrypted:	false
SSDEEP:	48:cddzBwF/6uO4knA9WItL58/cjXK37dHx2y3rHxBT:cdgFS4knmWIp58/bdHY+H3T
MD5:	4F7FB36FD2492C2E60ED5B370F822FEA
SHA1:	6FD10BB9F0EA1583CDC0ADBCCF1402223A6D0A7E
SHA-256:	2C7B52D0508E95064B8037FE7662DB36291C01EF2C186F207D208C2A4335DE60
SHA-512:	E5C49B305A72B7C4E6252F40408781AA1BFBEEF2F1569A15968BE3A2EBE68C30B0408E8340EF723C2F1574EB7408F5D46F60DDE82D8BCF9BCEEDD816BAF948EC
Malicious:	false
Preview:	.PNG........IHDR................a...&iCCPAdobe RGB (1998)..(.c``2ptqre.``..+).rwR...R`?..............> v^~^...v...D_....@..J.(.....(%.8......../)..3...E..... vQH.3.}...K.....I........ ..H}:....6....KR+@.28..T.e.g.(.ZZZ8..'..W.....+x.%.....%.....B..........j..d.2.....9....bg.b..\ZT.e22...#.#.......B...a.....T...!...>..9...O..:6\....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Windows)" xmp:CreateDate="2022-04-20T00:56:40+03:00" xmp:ModifyD

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\beef_raw.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	212
Entropy (8bit):	6.437062700407934
Encrypted:	false
SSDEEP:	6:6v/lhP1OyPr6Yk6kMzqiXO0YCdOwbxRtVp:6v/78yz6J640zUw7t7
MD5:	D8C74B23011C4920D9D5D0698D14CFD3
SHA1:	DE2A12797AE2F88095D18F2A487292D71E31F060
SHA-256:	D3CFA567CF2253EC805C9FB1FB96B7B2DE9FC9029CE1672E381A631C76F5E355
SHA-512:	D0B1A653F23DCBE59320C1F32538C6A0D8441AEA00C9F6B70DCBFAFF1F475DBE5C0ECCEC3EB4ADD45970AA000C4BA921B50D007F513FD3AECA44C903B4FD7397
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`..`....dL..W....%E..`g..QQ&..5.{.5.."h.H.H1H3.....P-.......a.a...A...s....Y#..0.0.q..b#..h..i.0.f;..d. .`.....qd.Di.......AP..@....d.....A.4.'.@s.."9.t....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\blaze_powder.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	278
Entropy (8bit):	6.738814769308896
Encrypted:	false
SSDEEP:	6:6v/lhPxhIeoA5H8h8vOEDfZpZcsJriIQOLNqj6zomBYcgsup:6v/7vJZhDB9lsOWeomacgsc
MD5:	5AFB5243B43E181F7C023B4E06FEA1BA
SHA1:	969DC7FBD58CD65AD54D4D71E20D1DCC68BE2482
SHA-256:	BE1D8C93BBFF955C94C194BB944B200D884D30FCC7E221FFF739881D6ED5ECA2
SHA-512:	23906051FAF56DA5C227116B222E4AF8E6AB20441C1FC4FC8BD10C78D46C1BF164162DA5E32AAD173311FDE550CD249EB56DE0383F7C2569A43BEF132EDC2113
Malicious:	false
Preview:	.PNG........IHDR................a....IDATx.c`...j.."...o.O.!0.@....D..l.?...`./f..l."+.....a6.r.......2.`...:.........N.9...t..{.!....!..?@X...K@..c1..0.H....!.}.....po.l....l..0.+.aq....D.....p..."..\|6.H.................Bl.i.i..3:....0tLR....... ...Pu\....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\blaze_rod.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	168
Entropy (8bit):	6.263168953350625
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lRkxEO+TRRWGAqXIKWUZXI40dV0UtZeHtVDhlo4sg1p:6v/lhPhg+3PWHXrYtVDhy4jp
MD5:	0C34928B3CC64F9810D75F4305E8D080
SHA1:	557F8140B98D1F5082BE8138AB2BF3D21A6856CD
SHA-256:	D402755C56B25D84CE73BA1F064252844B2EE9B2F6E3D17566450687A26D9C81
SHA-512:	73168CD38C0A22E9F624084F9416CD5380C61FD3BFFB7F4B0758E7952BC47B0FBE85D805CD2167F6C0FA03CA7B4E86F498409B5F991FC2D93B1E805678966B41
Malicious:	false
Preview:	.PNG........IHDR................a...oIDATx.c`.7.-..v....4..........e.O5f.O.....5..!Q3.f.......".f..I..g.4C.L..I.0........1Z....NV"..P.&.....n.y..@......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\boat.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	290
Entropy (8bit):	6.881493902072608
Encrypted:	false
SSDEEP:	6:6v/lhPdhrpOc1hyxuInQ7qcKMme6DljXi/sjLeGoIo47ERCMgDKa/ljp:6v/7LrpOESuXucKxjS/s2Go0ILvw
MD5:	1B894F323956DE58F4EE46CD569B4872
SHA1:	12D5F1752E6C52E45C29A3A1828A808E9BC2D6C4
SHA-256:	71263D22D22932CA29EF5FC832DCEB22F4F41C164E9CC53A392FEF4B7D08148E
SHA-512:	796CD066B254E2F3D907D060E2DF36654535131D5ED12CF39D9995F289A26E4E2563422EB3068E1A0B02D5B51B33F67FD3C81E8C5287D20ABF133A604C46452B
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8..+..A......I,k...h...`..j....M.F.b5.......Zy..2;g...\|..\|...A..g..S..?...e.i...\|\.......~..D......)..D^.W...!....\|od....;.(.....m... ..F.R...o....P.'W.y.p..... A../B.d..P...N..XOJ.a$..!.\y3....^8#6..Adt..}N..(@..E...W....Lv1.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bone.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	168
Entropy (8bit):	6.115124416646102
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lRkx/CCIWuQ8nMUwCErI9rH3gyTo++SSsz3HCJLFY8p:6v/lhPhSv3lrI9rHFqAz3HCJLG8p
MD5:	2B82E8C75845036A9DF3879C190C7001
SHA1:	8E4C46B691E396A31F16C64D426EDE0252280373
SHA-256:	5A975E7BB108733CFD3D8BA0173BF5A58F51F5898CD429A7DAB519524259FBCA
SHA-512:	71A360E51FA3BAAF21732647B7DB5A820ED5341C885D07990B318A3F2BC23A347263C411895E695D36703EA0BDCDFA60C957497755BED928DFF90175FDF4819D
Malicious:	false
Preview:	.PNG........IHDR................a...oIDAT8.c`.'8}l...O/...dk......l0&........i.a$..3....'..d.0..,..W3H#Y.A!..h.E.I.aq..$;... .$'..! M$'.t@V:....d..\........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\book_enchanted.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	275
Entropy (8bit):	6.716703264950804
Encrypted:	false
SSDEEP:	6:6v/lhPNx8xc68e3NxsYxVt2FCKm4O71n08WELuShzyyp:6v/7Gp9VR2FCxn/WEHx
MD5:	18878F165C823643442ACFC91F606F1F
SHA1:	DC78BB10171A320F5D79B2B220AE47ECB9DA65F0
SHA-256:	43912A1891CC6FB1FAE50E5F3C06827E4322E4FBB25A0D5D7C10AB8622C4A655
SHA-512:	707C7883C5D6DDDE0A6D87A80E475D54A83AB92EB2D999240035C00A97C9045E95E2814112AD4CC617E38C5FA1D83F4BEFF97371E438859C31961D69D9159090
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`.50Td...di......-..D..#.....5"c...l\....G.-..\.....!.N....?W..l.Q.....!.j\T. ...........5.ptt.../l...! ....1H..3.jA4..1.V..k....l#H.iR`y.f.. 9.....R.rE....F.......!0..0H3.c........(".[#6C`^..A..jD7..S...B...A.c....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\book_normal.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	212
Entropy (8bit):	6.518210193416759
Encrypted:	false
SSDEEP:	6:6v/lhP12Uq88ahmvkOy1/bVw61ZagzISsOR/hTjTp:6v/7Eqhmcr1TVwQZagzB1lp
MD5:	2C8F7C5C4A4F790963FD9C47770C61EB
SHA1:	E31C6BC6253F7CFF10CAE3F86B51937D92FA5B3A
SHA-256:	2941D48D49917A7CA0EBCF43FD7763310DAFEA5989B319FB9DB584147BEDCEC3
SHA-512:	93464E47CA71D4B6CBB9461F0B3A03F46148C81FDCA146F6773E85C9DCCDC68297D6572DD768D962A5B75609E6B450235D42BC33B8146F8538DBA2AF4DB6DDC2
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`.50Td...di......-.?.N.8C.5.c........d. gb......`..Vt1..l.)N...ptt.../l..g.!k.9s&X-... &...x..5.!..A......$...B.Az@........`3.......B.FtC..H....u.z.P......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\book_writable.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	278
Entropy (8bit):	6.975194290815515
Encrypted:	false
SSDEEP:	6:6v/lhPxhdofF5e87H2H/g1V2lZv5V48+ibp:6v/7vSfVRAbM8+k
MD5:	1B5D2A508A681928B0A043A5B4AA4579
SHA1:	48BA5B44F5D8A60FAA527C77E058D82373B2C08C
SHA-256:	158C4B322044DAEFC59A8D48699E86B7B38D850329BB4197ADDC5A2A21109A6C
SHA-512:	463D807BFD51694DA66E2F0F7873D724E7BF3E87EB2C7350F30BF978B8C5BE63B1FC52009BFABC5797DB05063E5FF01235F8A0DB90EDB4217CB8EF18C8C35B15
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8..;..@.EI...2.XX[..W@.....EP...@.V.9..a...8..7...,...........G.3...@.....ng{./.<.l..,. ..V%tcl$..EaoV.\|..&..uV.Y.....(..#.p.%...b...A.(.a..4M3.h\|M!....g/8.{.v]7...H Pp.0'.8F.R0T...D.%Q./0^S.@....dS.%I..,.>.Y/..tB....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\book_written.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	219
Entropy (8bit):	6.483092425675197
Encrypted:	false
SSDEEP:	6:6v/lhPwklmyc0cEUmIYtJSRnHys/PRJ0pmBlqRcJdp:6v/73wn59YtJSRnS+PRJ0UDz
MD5:	C32573B4A42D5D73084CF3E8B99C7B78
SHA1:	9BF4B798978CC6D45C57D10880FD8E91028BD772
SHA-256:	13EE07C5B96CF56A5E76F26DA14A0E6D6A0D43806658C0410673F14DBA154139
SHA-512:	C0B1AB25093421335E6EFCF1313B0CC6CE516EE2FF10456FA0FE848A974C699BD701DF5180F50AC295AF10E2BF1905FCC9D089FEF5CB4AC87874B8B37EF6D3A0
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`.5..`...di.U....#...H.....4.0AC.5.4.0L..!.4.4.e.....dB...`C@.................o.......4.9...D....`.+.v...!.4.4....\|.A.....n...14".l.....!$kD7.,....U...>.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bow_pulling_0.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1910
Entropy (8bit):	6.638467755966434
Encrypted:	false
SSDEEP:	48:cdzzBw/O4knA9WItL5s/cjGr3idHx2sqOS7D:cdeJknmWIp5s/YdHYsq7D
MD5:	B7A46EF99A08A154BE5FBEBE79974F03
SHA1:	79636BE9F4BA45E66E38539063D684523DDC537C
SHA-256:	B34041E7B6ECA7D358C84146E02D8138517D00C1EF54A671481F4CC167531CBC
SHA-512:	2B5B01B19E9731DC420931F235D7BF592B78835135CACC833EEA0E892FC230F0684708E0ADD29EF21FF831B1F6B6B055E691BC33A430A0B4B71229EB30780C1E
Malicious:	false
Preview:	.PNG........IHDR................a...&iCCPAdobe RGB (1998)..(.c``2ptqre.``..+).rwR...R`?..............> v^~^...v...D_....@..J.(.....(%.8......../)..3...E..... vQH.3.}...K.....I........ ..H}:....6....KR+@.28..T.e.g.(.ZZZ8..'..W.....+x.%.....%.....B..........j..d.2.....9....bg.b..\ZT.e22...#.#.......B...a.....T...!...>..9...O..F!\|....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Windows)" xmp:CreateDate="2022-04-20T00:56:40+03:00" xmp:ModifyD

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bow_pulling_1.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	6.610039372571681
Encrypted:	false
SSDEEP:	48:cdzzBw/O4knA9WItL5Zub/cjd74xZl3dudHx2sgARt:cdeJknmWIp5s/g7sZvudHYsgA/
MD5:	CE995E3226891C06FE0A816523EC5F00
SHA1:	4BC8635285B7C5411464C31E4200D3FC4C50EF6F
SHA-256:	EB8727312D03C8A6D1E2345627C81D58637B89049B81EA0EB8577AF7A7E69246
SHA-512:	6C65294902B4533021DE2BA841CF7C07BC3CFD6C835B1699A6A07C1B9E074B2601A5E15882BC2D294A3E950921B62181F259E2F53A1DBD7953E99997C7C7A2C5
Malicious:	false
Preview:	.PNG........IHDR................a...&iCCPAdobe RGB (1998)..(.c``2ptqre.``..+).rwR...R`?..............> v^~^...v...D_....@..J.(.....(%.8......../)..3...E..... vQH.3.}...K.....I........ ..H}:....6....KR+@.28..T.e.g.(.ZZZ8..'..W.....+x.%.....%.....B..........j..d.2.....9....bg.b..\ZT.e22...#.#.......B...a.....T...!...>..9...O..F!\|....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Windows)" xmp:CreateDate="2022-04-20T00:56:40+03:00" xmp:ModifyD

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bow_pulling_2.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	6.614767199349735
Encrypted:	false
SSDEEP:	48:thTD5mO4knA9WItL5k/cjTJ4j3ydHx2snAiRgy:tVD5AknmWIp5k/kJbdHYsAiRb
MD5:	E01F9574D2B59EF3534180C7E1DA277F
SHA1:	AD4B7847278152E14CFC36E9840F9B7B3BE71721
SHA-256:	DEA2F2CC13104D38107FA0A31D895B78044942B50F3FDA02D48F008AFFBCD515
SHA-512:	BF71AAB799116CFC56CB682A82B221E7215E81CF31D2F07460C9D70A1064FA3EF9C2A45A5F9B3237624E5D6852A55C7328594DF05960FB62143F4E8D97379BE7
Malicious:	false
Preview:	.PNG........IHDR................a...)iCCPAdobe RGB (1998)..(.c``2ptqre.``..+).rwR...R`?..............> v^~^...v...D_....)..p%.....?@l..Z....h.dg........."I.`....($...>.d.C.W@.$....].......>..f....a..%.. {.....2.3J..---..S.R..+.KRs..<.....KRS.j!...A.BP.i.5Zh..o.......@p.2..A.!@riQ....dL..0c.....R...?.1.^...:...S.bj.............O..."J....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Windows)" xmp:CreateDate="2022-04-20T00:56:40+03:00" xmp:Modi

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bow_standby.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1875
Entropy (8bit):	6.552246355092361
Encrypted:	false
SSDEEP:	48:cdzzBw/O4knA9WItL5e3l/cjkzPB3UdHx2sCAYb:cdeJknmWIp5e3l/JzedHYs4b
MD5:	7AE74E954696609D3F8E48A66A27BFB0
SHA1:	54EBDEFD2B06DF20E15D2201BE783DEF3E4EB03B
SHA-256:	E199009278979CFB701A0A8FF268A76A3C0F818843BBFDF73781649003B393D1
SHA-512:	E03990668922B9632B8EE0C522DC51B8F7BC319CF0EC2D5838544428803218D04B2F204266283FDBE223BDA46A8E37BD7B895CFE1EF298BD6156863ADB78128B
Malicious:	false
Preview:	.PNG........IHDR................a...&iCCPAdobe RGB (1998)..(.c``2ptqre.``..+).rwR...R`?..............> v^~^...v...D_....@..J.(.....(%.8......../)..3...E..... vQH.3.}...K.....I........ ..H}:....6....KR+@.28..T.e.g.(.ZZZ8..'..W.....+x.%.....%.....B..........j..d.2.....9....bg.b..\ZT.e22...#.#.......B...a.....T...!...>..9...O..F!\|....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Windows)" xmp:CreateDate="2022-04-20T00:56:40+03:00" xmp:ModifyD

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bowl.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	163
Entropy (8bit):	6.023095025184366
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lkOgRkT/EqC+G6w2o2y9JVgWoxkXccTFYFDJjbwLONXB1p:6v/lhP0OaCG8o2yTS5xkHkJmKjp
MD5:	643AA0C55CC25F1EEE9DFB0595FEDD9A
SHA1:	F69D46437CABBC15AAB9020ACDA4A928FE38442E
SHA-256:	4510B6ADBF2E162D5AF6330E7FAA3F162B82B89CACFD36EC5B90F3D29E0513E5
SHA-512:	EAF64B8323173B2A9F0E1A8BB907FFC2B893A7203C35A66557B756E8E8F21AE8CD9D77DDC5C1A1CDE11D2B1C552445F78811E9BF54A6A2529826AF1140F49293
Malicious:	false
Preview:	.PNG........IHDR................a...jIDAT8.c`.........a.5.[r./..c........l...0... ..(....X...1.!..&....sa..1.5X....ET..c..a..........fl...q...'in.\|N......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bread.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	205
Entropy (8bit):	6.45557042570304
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lqyx/iiuU15sHA2hyJqtHAOkRrq064T288JG2CxKLgd+TzXmD:6v/lhP/lt1tGTtpM/ypnMKUdk2WV1Mp
MD5:	4587C249DD36420AC760F134E766F75D
SHA1:	23FE7B906D55FE15B8BA13E53A77E20E2AF1F703
SHA-256:	2E266DD0BBC150F45E0E0307606DD519F8F18019202B49B0DF315F8ECC1F5DB5
SHA-512:	B32B07C48B7805381A463886AA363C698F72FB02B1C5B2ECB1D5D4C3F71BFECFB2EFE8D130489B7C50DD7DDD84FD4139C7EC6F9A1773A7D88C13BABA8A5E3D0E
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`..H.....I..&..Q.....D....S.........W3.bt......V......... u.. ..6g.4.... v.p9.Y3^..9..f..0...S3.........E0R..a...d.0......5..1.........c.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\brewing_stand.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	203
Entropy (8bit):	6.316927343163698
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l3bapr+Jl9+KpGhvvyCWjBQ1IswYsXqYJpcOpDnG4lO9Allsc:6v/lhPnbapr0l9rotvyvQaPpLG489AVp
MD5:	C57A0FFEA80A39FB0C5268DC09DB0A4B
SHA1:	EC6EBFDA36FCD1AD9E8C3057E65A26049048B8BC
SHA-256:	010377BB318A30F8AE2F2E5AF8BEA65B3CC096535D84FDE9631BF472E7A7C7C5
SHA-512:	0C1E097BA10D5B6C98237BCF2A6B29930555BE9EF33E5126A63D61EB77611CAF2F3947EA67ACFAE4CD3409E148B81BEAD1383B35C580C741571450E45A804C24
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`.~....?...V....&.....g...0.8N....V.Lc.#h..}e.....r.Att..K...A...$.&H.H3.....iHKK....&...............d....2.$.`.<y2.. 6Ao....G. M .Mn.............IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\brick.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	191
Entropy (8bit):	6.291090265307706
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lrXl2NpuOQ9mDgGbf19DJl09PNItSPhJaTleV7Xsup:6v/lhP7XlHOQ9mDgi19FONIIfc47Tp
MD5:	507D443EF60F561E518B63321B8AC53F
SHA1:	C4837669D61294E19FE120BC92922DED6137BED4
SHA-256:	0C052C23230FF95EC48959B3EE23E88D9B95B04FD4F9B3429DA6A585E6E95C81
SHA-512:	18ACD18F9693F7204E4D2F0C52594E1FA8D193F82115C172815267FA4074D43A90688A6833F634FC5C9EEABCAF2D6AE0CADBCD0AE7D633AA0B672F4868042799
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`.2.SY.?.........o.r._o..dM....b4.4...x.+Q.@....A........&d. .+&.0...\..1..0C.i..D}%.. ....."....9.`.`3.Y..F...)..@.&\..$M....j.?.jRa....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\broken_elytra.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	317
Entropy (8bit):	7.085155082664401
Encrypted:	false
SSDEEP:	6:6v/lhPW7vu2HMgHoyJhyaL/5G/HmCVV+FgIzZNrp:6v/7b2HMgH/vyYiHmCVkgIJ
MD5:	B6B45513C81B4EDCEB9476DF5D09202F
SHA1:	E88C32750D56DA7BD0B716624C9734CB74C94407
SHA-256:	621A48CE926D56523524302269DC3D984F0BED772FF916C9C3F7A4C67E357D62
SHA-512:	8A687827740CA90ACF4A84B98257EAD93A89C23CD81383AA287B4380C0874DF85FA7C98FAC17EC22C5F1860FF02DEBD0A8DE26D668A2622B4E7982E0F64F1420
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8...m.0.E.....6.^........i...p.6....2.B....FG.J.6.............".......+.QD..7.$.u].....F.E...%..nu.J.7...i....J..yY.J(p..1.#!..sL.T.p.~2.#...@".YMC.'.a.RD.X.....a.e........u......m...R$..k.........5.N.....<..+....k.........P.g..m.....9.._..<%.K\|..r}.'`.3....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bucket_empty.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	348
Entropy (8bit):	6.870622940932826
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+yIdHBJ19wR3kgjF+yjSdeWVdKz530LK+Wmm0Js5wilVp:6v/78/esHBf9wR3koFtSdKyLVhm0iGG7
MD5:	60397879CF3A83249AB41C845E8094AA
SHA1:	68CA298B65A850841AFE66F0F96DEE8E32845AA1
SHA-256:	26DFF6E89A93809A66123ADE3A939BED17BF73ACAD02B6893CFC3E861239BCB1
SHA-512:	1C9CA0C9F709A38C53669A1059ED3A1BCE816147326771EEF21B13FB878AAE85D7858810C2C794DE38ABDBE574F1AEE01399C095F969A52942AADB073D5D29E1
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O..A..0.E....R..^@z..6...^.{...].......k...4.Z.......h....T.f3.....m.z_..F!..A@s.m.q...F..flD.q$E..Y .i .2ir......B.u0M...nV..H.$PU....`#..H.$..Qt#e.xeY.2+....dT..$f##.P......d.&.0h_A......".....;.ip..@=..01.#....>.G47...#.O..p..&.7....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bucket_lava.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.3752309726752925
Encrypted:	false
SSDEEP:	12:6v/78/0fQfQ7j1Alh0ftnbEGl8JJ6H+dzpt7:uqQ7j1sh0f9bE1JJJJD7
MD5:	0C5441C0AA383D03283B3D24E55595EC
SHA1:	7A702FDC5F9582929F59368C778900B7F9488F2F
SHA-256:	96DF7FEF3914961DAFFD41595DB7CFF2C656286B9DDB715ECAE6133DB120AE36
SHA-512:	C235A91CED49625A2B29C81DC3F73A6F46A5157DFB7DFBC81043E5F12A140D74A6456364921F8A2D7DF696C4D55B2AEAC5A1582B26E90046DB45CD8E96EA8F21
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O.S.J.Q.=/......h.DA..M.B.[....... Z..B. h...V..rL!.....6-.........{.9..;..m..`...P....................v..k....G.3O?.y....LN&.H.]C.[..}...!Y...Q./C.uW...M.\.#....L.9NP..^..... ......'.\|......4M.wl.Ntn...t.F......H ...Y..].L.+ Pd..`0(B.F..6.\;9."Q^...W(WnU.P....,&.v.......`4{_.7....i..b.s.y.+!._..n.`.>...4%..6....R.O@..\>.F....p..."..Qk.K.....:."..V.N.......Bl&,W.."<.ug..;...{.\........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bucket_milk.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	365
Entropy (8bit):	7.051649024978117
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+yHD0aCgb76Ta+/g17UDu2jC5PQ3RwF9VPqmok2VcMJtljp:6v/78/eH5x/6TlgZbPy0PrXycQXN
MD5:	583B44B5E57CF9BA3ADD6CF41F41AB9B
SHA1:	EA5593BEF8AE54B2B81398C87975C1971B80F4A1
SHA-256:	40E4B614E2C3F55BD961ADF51777788FF5002ABB888D53239E8A9CB7A8B1414F
SHA-512:	2290FA667F33579438EFA80E0ED5FF55BC4CE19C24EDB4314825143B9B10EBD8371C57662197FD886AC66B19703BA3E1452192376DC8AE239F5C66A8E6CAB772
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O..;..P.E..........6........T$..b....'w..~...f>0.....!...l:.u}.,W...r0.C.,....~...-y.......q,....}.<.s..Q...m..'.EAI...i..*_C..k...\...O.ap.5$..............9J\..e.G.J...G..^/cg=(...4U. ..-...O..S`JU..i..~u:......t..X...^:...}..$....~...!..-.o.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\bucket_water.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	400
Entropy (8bit):	6.81849662574159
Encrypted:	false
SSDEEP:	12:6v/78/kFkQ4a7m3PpyYKBPat3M/6E3R0F9c:w4aSfpZot6fF9c
MD5:	594FD62FD5A534ECAA207D396E8CD180
SHA1:	A404FC54AE912B2EB3AC8B2B3E3718248AE3F396
SHA-256:	75CFFED46D11ECD4175BDD5E72BF42B022A1958A330437C0B2A2D4954451CB13
SHA-512:	F0412F4BB8EFA999DFD7A3D72B0464849E9AC65898A951F6E79E8FE4CCD22878A3B855448798DC4B3395A881FD14CC390B0E1913FEF3E08FB8ADF00FFFEDF2A9
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J....%IDAT8Ocd ......2...EEE.....C=..Lc`` ....X......tee%.F6...i.i..=.......>\|.......Lg..f.s................S.e...b.\`.Wo...QS.d.u.9...?..M.`9..L`.............. M ..C.`9iii.8..@i8.c....pcx.fA..{.N...0.a......:..,T.S#...p....)S..hB. C@...(a....?........e;.`5...b..7@.@..........>...i0@J^..00...1\|N.,.r....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\cake.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.676259287861872
Encrypted:	false
SSDEEP:	6:6v/lhPw2TSSwd6D0QWatxoSrAwfUSjs988KQKDk8hVsKAjvYjtZejeVp:6v/742WjdrExjAwfwAfk8hqKBREa7
MD5:	C5EE00ECDF9259A332505E689E20425A
SHA1:	B179EAE807EA56A1CFAEA13E0BF16BDF152F1EBD
SHA-256:	3E7B63FF06F70672BDAE31A96599A2CB94131700D2836EE073551C80B940A60D
SHA-512:	D7D8729DE9EAEB5AB79663833245CD449434F888AF8D442965F93E5BA017F6B699AB6BC2FE8B6A372583AACEC740156179A923A39C1195199DA3C2DFDF02C213
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`.6.zb..\|.........V...j.\...`.A..L_V..c.8............Cq.....pC.......a6@. q.f..$9.8..7...0Id.............Q.F..7 .H.`.#kB....6`...NC.5"k........y...!.`\|.:.z..@......0.@4......Y..p.@.f..D..&tz}.2..4...k...! ....0>.F........z....ePp.LR=....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\carrot.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	218
Entropy (8bit):	6.532576927759672
Encrypted:	false
SSDEEP:	6:6v/lhP1hEOW9Z9myVEaz9URgldE6jj/gMoLVp:6v/7D/8Z7uaz9RLf/gz
MD5:	E8715C91CA7C932C01439B03A37385D1
SHA1:	21F67A771B1B197B89345F4140B3897F5445639F
SHA-256:	043E4E87057ED8F9CB84265CB19A7CEC3B36FD7935D70F6672046C0EFA2861D1
SHA-512:	9E6FC2BD20D7EDE04EE0C7398AB690BFE7FAA0452880E18EA11F907ED502272F6561D5B645D9C3A055F09ADD262FEBF492B7A44C9E18EF3D48EAD419489558E3
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`.%0.g....g..'...f.!....a..4.Y..6Q6...k&.;..L...q.....6.f.C..a...d.k.....A....i..... ...!4.%..t.H3H1X3.C5..A...C.v$..m...i..v$.0....z.!.J.f.lEw>I."..5R..3...ZL75....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\carrot_golden.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	218
Entropy (8bit):	6.489611059256867
Encrypted:	false
SSDEEP:	6:6v/lhP1hE0F6EDBY5joa7oe2VPZuu+ZgD8up:6v/7Dvb8MKodZuuPAc
MD5:	D6983DBCF549B379E0F7F40AC9E7DC72
SHA1:	01D8CE2A4A2D4D4738D7E543FD3469368D0E3CA0
SHA-256:	62D3BB1BAFB1C4D610DDB98ED73308540BC512CE19C210D3725B8F2DD67C1DA1
SHA-512:	14CC2818B2E04792C408BBA1EAF248598D164C011680D5E05A15DD1A18CA54B1CBC83A7FA0DAF209D65FAC748C3DC4E87352A5D514DF46DF7D119D036AD21D9A
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`.%(......l..6...dH.&....D..M.. ...N....7.]..^$.6.f....a.lJ..k~....A....i..... ...?..0. ...% . . . .........A.mF......0.5.l..h.l+Y.I....$....H).....@-z......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\carrot_on_a_stick.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	209
Entropy (8bit):	6.497077790651611
Encrypted:	false
SSDEEP:	6:6v/lhP+qtYFOBdCP4fCph56FhN3kFV1/3E/bp:6v/7htYFmdu4qpgNiu
MD5:	7C936AFA1D8DA350DA636EE8F68374B3
SHA1:	BB3134B668A08E1D0A75CF274FE25EEB323E9B41
SHA-256:	A1477AC3ABF72FDD78F0940D20CF0700E23AAF987960F3CCE2F47CEEDE043FCD
SHA-512:	63E3ABE6EE9DBBB53AA7774A5E756F260245F7E640AC28D0B57987260D6F05DE6380FE3A43E944E9AC6C588DF4A916AA5ABDE28A6D81B953AA13BC21380BEB48
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`..........?.=.D.k.q.n..V...?9...i.LW.k&...abdk.....2.P.....'[3A...,./..(.[6o.cSSS..M!......4......M..b.H.......0....4....@...y.'.....F\|...\.o.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\cauldron.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	213
Entropy (8bit):	6.674674216939524
Encrypted:	false
SSDEEP:	6:6v/lhPqZDFPZPnzmgYW3ONT1kuFgBRHibp:6v/7SZD1xnI+ONT1kKKC1
MD5:	E0281FFDA9A51675837E7655862210EA
SHA1:	FA09FCC961F6357A8D21E5AD2A4731C951AD1FA8
SHA-256:	CD96945764DBD3B4E170F02AD29E43A97ACD72C4F41AD90EFA70869F2D6A68E8
SHA-512:	E754DDEDC4D7140A0C73E120053A5157831FCA1CB458D105B9E6C404F9733E52BB8A608EA862741C2E8E383B0C210081A66256D20DF6212D4A9C92BB93C9222E
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8....@0......X.`"11ue4y.' _..j..b..J{..Y..1....,.-.C\|'A.4...1...n.!,.AV......d]./....X.\|. .#....<..@..2&..`.@m..2.6P"..30.Rd.`...f.+.Z.~...r.[S..Ej".....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\chainmail_boots.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	172
Entropy (8bit):	6.17405186365841
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lqTC0dDKYNGUQjRToGUPdilpUDCqmUTzfL1jL3Lj/llsg1p:6v/lhPY9YYNGJj1o5Y0CynfL1jLbBlsc
MD5:	47D1578EE2344D11FB2CA6920E636F55
SHA1:	00C031EA69C6C4095508426AAD8593FE307DB2F0
SHA-256:	061BE8E65B0E28DF352A8DA03D28D587DFA73CFD5F795AF4833D4463E3213811
SHA-512:	D930C811D868BB20D6AB119BEAD6AFB9C5D6BF9BB596FAB5827D702C2F663AE3D595919D668FEFCF81C1FF3DD904FBF7290B9A4D5AB6BDFAAE6BD889E67F7A60
Malicious:	false
Preview:	.PNG........IHDR................a...sIDAT8.....1.C..C8Y..H..6=r ....wB?.......3O{...cTu..<.)....MD..c...p.S.L.i.....j.o.6H!1.{_...3..7.. .....:......<....Ac[(....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\chainmail_chestplate.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	200
Entropy (8bit):	6.596333138400238
Encrypted:	false
SSDEEP:	6:6v/lhP3PlultCyZI1l8r+FrIIF/ClI+6M/2up:6v/7/QrCyMlnpIYcI+6s7
MD5:	94FE25BC375659FD44A71BA682BE0084
SHA1:	266ABC931C89315004E560E305656E8722311EB6
SHA-256:	FA35055FC557527BD4F63D696FEF640F505F28073964AFD2FCC5757DCEF36CCC
SHA-512:	AD52378C8AA69C8B7C031C3B19017C56942F17C93664AB44FF1E9F4E3D33784F790DC9B46996C63725877047598069821F409722F13EAED13162214F79F9AE1A
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8..... .D].!..}.....\C.....P..iJ..R..<....cHkmi....A.}...=...4.o.3......*....r.....i.P?..4.y0..j.B....`E........uk..x.. 2.am...\|....R..E/R....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\chainmail_helmet.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	152
Entropy (8bit):	6.10310446483061
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3leuIv1ULeItyhjuBOYCZBhjFyFJVF6k84nIdlsup:6v/lhPuupRtyhwrEhjFyHsHnjp
MD5:	633893325F896742E29803B41DCF2EC7
SHA1:	5B7FC0753A8A275F89DDEC551820976121D9F3BB
SHA-256:	43FF24A39061E9AC1143254E803877331587479A2398C801A7D4BE7329C918A3
SHA-512:	CF47B4D99496B58E796DF8AC6F7DE7003AA1295FAE6994321C50E405140F8085A83403853C397597F7F3746347CC8518744662A69EBA8D9E3355343413AA782F
Malicious:	false
Preview:	.PNG........IHDR................a..._IDAT8.....P..Y.!:..0[..'.?..Wc....R0.....8.."y..!w.8,.=..H..<.j.x..+"Dr.BW......t... .RA..M..P.k.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\chainmail_leggings.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	170
Entropy (8bit):	6.296846707502776
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3l1hs3ksCOSIKz5Km9X4Bfv9Wr+uo5F6fqG2h1hlhyYyxB8D8u:6v/lhPFhQ8NVjSWMb6fqG2h1h+HB8fp
MD5:	960A80239B040E0DD4D356EAAB08E2A2
SHA1:	A3FFA95D1A08038F63025E7C804253C57891936E
SHA-256:	6836097D33AA0D542B4F1F29874BC09297244A5A6DCE4221D68C8A4493202150
SHA-512:	C0C5045A22D5E2DB839049AE4F5F2005C80B276F891DE0A3528630C99F99E474084A17FD1B6925188BDADE525E8BE9FDF0B33C5B0ABA871A312FC31B3A3D9714
Malicious:	false
Preview:	.PNG........IHDR................a...qIDAT8..R...1......OG..n.P...B0......JD,C...aU5/p`.esN.c.M.`.:;e...S.{\..N.m...D.2.N..t.._......../..Dzh.....x..J......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\charcoal.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	244
Entropy (8bit):	6.791141145593496
Encrypted:	false
SSDEEP:	6:6v/lhPqdHiT6/qwmhRcu5TzEpZsdFLTC6h5GxrXACg4agXjp:6v/7SdC2shr5TzEpZMdTdkDg4x
MD5:	99D9B8F8ECC013BFC122D41DA499E686
SHA1:	29342D2308D52BADE7BE6F375D7D3CC74FD57B3E
SHA-256:	AE6E9AF86FAB77BD2911788A53EB136AD6FC717479F810D8D6847F2623245452
SHA-512:	1467D646B1044C8290F0311077D04E669B4F702A524D694218716D9A68FEE7FF698CDC98813BF5F26F8A0846AC01342A8CAFF496D600FB451DE8EE4104E56D29
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.....@......."...K.q..tu..}...g.\|..BI..x.....]......mc.......\|.S....zU.!......8..~.."........$.. .T..3{...........u.!^L. .0...HR....g.CA..Q.t.8\|.>].Ig..}%:{H8..2.... s....y........3........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\chicken_cooked.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	243
Entropy (8bit):	6.593387351585129
Encrypted:	false
SSDEEP:	6:6v/lhP4klZdwb87O9vwnj0Oc0gL/UX1lA6PyqSoaO/bp:6v/7fLwHKIOcpL/UQ6Pb9
MD5:	23747AD3A2E96C8B38B4D05901A45DB5
SHA1:	A476F364B612A4414D9FB829CE98BDB4B6D87CD3
SHA-256:	BE65F5417B8EFC08FB7E4B79AFBB69546B88DD179A4B2417A94EADF19EF15A6C
SHA-512:	22860631C90A6AE123141AC1C6036C6B75E679D8BC3747D15491DB01CB7C9B486E72A577CFA09592BDABCC416EE72F574C99D0E5B71D4F0E9AA7137B2A748999
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`...vQ...I.\|......../.%..$..&........a...! .0[a.A.=...ArQ:...2.D#k.a..p...+..0...a..v."X8`.L.....a..\...$....h...D..3.`.@4.fd/......V5.h..$,.Ab .8c..5`Id.k&*%...\C.V\|.!Y#....M?_.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\chicken_raw.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	240
Entropy (8bit):	6.5434042808973425
Encrypted:	false
SSDEEP:	6:6v/lhP5S6Sneoi/BoVBbiKGbv8s7p11eTQokFoECs7XQT5z/kup:6v/7xS6Xe/Avz7YE5S+7i55
MD5:	C4483E24A1721EB3664EDD83FF26E620
SHA1:	C3FFB08A494421A738B9A62EC2B171C2939A237D
SHA-256:	D881FFDA3BF13C96173A88516BC5E72028080D33E2DF99C6370F44389C5EEFAE
SHA-512:	D9B5C051FCE9690C80D65EFE3AB15F1E271C4C4C66D11C3697E988617A06778941C3D4346A58DA88E485F53E96A454F492D5758F60A9BD2F574E10093E564B56
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`...R.........i...Y.. 6I.......b.0.M....d.0...~..A. ..D...?...... >H..!0.....0.0..i.a...@.L.. 6H.,...`....h.. .P...0.)..0..C.&..v.....E3.0.f.. .8c..)H.c.3L3Q)........s......7@..L.a.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\clay_ball.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	196
Entropy (8bit):	6.345138861927538
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lKJb+qyscxfFgkUMph264OTEV93pdhp7btkeIYpDKN16RU/Vp:6v/lhP6JbHys6akph2qTEBb6YtKfV/Vp
MD5:	F046156EB8AE9522DBEE340D624D81CC
SHA1:	1D73304A7B59253E35917492A1FFBF73A48AD4E1
SHA-256:	6DB8D84BED1B47E3C842BA53F3CA5C8842D7F5555A2CD798CB2E9121196BE15C
SHA-512:	2EC3798B12630C3BFE6F2496871CC3E365329AF5CC7D772C6AD0C98E47D36B843515F65C74C6EF58B7FB10F5DF74F4CFF5DB77F0542360F3E49AB6D9BA0A5D7A
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`....%.?2&Ysi....o.. L.! .Sf..k..0C.-].....~.50.f.^8;....!0.`..4.e.L3H#.f...a^.k...].c.e.,.a..r...a....H..+`..j.......o....D.F...-......9....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\clock.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3217
Entropy (8bit):	7.721085468140665
Encrypted:	false
SSDEEP:	96:bSV0NwEWI1X3W9kwcQzYdoxRGVMaOHtK6JrKdi:bSV0NxlG9kwfzq9VMHgcrKg
MD5:	377A2B520095BBBB56454BA9CDD5C1F0
SHA1:	97962238A5DFBC1A4194E3FFA4B7B44A14F71BB8
SHA-256:	FA998891DD4536C5F718D79AEF51B1B6F8EEB26F92BF0803E62D2BE37964D9F1
SHA-512:	12CD90DE704667EBBD41AFD5ED4B857BFAFA971E857C0D6F36DF0C669EEFD5FD21CF530C788D88B22927B1978FD8690DB8F62B79FA68383ACF037DA4E088AF83
Malicious:	false
Preview:	.PNG........IHDR..............j......bKGD..............pHYs................1IDATx..._H...../.0e).q!....\|..,.....>.p.)U.....,*m).....,...+b.vY.o..nHJ...>...J6..-y.%.'.-./..s....93s.L.D...68...~..w..E..n.../...x..:..5.....p;....GRaC.?.+zGt'>.`.......~..........^..L."..H...`....j.....{~._'...`......H.f..z.J.......S.U.....2t0?...hT..:y.......}...j...yQT5...a..~.w..m.D.k.....y....'O...~./...}..x..=x..;....f.'1.9....?.N.GC.W....w.X\|.3}.#..Z6.....,,.3t.....f.p07...$..h.?....0....4.@..Rss@...s...v...<....+...&z........hl...9....V6..$l/.,.{`x.$l7.q........F6..{.0?.E..........r=.........E..T.U...{...z....Mx...l.WO[...i.`...".X....qP.....++.........T.UC.z.`~:....G.A@......r......_.L.....A:?.A../l...&....`k..=@.0?.e~....D..X.C........"..)l-t....zp..l.....<`....gk..~......b.:.....G....7..a..=@.N...ogz.@..V....oo.h.B!.B(.]......3Z.4....`F+.....h.`;A.......x`5..`.8~....H..i.]v...tz.=@....X.Ch..6^.....t../8z..Ps..N..j...S-....y...&H..\{`.#.{`..i....k.t.~..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\clock.png.mcmeta

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.6211755429194716
Encrypted:	false
SSDEEP:	3:3Hvzzfky:3Hv/9
MD5:	593B64E0DB05FEB56BF74272B5A3D6F6
SHA1:	4BB0A08DEC1EF6E1EA972AB04EFBFD9332E3AD4D
SHA-256:	4A5DAD045D1C6172B28DCA8EDA5EE036ECF966137CDA30C64770BF48689C92D4
SHA-512:	4B65E20861A4322BA76DB8422FD569C893CD0CC7C812EFDB7962940F70FA54B1550809545ADE36A179454B0AAB6B1C75ACDD42DD91A6041BC1CE5CFD18D7BA72
Malicious:	false
Preview:	{.. "animation": {}..}

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\coal.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	223
Entropy (8bit):	6.722797965467036
Encrypted:	false
SSDEEP:	6:6v/lhPYrmXkA6YA23ViGUpdoOorM/ArtCFTKbp:6v/7QrYkab3VbUToOj/S4TK1
MD5:	AA46524FD82B785BEAE4A335810B55DD
SHA1:	C56C4A54A82E4A5FED0D305DEE53919C0CFFF3F0
SHA-256:	1FC55287C9B4A151AF132727A0178FB7EEC857EAF23BBA2AECD6EDE1E106B108
SHA-512:	50E8911A53CE282327D44216F4AE7CBCF8A82E51721BB0E7D6657DC5E5F25C04A5031DB3CC10513EA86E9D2B9446144EA92CB039E890B1550C93A6293586290C
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8..1..0.Es.,%KH...=x0d...H..~...]j.X....a..5.y.6..-.TD...0.`9g....Q.."...]{.....,.k.&D.. ....5?..;..M@.$..y.."..n2...v.U..*..$.W.,... .26.5.7x}..n.~Yox...d..<....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\comparator.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	202
Entropy (8bit):	6.40447425383871
Encrypted:	false
SSDEEP:	6:6v/lhPlR2o+p27Jkr/deQaK3VB8ZUle/xZtjp:6v/7+o+cUFwCTtE/nz
MD5:	FFC1C86EB5A73DBA8C28F717EC1C6053
SHA1:	01CD5BB7929580576AC11746856D8242E9DBB710
SHA-256:	5DFFDF0354D58DE8C353D32E4FBA817664102CE96C563AF8EA18F97181798DB2
SHA-512:	4F979D0EB69D95617D1DBCEF25EB10C8EE87CA2313E05EE8259EB78B1AB922FA536C4B1D05DD6DB4A9E9C1F77C8232ABB8D96B172B511AAD089423C875AC7DFB
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`.7hea......"...x.7`j...'S..d;.......d..\K.?N.A.(2............d.B0&).A....... C2....5..b.! ....d...<2....0/...ad...X..*...{.h.p..b3.:...a..y.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\compass.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.557958408246525
Encrypted:	false
SSDEEP:	24:ms/605Y2CGf9saxIZwasUpMYrpFyEBknG2vIa+VdBUavr2MbTcK2Et8:J/605Y254was0rpsg2ga+d160x2Ea
MD5:	1CFC930E5DEAE0E121D5E93B9420320E
SHA1:	277723DED7FDFE320083686C4728E9636CDC1F3E
SHA-256:	6238EDE831E8189D3CB2403E4B22F7EFA7A3177E5865B4693156C75FC35DCB01
SHA-512:	B69006D749DABA4864E2EB10B65DC6C7C9A29CECBAC8082FB66400B17B5A8C0E1C251A7255ED15007986DDDEF724816F026DEDBB0E83C5339EB960A43760FE90
Malicious:	false
Preview:	.PNG........IHDR.....................bKGD..............pHYs................UIDATx...N.@....,d..D.2./.!C-ff..W........Pe..RG.!....3D}.$......!...}..C.......GH..w...n...........e......v.;;;...b....n.......z=......8..P;.:..}....w.F .M..8.......A.O...'.6H)@.e.o&I2.Y..<.....,..R;fY.n.......0..0...c. ...U;.........F........__....n.(.%.n5.....gm...S..;...%P......+..d8.8..y.o6.=P-.....{........8"...fA..=...4.8..=h....H......s....$M1IS?.d8w......N............4G.......t.E.....yG.........o.........e{.N(.<h..:QT..5.H.....v.....i........bA.....\....3=...`Y.hs...t.H.........=......z@...=....'.C..E....K.....no..s..H..?=...`.<P...@.\|....4...o6.g..q..$..$...`.<...q...@....x..@.....U.j([.?...<...P....g..^...^.2.z?RU...H.7.U.(A.=...=...?0..../.N.X./,.Z...'..z`6......q....z....LX..@..M...=../..p.g2.....P.....;.......s}..b.....DPz......./l.zP.H....{...T.6l..j..zA.......2....87......yy....w.!-.<s....z@.V......k..@..\?.d...........=x5.C)zPl.j{.D...=......z@...=xC..R

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\compass.png.mcmeta

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.6211755429194716
Encrypted:	false
SSDEEP:	3:3Hvzzfky:3Hv/9
MD5:	593B64E0DB05FEB56BF74272B5A3D6F6
SHA1:	4BB0A08DEC1EF6E1EA972AB04EFBFD9332E3AD4D
SHA-256:	4A5DAD045D1C6172B28DCA8EDA5EE036ECF966137CDA30C64770BF48689C92D4
SHA-512:	4B65E20861A4322BA76DB8422FD569C893CD0CC7C812EFDB7962940F70FA54B1550809545ADE36A179454B0AAB6B1C75ACDD42DD91A6041BC1CE5CFD18D7BA72
Malicious:	false
Preview:	{.. "animation": {}..}

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\cookie.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	226
Entropy (8bit):	6.487989832033299
Encrypted:	false
SSDEEP:	6:6v/lhPdROxb9dwRPRnpTWwSLlU69wvFFTp:6v/7exb9qRPRnp7/6A
MD5:	FDC2C9850C934EAC830E3C880BBF6517
SHA1:	8090123A6FC144933D2CF6A8ED27D469B9CB0E60
SHA-256:	263825506C0C0A80D945DA48BA95EA2F361A83492E88861D06FDF97037DFDED9
SHA-512:	394C4AAF309CAC176EAA5F9E9C1CBB27A7F579B8F6C8E69FC724CAC1773170E61AA27A741045422AD7D52F704D80724559E8685A59BD7DB0BB2CBB6EAD07C61C
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`..`g...l.h......5...l.C.x..I.........Al....a.....l.K`ld.P....4.$aN....@..a...;..6t6H...0.f+.ft5(..LDW..,d.`...s..F.....A.D\1.R.b..!..D.4.K#....A6...4... t<83....J.:.......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\desktop.ini

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.6427741506984646
Encrypted:	false
SSDEEP:	3:dCoVMEhAdFWKCAYuIAWKCAJs:qBLYyu
MD5:	9DA26F73B0F4694B106943E534462FD0
SHA1:	F79EA1B9EAAE9BF4ED879EE61D82743DE507E7B6
SHA-256:	15F4EC50106F15A171E569F032BD5B125CAD9B8A4C606ED25369372F9BFBBA0A
SHA-512:	75CCD192667061EFC18A60FD2AFB397D596BB0D7861344F892E7A3CBD550640B6EF1844888D651479232C59BD59AD901EC3759C01F403E680B8B16F4C208BCFD
Malicious:	false
Preview:	[LocalizedFileNames]..totem_of_undying.png=@totem_of_undying.png,0..

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\diamond.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	397
Entropy (8bit):	6.876682115936828
Encrypted:	false
SSDEEP:	6:6v/lhPkR/CnFmoclPGelQ/pzQ1WHBqd41MBdkUrMzsF9jJ1y/4G6LTJ3wcV8Qkup:6v/78/kFmoeJQ/S66+zsF9jdG6ndpi5c
MD5:	38806AF1AA53477E626A97B5F59FD660
SHA1:	D991DC952ABDCE814540545850E917E0FE83158E
SHA-256:	23378BADCD603A4DA526FC1421E518F964BB5C04E840AA344B87ADDA0770D7D3
SHA-512:	FB7DF7BB76313CB39396286C64950EA1870A4BEF83501B4E52CC4197760CE284FEAFAB171557DCF21476DBA62445B84981977C66EC2657D9ED5BD6B7FDB07A01
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J...."IDAT8Oc.p...1.....P&.l~..S-..i...?.....?..0.......kn..Y.`\|..D\YZ.......f(....4...E..$..1......K...]...R.....Z0]..Zv..B.L`...e....x. ...q>..\......{...k.o>>`8........=.....`...}..[(._.. .A.@.,P..@6_....+......d.2@I..h.s+b.v.._d....mp.....n>.....u...0.r....<.`aqx....A.......@.]3.....@.u.........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\diamond_axe.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	349
Entropy (8bit):	6.796075856564158
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+NK81hqlPXtduAkhFSLol86YVnadNf8X6Hy/3QmuyLp:6v/78/R1hqZjCFSLoi6NdNUX6U3Qmuyl
MD5:	9A8271DFF77B718F76D630182C40BC16
SHA1:	691E57418B2F668F3DA44E83B0A9F869CDC7B667
SHA-256:	C4280D256D34189F60D8A1D0F49CBBE98CC142EC3A1A08C9FFABF16CC36034FE
SHA-512:	AFC4FC935E5F8D0BEC15219DA070DE8E1CAA3C8840F710140744F501B6C2B53A9015B80AEF0D5610C83BF21C921E248C63C59CC7EC6BFCED9C1221FB327CDEB5
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8Oc..0Bi..Wv..7.....?.....@..........-.z.C... . .kk......(..s@....1\;............e.....b8..;\..... ?.{..a..u`...`.7.....o....._..=...O......:.F......6..4.K.2..feP..:......._...l#......r...f....$...L...5..lx..i..ba8..#...HK. `,.I..).....ts.CL......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\diamond_boots.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1792
Entropy (8bit):	6.481153647728119
Encrypted:	false
SSDEEP:	48:cdzzBw/O4knA9WItL5+/cjKNgN42NL3KNudHx2s5Yeub:cdeJknmWIp5+/p2jI4dHYs5vy
MD5:	B21B9048603FE987C61592B5D180E911
SHA1:	9EF204148B1FF5374EC0733500E8DA2278383492
SHA-256:	4C0404D2B5848D1954DCA92EDD1A8BA1D3AD4A81E5C3C42EA4BDAC5BD56548B2
SHA-512:	6897A611FC15109EEBCF1006419F121FCC3B58D3086C05FA467CEF4E2E3F948F18F6569F5D2C4CEA8DDBFAB9FE5165982E3CB26D123004E8CB2CB991646063CC
Malicious:	false
Preview:	.PNG........IHDR................a...&iCCPAdobe RGB (1998)..(.c``2ptqre.``..+).rwR...R`?..............> v^~^...v...D_....@..J.(.....(%.8......../)..3...E..... vQH.3.}...K.....I........ ..H}:....6....KR+@.28..T.e.g.(.ZZZ8..'..W.....+x.%.....%.....B..........j..d.2.....9....bg.b..\ZT.e22...#.#.......B...a.....T...!...>..9...O..F!\|....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Windows)" xmp:CreateDate="2022-04-20T00:56:40+03:00" xmp:ModifyD

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\diamond_chestplate.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1793
Entropy (8bit):	6.453402597782009
Encrypted:	false
SSDEEP:	48:cddzBwlO4knA9WItL5IqM/cjxBBBG1B13xBMdHx2sDh:cdgHknmWIp5Y/odHYs9
MD5:	1F5FF3ADEA553FBAD1D3D1C0BF06B635
SHA1:	1B8C23EAAA4E9F36A5E81DCE11BF02809D0B02CD
SHA-256:	8DBAD5088508708C7F4E6BE2B109C0B448925E64D7D4324B6201A581045438A3
SHA-512:	3BF225BCC50DABF14365B6647A67EBF6E6DCEBBCD64FC3968DE32F7F32B0947E544525CE1DFC043DF963A25A2D53ECD725391490EB227230543440FFA0210BC9
Malicious:	false
Preview:	.PNG........IHDR................a...&iCCPAdobe RGB (1998)..(.c``2ptqre.``..+).rwR...R`?..............> v^~^...v...D_....@..J.(.....(%.8......../)..3...E..... vQH.3.}...K.....I........ ..H}:....6....KR+@.28..T.e.g.(.ZZZ8..'..W.....+x.%.....%.....B..........j..d.2.....9....bg.b..\ZT.e22...#.#.......B...a.....T...!...>..9...O..:6\....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Windows)" xmp:CreateDate="2022-04-20T00:56:40+03:00" xmp:ModifyD

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\diamond_helmet.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1799
Entropy (8bit):	6.454897852422268
Encrypted:	false
SSDEEP:	48:cdzzBw/O4knA9WItL5Q/cj2NHZOHk32ddHx2sYl:cdeJknmWIp5Q/4dHYsYl
MD5:	8C2799416D6CBBDF0A8F67427F3439B7
SHA1:	CC760C1291C8EA67C7EC8C74F6742F05B836CC3F
SHA-256:	BB5469B940A0D36DD279C13193C53DD728A8738FE41FFD650B969536A8E2E5DB
SHA-512:	B17D5B9CC386CC87F7198E93BB8F54CCB3123E91DE6C6B48107331F010D9D674B4C706F714AFF50DD86ABA687B2864962C810FEE93C63049E2732D6B625579D6
Malicious:	false
Preview:	.PNG........IHDR................a...&iCCPAdobe RGB (1998)..(.c``2ptqre.``..+).rwR...R`?..............> v^~^...v...D_....@..J.(.....(%.8......../)..3...E..... vQH.3.}...K.....I........ ..H}:....6....KR+@.28..T.e.g.(.ZZZ8..'..W.....+x.%.....%.....B..........j..d.2.....9....bg.b..\ZT.e22...#.#.......B...a.....T...!...>..9...O..F!\|....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Windows)" xmp:CreateDate="2022-04-20T00:56:40+03:00" xmp:ModifyD

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\diamond_hoe.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.541126613205692
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+QylTw6l2KKIz/OmaOdSHvG6QSp:6v/78/plTw6l2KNrUHvd7
MD5:	775E1C903AA8E54A0F50ABA2A650BA35
SHA1:	CA03D1E9D708DE2EA9BED8A0723208A61DFA32D8
SHA-256:	F6631C91B8EB374E6C2FA9C1594D465D8CBE8BBED0AAD06B5DC1686C27C3E7F9
SHA-512:	D7692E10388F0558B101F8776417E1CF639CDE90D96C3F1A493A37F986595D9595DFCD1645A28A87D2FC8DA1100E75AC2C6D2AF9C5CC7496877A098D83A4A3BE
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8Oc..0Bi............q0^...............k.C... C@xm.. .!.J....9I3.d....`..t..+................@...T.6....F.\|g.l.......L...9...A...X.N>..p.....=...'Y..00...._.'......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\diamond_horse_armor.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	194
Entropy (8bit):	6.287502919261366
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lNhq8cMIu77+SecoMvNHmdigmRSkyxtbEb2ilCCVGEVmVplKh:6v/lhP9hqv3cGdigd9xtwRYCV8Li/bp
MD5:	9394392855D7417B05A093BAAADAFCF0
SHA1:	BA6EAF9AA3B40040D5E3000891DDB47835239280
SHA-256:	8A39726A090DF59D6D6C0763F6C4D9037FCD4ADCDBBD46570A0E0F200897B4C7
SHA-512:	690B9CBE30DC89DB68EC916922749FA95A557C23EF237A31067FA38D61BCC50D7AB9AB5B905709CAFA7BDB0154C09D12BA81518BC3F9EFB39CAAE7B1AB35D35F
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8.c`.Y`....)6....n.O.f..$C...... . 6.. ;]j.r8FQ...@...b@.......r........q..D.f.".&..0.$..;...H..C..3.$.S.a.H.....`..0C0.@.#1xp.........QH....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\diamond_leggings.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	6.426778795679857
Encrypted:	false
SSDEEP:	48:cdzzBw/O4knA9WItL5k/cjYD2K3GdHx2sV:cdeJknmWIp5k/EdHYsV
MD5:	A3C8EEFD966E0DFB6FB091322126F75E
SHA1:	927512DED594E010FE6B9B60A64D8A1A9F890D90
SHA-256:	43FC79EFC31889BC0040147F62BEBD7734CEB7513CAF2885F12AAF544F92A930
SHA-512:	C81CEDA00A3BE98912E886E3E99ACCE090BF143DE843FB64B91D3C17F92D967E97F505592842F6EB33B9DB00A4BF4CCA38C8CD2E0BD74128066300ACF41B575D
Malicious:	false
Preview:	.PNG........IHDR................a...&iCCPAdobe RGB (1998)..(.c``2ptqre.``..+).rwR...R`?..............> v^~^...v...D_....@..J.(.....(%.8......../)..3...E..... vQH.3.}...K.....I........ ..H}:....6....KR+@.28..T.e.g.(.ZZZ8..'..W.....+x.%.....%.....B..........j..d.2.....9....bg.b..\ZT.e22...#.#.......B...a.....T...!...>..9...O..F!\|....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Windows)" xmp:CreateDate="2022-04-20T00:56:40+03:00" xmp:ModifyD

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\diamond_pickaxe.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	361
Entropy (8bit):	6.886138800333511
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+xTw6l2KKIz/OmaOdNWNF8WVBtVJOuoAby49hi2QLlJL2p:6v/78/tTw6l2KNrU+SF8ktbOdAbyEh+w
MD5:	5642EA5B671ED5D78C3174C1F9106D46
SHA1:	25406F93E4BF13D70D1F4B94AC803B87244434B2
SHA-256:	C7FC2164543C8082D36C7193B0B60C705014A19DA64092C25D269C9E104806BD
SHA-512:	D94635A357759DC9BE08FFEB5A822D245EE5F6113841B456D43A816FBDB973DFDBB4C7BC2E9351DBA0EED71D35F09AEA2C3F46F08B8EE4156156494D9052E145
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8Oc..0Bi............q0^...............k.C... C@xm.. .!.J....9I3.d....`..t..+..........!{..J.. ........2.\|r.!!>..f.3X..../.........02~RjP.d.v.d.~_....`6......$v.S1.]}`y..i...)G..5#.....o>>....Hs...........@.3M$..r...4....,...p..G.~&.@.,gS.....Hyg..L.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\diamond_shovel.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	305
Entropy (8bit):	6.607131037812468
Encrypted:	false
SSDEEP:	6:6v/lhPkR/CnF37z1zQDXuUWJQLbrEPdGsTkeSvD86vy2TiZotXaA4beqbTp:6v/78/kFr53UWezENkjbLyHZopaA4qW
MD5:	AF987BCFEDB71BA4FD5DF18035BC1AFC
SHA1:	1F6CCBB842EEE0BF4ED4601624B39760007C37F8
SHA-256:	15AE086D4ACCBC8D5C3FEEB9BD6426865AD15E4624A7D843DA95DA6B31A2F8CE
SHA-512:	8758DB97DD98B70BB3C41BA23CD94B674D3F7E861C75857681BE1976F6A657B7A875831AE54D1AE97C5CD80BBB641C70008A3824DAAD5985E3B8D9F3873F46F6
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J.....IDAT8Oc.p.......k...7.....?.........`\|t....\|.`.....HqES....`......\.W.z.-.u..0~q...(?x(...7..f.i00.L.#.. ..62...Y......;Q....K....'Y3.f.....f..Hs.....!......x..\~.p....B......b..b!I3.0..$.........ZwB\`.....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\diamond_sword.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1882
Entropy (8bit):	6.582291908822023
Encrypted:	false
SSDEEP:	48:cdzzBw/O4knA9WItL5m/cj2p3sdHx2sWymxg:cdeJknmWIp5m/MdHYsWTq
MD5:	8E1913AD9305A7DBE0A9F46D4B7AA9B5
SHA1:	F2BBCB390F684328249F7994B480D2FCFEBCDCB6
SHA-256:	1492B6370A22AB05F894D416AC97E63A36C5C901AA7A1CFA4403183853A982EF
SHA-512:	F9EA326E7EF48F5BD3DF4111518187BE3A9E7E4C270E247532D7A39D23E665702406528414EC5FE2801C8DA14F783AE4BC6DAF0B0A767AA01EC9277A7994458F
Malicious:	false
Preview:	.PNG........IHDR................a...&iCCPAdobe RGB (1998)..(.c``2ptqre.``..+).rwR...R`?..............> v^~^...v...D_....@..J.(.....(%.8......../)..3...E..... vQH.3.}...K.....I........ ..H}:....6....KR+@.28..T.e.g.(.ZZZ8..'..W.....+x.%.....%.....B..........j..d.2.....9....bg.b..\ZT.e22...#.#.......B...a.....T...!...>..9...O..F!\|....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Windows)" xmp:CreateDate="2022-04-20T00:56:40+03:00" xmp:ModifyD

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\door_acacia.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	130
Entropy (8bit):	5.66951518029626
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lUkC9/lqxW6+BiaG2Ldik7Yluw/kg1p:6v/lhPULqxb+gaG6Hg8up
MD5:	38632062851DD0839BA7C9EEF7F51877
SHA1:	FE8F56CF98E042764849BE8D5EB1E99EC9247568
SHA-256:	48E12B1E4CB8DFFEB0517250586ED0121D4E43C4E4D144EF541617A9B9B6A767
SHA-512:	8AACAA80BF9C8A44ED1A999CE8A70B97DBBB905C95590C73A106C3FAD30AEF6A3FFDE085952FCA084884576A76AAFE885DAE3353C2753AAEA662EE49766A2DB4
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a....9IDAT8.c`.T......4...(.@\|l4^.t..(3.b.......+.x...0I..`d=..u.....4....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\door_birch.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.965608388377961
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lUkC9/xyxHx/xaQX/speeMmFMghkj9eNY0f7DsmFUl/1p:6v/lhPUnYxbeeeMmFjGjqh7up
MD5:	14FA34423615F609947624AFAD25B205
SHA1:	62B8BAD98858144600F0401415C8850456CEF48B
SHA-256:	7F21F39CF0F6459A05EDCE6BBB1DF5C5A31CBEB41E30A6986190ED0F858FFDBB
SHA-512:	E0DBC8E0B22AB518FBE91352DFB46BD06DE638CBB075399897FD7189CE6CECB4D5ADA4C097FD4A5B8BA0140EE441A86D07962C22D34C8B1254444802D714A46B
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a....WIDAT8.c`.T`...N...rj&.......C0.}.6......2.+.iD.$...f..~.....;..d.U.@Q: ...``. .#..._..N........IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\door_dark_oak.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	136
Entropy (8bit):	5.672197435528582
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lUkC9/JyxHxnDxwoLvb0xtuj905m+g2T/Vp:6v/lhPU/YxnDJLb0xa90Pg2LVp
MD5:	DCF46B7A41336B8205C1848F83139FA1
SHA1:	DE619D8BA5B298719B3D93BC83BE22791887C465
SHA-256:	DB31B4AD4856D2C960C0F764ECDF18970644D401818EE276BBE42CA14878B6B2
SHA-512:	D83677AFEB5BCB0CD588835F38CA65CFFE43E111BD8BACF4E3169B0341BA864DD705E9F9CF57B5D0D38A7E4D62A85B3B76D8A6E24F0FC7923347A9ACA6DA8208
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a....?IDAT8.c`.T@M......AL....18...i.....@......0(\|`a4..`.....1.Y..6...:._....IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\door_iron.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	140
Entropy (8bit):	5.703096052133844
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lUkC9/9hqxqf8RlId5Ek4PRVzO3AlM4TPbp:6v/lhPUDhqxPDYaPRkAlM4TPbp
MD5:	42867C1E65D2236CF8AB67B98D442EC0
SHA1:	F8E33275AE8FB6FA321EA899EBB5BCA11B37C872
SHA-256:	281BE60F0B29480F2EB0C145CEE46236D5C0F39D4B348897FFAA15E19E1BF462
SHA-512:	EC4198AE6655AA76DB7A33AD7BC183592DF1CB66E3085EDD5177B28816C4D172269B0842303DAD9211D379F56EB411AC640E570852BE648DF12FFA78C68B944D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a....CIDAT8.c`.T`....=K..4.Y.......Pf..{.j.P....16>.. ...t0...2.......]v..[......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\door_jungle.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	138
Entropy (8bit):	5.595186607830638
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lUkC9/kxTj7WyRsefk1Ytdtf7Wjg1p:6v/lhPUGxDZ/s2Kqp
MD5:	4335D87C224AD9A28937D02438253468
SHA1:	5FDFF24B4DA3C6D7370F089C42BD46DB884CA26D
SHA-256:	1DF6D70CED3CDA30E2BC529FB9C9E25E6E83A48AB0D3645EB614EA8B0DA5480E
SHA-512:	33389F70A262D834D9D37593928AB9174F8270AD0DA99A6AA4613A4EECC8C00560AACB9FC48D7BDD88A21617D95E8977044505CFAF8FA733F1DF9EE8C1426E96
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a....AIDAT8.c`.T`AI..MMq.1....6 ....".]0..P%..1(\|`aD.X.x.........b0....:.ed@......IEND.B`.

C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu\RPGOD\assets\minecraft\textures\items\door_spruce.png

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	132
Entropy (8bit):	5.561657697570608
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lUkC9/F+uOxnqTv3TSg1kmeauJSM7ljp:6v/lhPUL+uOxq3Sg1AcMhjp
MD5:	37AE3BBDA9B6F64A694E05004593A311
SHA1:	7B7555D58054BBC519EB3BE1BD61365009C13B67
SHA-256:	3499A31F8316AB075A5727F3A935F3714F3E996C35C0381D2891620F3007032F
SHA-512:	077C71941C52B9B5430A29710C88AD91991A11C2288522B5D0F4ED4957EB7D17FC9FBA509483A246FCE6240FD2C86AC962E7EB8DD966C211CC4281965DE3C6D5
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a....;IDAT8.c`.T .]..U..AL;............T1......(.....<..I: .#....B.l.V......IEND.B`.

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	69965
Entropy (8bit):	5.083792318784283
Encrypted:	false
SSDEEP:	192:hxyYlUwEJ7YBMrX3qf9OKaH0906kZW9uOJJttC/PTvpeRi4x9FCdGg2KEQunbIAg:h6wMrXGVi+4YW
MD5:	049A3729B5BCBBB89E32ED53917452D2
SHA1:	F916F31AA98556320F0D1BB88710E44B820B0BC7
SHA-256:	1F316192C73EE0DF3EECD12CD2965B594BD08F4A8AD3957D925A12EA5C6D3687
SHA-512:	A879F528683BFAEA0DF21F52A63517D68B0434E0E707B27DEA6408A9C0C69361FEB81482F355CEB4C4ADC59270826E2BFEA3DBAFEFFE216B1EB4AEC2D0D6562A
Malicious:	false
Preview:	11/26/2023 1:32 AM: Unpack: C:\Users\user\Desktop\RESOURCEPACK\RP.7Z..11/26/2023 1:32 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu..11/26/2023 1:32 AM: Received from standard out: ..11/26/2023 1:32 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..11/26/2023 1:32 AM: Received from standard out: ..11/26/2023 1:32 AM: Received from standard out: Scanning the drive for archives:..11/26/2023 1:32 AM: Received from standard out: 1 file, 10115472 bytes (9879 KiB)..11/26/2023 1:32 AM: Received from standard out: ..11/26/2023 1:32 AM: Received from standard out: Extracting archive: C:\Users\user\Desktop\RESOURCEPACK\RP.7z..11/26/2023 1:33 AM: Received from standard out: --..11/26/2023 1:33 AM: Received from standard out: Path = C:\Users\user\Desktop\RESOURCEPACK\RP.7z..11/26/2023 1:33 AM: Received from standard out: Type = 7z..11/26/2023 1:33 AM: Received from standard out: Physical Size = 10115472..11/26/2023 1:33 AM: Recei

C:\Users\user\Desktop\RESOURCEPACK\RP.7z

Download File

Process:	C:\Users\user\Desktop\RP.sfx.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	10115472
Entropy (8bit):	7.998882957219245
Encrypted:	true
SSDEEP:	196608:Mhhf7FHaM6MkwG2ea8oQoidqpcO49UEahKBXSmLnS0rCqs2vm9ED:MvfBdPG2QzoY1OgUEPV7r9s2+9W
MD5:	74A50DA81611D6A2EEF2D5E458C7FFFA
SHA1:	13065FDBE2CA38C8894F748F073DA3FA70A28E4D
SHA-256:	FE244979A074656D0143FA473A2DC0372ED736507DC7DF0BCAE2782FD05A26C7
SHA-512:	80BC90E626F1902B9853D6D4698B496574F2BF13095F1D8D745DED7949A048FE34C65FAE8D22628037D2E82386859B587A32376B3D8892EAF3C7796200087C43
Malicious:	false
Preview:	7z..'....9.WIY......'.......o.\|.BZh91AY&SY..........................................2.......>.......h.i%.s.\..5.>.]....q..Ow...O.......;..=.....5...oo.Z..$W{.......}o..e..Y.U......w..}.;..Ow..}..}.>x.z...}...}Qw_}.7....{.v.wo..n.....S.^..}.....P...z...o..>....wJ..ww{x..[.}...\.m...W..}..b..w.....w....:......n.U...]p.{{.....}.=3n.j.......v_v...{{..r}..o5....r..}k...:e{8.>.w..z]._O....X..m{.{s.....gl.....@m.q.......ws5K......._=t.5T.=t^n.....{{.ok...h.....T.......o{...^.{.{..u.6.\..".'.....2.....V.JS..{....v....l.]z.y..^S.....u..{....V.{....Z..t.u.\..7...w.......v.}.wwq....]....=]..w}...mE.....Zm=...\|...f.N...w.......}^k.........v.7.l..n..^.S.]u.i.....N..A.{.n..<..........:...o.z.}.m.==w......_Y...;..y].[....V...w[.......}..c{..\|.6....^...}}.{...^......^.z:..7w%.n.......^>.}.n..........;.7.CCF...u......u,....k.....;..z.....wi..\.tt......5.....36.9s^s..'...E.3..w......g......]y./.<.]....k.W3N..._^..\|<

C:\Users\user\Desktop\RESOURCEPACK\RP.exe

Download File

Process:	C:\Users\user\Desktop\RP.sfx.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	257024
Entropy (8bit):	5.700206392518801
Encrypted:	false
SSDEEP:	3072:CF7zU2iSjjusPFspsXuZgPBU13oNod6bc82hfZRO6FYSZUjBs8R5JCXfhI/KQ73h:azUyjHsmPBUqN26bjYRrFYSeprZ
MD5:	513286E3E241F1C93556F45DB4F8DC23
SHA1:	32C83261B6AC5663E91664764AAB429E6CD424D1
SHA-256:	A46070CB169ED0754C0FB624AD29F59FBC66FB75DF9D2B3DAEFDA76BC0D0D893
SHA-512:	890A2D7A72CF9975EBD716AD3C6F05F595AFD1218106054C3C33FF1B9D41BAF52C0013B8F65D975D372151B3303311F6554CB412FBCBBB0CF01DC8E81109F693
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: Joe Security Rule: JoeSecurity_44CaliberStealer, Description: Yara detected 44Caliber Stealer, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 78% Antivirus: Virustotal, Detection: 57%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. .......................`......-.....`.................................<...O.... .......................@...... ................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................p.......H....... /..............................................................2r...p(....&....0..Z.......s......rg..p~....o.....ry..p.o.....r...p~....o....~....~.....(......o....s....o.....o.......0..V.......s......rg..p.o.....ry..p.o.....r...p~....o....~....~.....(......o....s....o.....o.......0..R.......s......rg..p.o.....ry..p.o.....r...p~....o.....~.....(......o....s....o.....o.......0.............s....%o..........%....io....&o....s......r...p.o.....r...p.o.....r...p....s.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.994565048487039
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RP.sfx.exe
File size:	10'504'001 bytes
MD5:	e335f71c0f053c393626691bd60a58a4
SHA1:	0cc99df70cca24c5f96edf36672ea297fe71043f
SHA256:	af0c48ca1ed3431b936d489bf1e8255a5d4182bd6164946bd6179ae3f212d0b1
SHA512:	eaa5b09100e133cd7241258255c02be262d3f6061774f9d32424922aaae8fa04d148f665d7c61c6f7ac1f1a23e87994b7bc6b0ba7fdd2fd0fa2d4575ac460195
SSDEEP:	196608:uchhf7FHaM6MkwG2ea8oQoidqpcO49UEahKBXSmLnS0rCqs2vm9EGgy:dvfBdPG2QzoY1OgUEPV7r9s2+9bgy
TLSH:	C0B63337B1E69D71C57304322FD4A1B43A38BD2657690CE74350B98F8CB8AD2BB2475A
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......#.=lgwS?gwS?gwS?...?jwS?...?.wS?...?.wS?...?ewS?..W>twS?..P>qwS?..V>UwS?n..?lwS?n..?`wS?gwR?ovS?..V>AwS?..S>fwS?...?fwS?..Q>fwS

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x416f40
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x651BC7FC [Tue Oct 3 07:51:24 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	319b1edcc4538be377f43066c635ffef

Entrypoint Preview

Instruction
call 00007F1768C8D751h
jmp 00007F1768C8D0EDh
jmp 00007F1768C917CFh
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F1768C8C703h
push 00432B44h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F1768C8DF5Ah
int3
push ebp
mov ebp, esp
and dword ptr [0046A5D8h], 00000000h
sub esp, 24h
or dword ptr [00435684h], 01h
push 0000000Ah
call dword ptr [0042A180h]
test eax, eax
je 00007F1768C8D422h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-1Ch]
xor eax, 6C65746Eh
mov dword ptr [ebp-08h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
or eax, dword ptr [ebp-08h]
or eax, edi
mov dword ptr [ebx+04h], esi
mov dword ptr [ebx+08h], ecx
mov dword ptr [ebx+0Ch], edx
jne 00007F1768C8D2B5h
mov eax, dword ptr [ebp-24h]
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007F1768C8D295h

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x33a70	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x33aa4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6c000	0xe044	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7b000	0x2a70	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x31e40	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2c340	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x230	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x33094	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28f0c	0x29000	False	0.5828946741615854	data	6.691649887148511	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0xa73e	0xa800	False	0.4587286086309524	data	5.245780169300487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x35cb8	0x1000	False	0.4140625	DOS executable (block device driver w{\362ko\3050)	4.15726616677493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x6b000	0x178	0x200	False	0.43359375	data	3.2160543236862766	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6c000	0xe044	0xe200	False	0.6344026548672567	data	6.802485077360432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7b000	0x2a70	0x2c00	False	0.7676669034090909	data	6.663559199510513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x6c644	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x6d18c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x6e738	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	0.47832369942196534
RT_ICON	0x6eca0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	0.5410649819494585
RT_ICON	0x6f548	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	0.4933368869936034
RT_ICON	0x703f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	0.5390070921985816
RT_ICON	0x70858	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.41393058161350843
RT_ICON	0x71900	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	0.3479253112033195
RT_ICON	0x73ea8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9809269502193401
RT_DIALOG	0x77c1c	0x2ba	data	0.5286532951289399
RT_DIALOG	0x77ed8	0x13a	data	0.6560509554140127
RT_DIALOG	0x78014	0xf2	data	0.71900826446281
RT_DIALOG	0x78108	0x14a	data	0.6
RT_DIALOG	0x78254	0x314	data	0.47588832487309646
RT_DIALOG	0x78568	0x24a	data	0.6279863481228669
RT_STRING	0x787b4	0x1fc	data	0.421259842519685
RT_STRING	0x789b0	0x246	data	0.41924398625429554
RT_STRING	0x78bf8	0x1a6	data	0.514218009478673
RT_STRING	0x78da0	0xdc	data	0.65
RT_STRING	0x78e7c	0x470	data	0.3873239436619718
RT_STRING	0x792ec	0x164	data	0.5056179775280899
RT_STRING	0x79450	0x110	data	0.5772058823529411
RT_STRING	0x79560	0x158	data	0.4563953488372093
RT_STRING	0x796b8	0xe8	data	0.5948275862068966
RT_STRING	0x797a0	0xe6	data	0.5695652173913044
RT_GROUP_ICON	0x79888	0x68	data	0.7019230769230769
RT_MANIFEST	0x798f0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, FormatMessageW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileTime, CloseHandle, CreateFileW, GetCurrentProcessId, CreateDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, MoveFileW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetTimeFormatW, GetDateFormatW, LocalFree, GetCurrentProcess, GetExitCodeProcess, WaitForSingleObject, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, GetOEMCP, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetCommandLineA
OLEAUT32.dll	VariantClear
gdiplus.dll	GdipCreateBitmapFromStream, GdipAlloc, GdipCloneImage, GdipDisposeImage, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2023 01:32:58.028712988 CET	49729	443	192.168.2.4	172.67.160.84
Nov 26, 2023 01:32:58.028743029 CET	443	49729	172.67.160.84	192.168.2.4
Nov 26, 2023 01:32:58.028819084 CET	49729	443	192.168.2.4	172.67.160.84
Nov 26, 2023 01:32:58.050849915 CET	49729	443	192.168.2.4	172.67.160.84
Nov 26, 2023 01:32:58.050873995 CET	443	49729	172.67.160.84	192.168.2.4
Nov 26, 2023 01:32:58.320312977 CET	443	49729	172.67.160.84	192.168.2.4
Nov 26, 2023 01:32:58.320400953 CET	49729	443	192.168.2.4	172.67.160.84
Nov 26, 2023 01:32:58.325812101 CET	49729	443	192.168.2.4	172.67.160.84
Nov 26, 2023 01:32:58.325834990 CET	443	49729	172.67.160.84	192.168.2.4
Nov 26, 2023 01:32:58.327872992 CET	443	49729	172.67.160.84	192.168.2.4
Nov 26, 2023 01:32:58.373779058 CET	49729	443	192.168.2.4	172.67.160.84
Nov 26, 2023 01:32:58.440526962 CET	49729	443	192.168.2.4	172.67.160.84
Nov 26, 2023 01:32:58.485260963 CET	443	49729	172.67.160.84	192.168.2.4
Nov 26, 2023 01:32:58.604873896 CET	443	49729	172.67.160.84	192.168.2.4
Nov 26, 2023 01:32:58.604938030 CET	443	49729	172.67.160.84	192.168.2.4
Nov 26, 2023 01:32:58.605012894 CET	49729	443	192.168.2.4	172.67.160.84
Nov 26, 2023 01:32:58.609458923 CET	49729	443	192.168.2.4	172.67.160.84
Nov 26, 2023 01:32:58.741602898 CET	49730	443	192.168.2.4	104.21.85.189
Nov 26, 2023 01:32:58.741647005 CET	443	49730	104.21.85.189	192.168.2.4
Nov 26, 2023 01:32:58.741733074 CET	49730	443	192.168.2.4	104.21.85.189
Nov 26, 2023 01:32:58.742470980 CET	49730	443	192.168.2.4	104.21.85.189
Nov 26, 2023 01:32:58.742482901 CET	443	49730	104.21.85.189	192.168.2.4
Nov 26, 2023 01:32:59.006951094 CET	443	49730	104.21.85.189	192.168.2.4
Nov 26, 2023 01:32:59.007023096 CET	49730	443	192.168.2.4	104.21.85.189
Nov 26, 2023 01:32:59.010396957 CET	49730	443	192.168.2.4	104.21.85.189
Nov 26, 2023 01:32:59.010406017 CET	443	49730	104.21.85.189	192.168.2.4
Nov 26, 2023 01:32:59.010704041 CET	443	49730	104.21.85.189	192.168.2.4
Nov 26, 2023 01:32:59.012403965 CET	49730	443	192.168.2.4	104.21.85.189
Nov 26, 2023 01:32:59.057262897 CET	443	49730	104.21.85.189	192.168.2.4
Nov 26, 2023 01:32:59.331665039 CET	443	49730	104.21.85.189	192.168.2.4
Nov 26, 2023 01:32:59.331705093 CET	443	49730	104.21.85.189	192.168.2.4
Nov 26, 2023 01:32:59.331758976 CET	443	49730	104.21.85.189	192.168.2.4
Nov 26, 2023 01:32:59.331778049 CET	49730	443	192.168.2.4	104.21.85.189
Nov 26, 2023 01:32:59.331792116 CET	443	49730	104.21.85.189	192.168.2.4
Nov 26, 2023 01:32:59.331852913 CET	443	49730	104.21.85.189	192.168.2.4
Nov 26, 2023 01:32:59.331911087 CET	49730	443	192.168.2.4	104.21.85.189
Nov 26, 2023 01:32:59.341557980 CET	49730	443	192.168.2.4	104.21.85.189

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2023 01:32:57.891273975 CET	52654	53	192.168.2.4	1.1.1.1
Nov 26, 2023 01:32:58.020195961 CET	53	52654	1.1.1.1	192.168.2.4
Nov 26, 2023 01:32:58.613147020 CET	55300	53	192.168.2.4	1.1.1.1
Nov 26, 2023 01:32:58.740051985 CET	53	55300	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2023 01:32:57.891273975 CET	192.168.2.4	1.1.1.1	0x5613	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)	false
Nov 26, 2023 01:32:58.613147020 CET	192.168.2.4	1.1.1.1	0x7473	Standard query (0)	ipbase.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 26, 2023 01:32:58.020195961 CET	1.1.1.1	192.168.2.4	0x5613	No error (0)	freegeoip.app	172.67.160.84	A (IP address)	IN (0x0001)	false
Nov 26, 2023 01:32:58.020195961 CET	1.1.1.1	192.168.2.4	0x5613	No error (0)	freegeoip.app	104.21.73.97	A (IP address)	IN (0x0001)	false
Nov 26, 2023 01:32:58.740051985 CET	1.1.1.1	192.168.2.4	0x7473	No error (0)	ipbase.com	104.21.85.189	A (IP address)	IN (0x0001)	false
Nov 26, 2023 01:32:58.740051985 CET	1.1.1.1	192.168.2.4	0x7473	No error (0)	ipbase.com	172.67.209.71	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

freegeoip.app

ipbase.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	172.67.160.84	443	6660	C:\Users\user\Desktop\RESOURCEPACK\RP.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-26 00:32:58 UTC	67	OUT	GET /xml/ HTTP/1.1 Host: freegeoip.app Connection: Keep-Alive
2023-11-26 00:32:58 UTC	623	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 32 36 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 33 32 3a 35 38 20 47 4d 54 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6d 61 78 2d 61 67 65 3d 33 36 30 30 0d 0a 45 78 70 69 72 65 73 3a 20 53 75 6e 2c 20 32 36 20 4e 6f 76 20 32 30 32 33 20 30 31 3a 33 32 3a 35 38 20 47 4d 54 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 69 70 62 61 73 65 2e 63 6f 6d 2f 78 6d 6c 2f 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 Data Ascii: HTTP/1.1 301 Moved PermanentlyDate: Sun, 26 Nov 2023 00:32:58 GMTTransfer-Encoding: chunkedConnection: closeCache-Control: max-age=3600Expires: Sun, 26 Nov 2023 01:32:58 GMTLocation: https://ipbase.com/xml/Report-To: {"endpoints":[{"url":"ht
2023-11-26 00:32:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49730	104.21.85.189	443	6660	C:\Users\user\Desktop\RESOURCEPACK\RP.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-26 00:32:59 UTC	64	OUT	GET /xml/ HTTP/1.1 Host: ipbase.com Connection: Keep-Alive
2023-11-26 00:32:59 UTC	700	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 32 36 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 33 32 3a 35 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 67 65 3a 20 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 6d 61 78 2d 61 67 65 3d 30 2c 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 4e 66 2d 52 65 71 75 65 73 74 2d 49 64 3a 20 30 31 48 47 34 47 50 44 54 43 Data Ascii: HTTP/1.1 404 Not FoundDate: Sun, 26 Nov 2023 00:32:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeAge: 0Cache-Control: public,max-age=0,must-revalidateVary: Accept-EncodingX-Nf-Request-Id: 01HG4GPDTC
2023-11-26 00:32:59 UTC	669	IN	Data Raw: 63 30 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d Data Ascii: c0a<!DOCTYPE html><html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"> <title>Page Not Found</title> <link href='https://fonts.googleapis.com
2023-11-26 00:32:59 UTC	1369	IN	Data Raw: 30 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 32 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 6d 61 69 6e 20 7b 0a 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 76 77 3b 0a 20 20 20 20 7d 0a 0a 20 20 Data Ascii: 0; font-size: 22px; line-height: 24px; } .main { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; height: 100vh; width: 100vw; }
2023-11-26 00:32:59 UTC	1051	IN	Data Raw: 33 36 2c 34 2e 30 39 33 37 30 38 30 33 20 4c 38 2e 35 35 38 30 39 35 31 37 2c 37 2e 34 33 32 39 34 39 35 33 20 43 38 2e 32 33 35 33 31 34 35 39 2c 37 2e 37 34 36 31 31 32 39 38 20 38 2e 32 33 35 33 31 34 35 39 2c 38 2e 32 35 33 38 38 37 33 36 20 38 2e 35 35 38 30 39 35 31 37 2c 38 2e 35 36 36 39 33 37 36 39 20 4c 31 32 2c 31 31 2e 39 30 36 32 39 32 31 20 4c 39 2e 38 34 31 38 37 38 37 31 2c 31 34 20 4c 34 2e 32 34 32 30 38 35 34 34 2c 38 2e 35 36 36 39 33 37 35 31 20 43 33 2e 39 31 39 33 30 34 38 35 2c 38 2e 32 35 33 38 38 37 31 39 20 33 2e 39 31 39 33 30 34 38 35 2c 37 2e 37 34 36 31 31 32 38 31 20 34 2e 32 34 32 30 38 35 34 34 2c 37 2e 34 33 32 39 34 39 33 36 20 4c 39 2e 38 34 31 39 39 35 33 31 2c 32 20 4c 31 31 2e 39 39 39 38 38 33 36 2c 34 2e 30 39 33 Data Ascii: 36,4.09370803 L8.55809517,7.43294953 C8.23531459,7.74611298 8.23531459,8.25388736 8.55809517,8.56693769 L12,11.9062921 L9.84187871,14 L4.24208544,8.56693751 C3.91930485,8.25388719 3.91930485,7.74611281 4.24208544,7.43294936 L9.84199531,2 L11.9998836,4.093
2023-11-26 00:32:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:32:55
Start date:	26/11/2023
Path:	C:\Users\user\Desktop\RP.sfx.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\RP.sfx.exe
Imagebase:	0x5d0000
File size:	10'504'001 bytes
MD5 hash:	E335F71C0F053C393626691BD60A58A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_44CaliberStealer, Description: Yara detected 44Caliber Stealer, Source: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:32:56
Start date:	26/11/2023
Path:	C:\Users\user\Desktop\RESOURCEPACK\RP.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RESOURCEPACK\RP.EXE"
Imagebase:	0x192d19b0000
File size:	257'024 bytes
MD5 hash:	513286E3E241F1C93556F45DB4F8DC23
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000001.00000002.1694023310.00000192D36D1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: 00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_44CaliberStealer, Description: Yara detected 44Caliber Stealer, Source: 00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000001.00000000.1651762956.00000192D19B2000.00000002.00000001.01000000.00000009.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: Joe Security Rule: JoeSecurity_44CaliberStealer, Description: Yara detected 44Caliber Stealer, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: C:\Users\user\Desktop\RESOURCEPACK\RP.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 78%, ReversingLabs Detection: 57%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:32:56
Start date:	26/11/2023
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\RESOURCEPACK\RP.7Z
Imagebase:	0x9c0000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:32:56
Start date:	26/11/2023
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ubt3pxhd.eyu" "C:\Users\user\Desktop\RESOURCEPACK\RP.7Z
Imagebase:	0x10000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:32:56
Start date:	26/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.2%
Total number of Nodes:	1593
Total number of Limit Nodes:	58

Executed Functions

Function 005E3F67 Relevance: 47.7, APIs: 22, Strings: 5, Instructions: 453
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005E2B3D: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 005E2C27

Part of subcall function 005E1CFD: GetCurrentDirectoryW.KERNEL32(?,?), ref: 005E1D05

SetFileAttributesW.KERNEL32(?,00000000,?,?,?,00000800,?,B0DADE4A,?,00000000,00000001), ref: 005E40B3
_wcslen.LIBCMT ref: 005E40ED
_wcslen.LIBCMT ref: 005E4101
_wcslen.LIBCMT ref: 005E4126
GetFileAttributesW.KERNEL32(?), ref: 005E416C
DeleteFileW.KERNEL32(?), ref: 005E417E
_swprintf.LIBCMT ref: 005E41A3
GetFileAttributesW.KERNEL32(?), ref: 005E41B2
MoveFileW.KERNEL32(?,?), ref: 005E41CB
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 005E41DF
_wcslen.LIBCMT ref: 005E425A
_wcslen.LIBCMT ref: 005E4263
SetWindowTextW.USER32(?,?), ref: 005E42C2

Strings

ProgramFilesDir, xrefs: 005E4396
e^^, xrefs: 005E415F
%s.%d.tmp, xrefs: 005E4196
Software\Microsoft\Windows\CurrentVersion, xrefs: 005E436B
<br>, xrefs: 005E4224

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: File$_wcslen$Attributes$Move$CurrentDeleteDirectoryEnvironmentExpandStringsTextWindow_swprintf
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$e^^
API String ID: 2983673336-2812199591
Opcode ID: 4fe9ef582591dec9e64b336db6560cc6462071119e9a6597772fa83ec96d0a22
Instruction ID: 3b12742021d1a277ecedb27419d977861afe8dcda81ea38f985ddecdcb8e43bb
Opcode Fuzzy Hash: 4fe9ef582591dec9e64b336db6560cc6462071119e9a6597772fa83ec96d0a22
Instruction Fuzzy Hash: EDF18372900299AADB38EFA5DC49EEF3BBCBF48310F14052AF949D7140EB749A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 005E5833 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 208
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005D7316: GetModuleHandleW.KERNEL32 ref: 005D7343
Part of subcall function 005D7316: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005D7355
Part of subcall function 005D7316: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 005D737F

Part of subcall function 005E1CFD: GetCurrentDirectoryW.KERNEL32(?,?), ref: 005E1D05

Part of subcall function 005E23FB: OleInitialize.OLE32(00000000), ref: 005E2414
Part of subcall function 005E23FB: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 005E244B
Part of subcall function 005E23FB: SHGetMalloc.SHELL32(00620958), ref: 005E2455

GetCommandLineW.KERNEL32 ref: 005E5880
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 005E58AA
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007402), ref: 005E58BB
UnmapViewOfFile.KERNEL32(00000000), ref: 005E590C

Part of subcall function 005E54D0: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 005E54F1
Part of subcall function 005E54D0: SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 005E552B

Part of subcall function 005D612B: _wcslen.LIBCMT ref: 005D614F

CloseHandle.KERNEL32(00000000), ref: 005E5913
GetModuleFileNameW.KERNEL32(00000000,00637220,00000800), ref: 005E592D
SetEnvironmentVariableW.KERNELBASE(sfxname,00637220), ref: 005E5939
GetLocalTime.KERNEL32(?), ref: 005E5944
_swprintf.LIBCMT ref: 005E5998
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 005E59AD
GetModuleHandleW.KERNEL32(00000000), ref: 005E59B4
LoadIconW.USER32(00000000,00000064), ref: 005E59CB
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00013040,00000000), ref: 005E5A1C
Sleep.KERNEL32(?), ref: 005E5A4A
DeleteObject.GDI32 ref: 005E5A83
DeleteObject.GDI32(?), ref: 005E5A93
CloseHandle.KERNEL32 ref: 005E5AD6

Strings

STARTDLG, xrefs: 005E5A11
sfxstime, xrefs: 005E59A8
winrarsfxmappingfile.tmp, xrefs: 005E589E
sfxname, xrefs: 005E5934
zyb, xrefs: 005E58EB
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 005E5989
rc, xrefs: 005E5926

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf_wcslen
String ID: rc$%4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$zyb
API String ID: 3014515783-2180176422
Opcode ID: b5e82257bb7d2ecaeedecc6bcd97f96600c7e5333d95dc0610592f741ad212c4
Instruction ID: c8e98737fac47a722bc1f79a7562a80f574f954a00dfb637e7f090b98b6771b1
Opcode Fuzzy Hash: b5e82257bb7d2ecaeedecc6bcd97f96600c7e5333d95dc0610592f741ad212c4
Instruction Fuzzy Hash: EE71E2B1500B85AFD334AB66EC49F7B3FADFB84744F001815F585D21A2EB789844CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 005E1D72 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,005E2F9D,00000066), ref: 005E1D85
SizeofResource.KERNEL32(00000000,?,?,?,005E2F9D,00000066), ref: 005E1D9C
LoadResource.KERNEL32(00000000,?,?,?,005E2F9D,00000066), ref: 005E1DB3
LockResource.KERNEL32(00000000,?,?,?,005E2F9D,00000066), ref: 005E1DC2
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,005E2F9D,00000066), ref: 005E1DDD
GlobalLock.KERNEL32(00000000,?,?,?,?,?,005E2F9D,00000066), ref: 005E1DEE
GlobalUnlock.KERNEL32(00000000), ref: 005E1E76

Part of subcall function 005E1CD6: GdipAlloc.GDIPLUS(00000010), ref: 005E1CDC

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 005E1E57
GlobalFree.KERNEL32(00000000), ref: 005E1E7D

Strings

PNG, xrefs: 005E1D76

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: b413d2ad54c11e6797e7008c62f05f3c04c443caf70a3bf45e481d807eb7ea83
Instruction ID: 67796e981ff5f07f8fdafa7a9609ddb9cb2ef9701def3d824e2fa01c17090083
Opcode Fuzzy Hash: b413d2ad54c11e6797e7008c62f05f3c04c443caf70a3bf45e481d807eb7ea83
Instruction Fuzzy Hash: 7B3190B5204742AFD7249F22EC4C92B7EADFF847907040969FD49C2221DF35DC04DAA6

Uniqueness

Uniqueness Score: -1.00%

Function 005D4783 Relevance: 16.4, APIs: 3, Strings: 6, Instructions: 684COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000800,B0DADE4A), ref: 005D47ED

Part of subcall function 005D4029: _wcslen.LIBCMT ref: 005D4031

Part of subcall function 005D704F: _wcslen.LIBCMT ref: 005D7055

Part of subcall function 005D8111: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,005D3C83,00000000,?,?), ref: 005D812D

_wcslen.LIBCMT ref: 005D4B20
__fprintf_l.LIBCMT ref: 005D4C70

Strings

RTL, xrefs: 005D4C32
*messages***, xrefs: 005D48F1
,, xrefs: 005D4CAB
@%s:, xrefs: 005D4C5A, 005D4C66
*messages***, xrefs: 005D492A
$%s:, xrefs: 005D4C53

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _wcslen$ByteCharFileModuleMultiNameWide__fprintf_l
String ID: ,$$%s:$*messages***$*messages***$@%s:$RTL
API String ID: 2646189078-285229759
Opcode ID: 5d18cf08b85e4c8ed2358fce58d062478ad245fd2fdbdaeae7d063a307da7eb8
Instruction ID: a3511a015ea2c5db8a47c5aa8c94737f90e6793d32664cb3dfb687924d0dbb57
Opcode Fuzzy Hash: 5d18cf08b85e4c8ed2358fce58d062478ad245fd2fdbdaeae7d063a307da7eb8
Instruction Fuzzy Hash: 6942E2B190025AABDF34EFA8C845AEEBBB5FF58710F04042BE505AB391E7719940CF65

Uniqueness

Uniqueness Score: -1.00%

Function 005D3230 Relevance: 7.6, APIs: 5, Instructions: 111
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,005D3127,000000FF,?,?), ref: 005D326E

Part of subcall function 005D3C9D: _wcslen.LIBCMT ref: 005D3CD8

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,005D3127,000000FF,?,?), ref: 005D329E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,005D3127,000000FF,?,?), ref: 005D32AA
FindNextFileW.KERNEL32(?,?,?,?,?,?,005D3127,000000FF,?,?), ref: 005D32D1
GetLastError.KERNEL32(?,?,?,?,005D3127,000000FF,?,?), ref: 005D32DD

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 71d1d6e321097b79701ee5801c9bdd4789d5e076659c4c695a704056a5a20334
Instruction ID: b1fc10d812632170703df7b5a1697d38d65820b46776c39084ba21205bb0b17f
Opcode Fuzzy Hash: 71d1d6e321097b79701ee5801c9bdd4789d5e076659c4c695a704056a5a20334
Instruction Fuzzy Hash: 35416575508645AFC324DF28D888AEAF7E8BB88340F00091FF599D3350E775A958DB92

Uniqueness

Uniqueness Score: -1.00%

Function 005DAA76 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005DAB3B

Strings

ytesWritten, xrefs: 005DAC78, 005DAD68, 005DAD6D, 005DAD87
LOa, xrefs: 005DAC85, 005DACD0, 005DACE6, 005DACF4
RP.exe, xrefs: 005DAAB6, 005DAAD2, 005DAAE1, 005DAB05, 005DAC15, 005DAC37, 005DAD91, 005DAEDC, 005DAF51

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: LOa$RP.exe$ytesWritten
API String ID: 885266447-2310270233
Opcode ID: 04550d356b4deddbffcb2bd5291b917517c7eb691c1b82c0e15e1e284bfc37db
Instruction ID: 00550806a0a35c34ed5df258ab1364308dde2468cb4b810d98b46dca225ce9ef
Opcode Fuzzy Hash: 04550d356b4deddbffcb2bd5291b917517c7eb691c1b82c0e15e1e284bfc37db
Instruction Fuzzy Hash: F6D1CF715442429FEB35EF2CEC5966B3FA7FBA9310F08952BE445833A2DB705841CB92

Uniqueness

Uniqueness Score: -1.00%

Function 005EF3F2 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(005F03B2,?,005EF3C8,005F03B2,00602D88,0000000C,005EF51F,005F03B2,00000002,00000000,?,005F03B2), ref: 005EF413
TerminateProcess.KERNEL32(00000000,?,005EF3C8,005F03B2,00602D88,0000000C,005EF51F,005F03B2,00000002,00000000,?,005F03B2), ref: 005EF41A
ExitProcess.KERNEL32 ref: 005EF42C

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1d55273b25fe83c78bbeb4ed4692498c58f7c5f1de4027bbf72cea5ed65ccb2a
Instruction ID: 1462ad2ec54ee3be2e8f4411982a83367e14199898d59a128997fa88b621f92c
Opcode Fuzzy Hash: 1d55273b25fe83c78bbeb4ed4692498c58f7c5f1de4027bbf72cea5ed65ccb2a
Instruction Fuzzy Hash: A0E04F71000148ABCF026F55DC0CA5A3F69FB94341F404420F848C6171CF39ED45DB41

Uniqueness

Uniqueness Score: -1.00%

Function 005DC084 Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

c, xrefs: 005DC3A5

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: 1bda7f7c14430c92aa2cfe82c560353880068b2c4e3efae19898efef9e5d416d
Instruction ID: 5f71061800c2645b10da3dd53d501ccd56757684285d2fdce0177fb207e99409
Opcode Fuzzy Hash: 1bda7f7c14430c92aa2cfe82c560353880068b2c4e3efae19898efef9e5d416d
Instruction Fuzzy Hash: 32E12575A083528FC724DF6CD580A6AFBE1BBC9308F104A2FE59A97351D630E945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 005E3040 Relevance: 97.0, APIs: 47, Strings: 8, Instructions: 746windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005D11F6: GetDlgItem.USER32(00000000,00003021), ref: 005D123A
Part of subcall function 005D11F6: SetWindowTextW.USER32(00000000,005FA584), ref: 005D1250

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 005E3166
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005E3184
IsDialogMessageW.USER32(?,?), ref: 005E3197
TranslateMessage.USER32(?), ref: 005E31A5
DispatchMessageW.USER32(?), ref: 005E31AF
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 005E31D2
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 005E31F5
GetDlgItem.USER32(?,00000068), ref: 005E3218
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 005E3233
SendMessageW.USER32(00000000,000000C2,00000000,005FA584), ref: 005E3246

Part of subcall function 005E4CDB: _wcslen.LIBCMT ref: 005E4D05

SetFocus.USER32(00000000), ref: 005E324D
_swprintf.LIBCMT ref: 005E32AC

Part of subcall function 005D30BD: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005D30D0

GetLastError.KERNEL32(00000000,00000000,00000000,?,00000800), ref: 005E330F
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000800), ref: 005E3337
GetTickCount.KERNEL32 ref: 005E3355
_swprintf.LIBCMT ref: 005E336D
GetLastError.KERNEL32(?,00000011), ref: 005E339F
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,00000000,00000000,00000000,?,00000800), ref: 005E33F2
_swprintf.LIBCMT ref: 005E3429
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007402,winrarsfxmappingfile.tmp,?,?,?,?,0062797A,00000200), ref: 005E347D
GetCommandLineW.KERNEL32(?,?,?,?,0062797A,00000200), ref: 005E3493
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,0062797A,00000400,00000001,00000001,?,?,?,?,0062797A,00000200), ref: 005E34EA
ShellExecuteExW.SHELL32(?), ref: 005E3512
Sleep.KERNEL32(00000064,?,?,?,?,0062797A,00000200), ref: 005E355A
UnmapViewOfFile.KERNEL32(?,?,0000421C,0062797A,00000400,?,?,?,?,0062797A,00000200), ref: 005E3583
CloseHandle.KERNEL32(?,?,?,?,?,0062797A,00000200), ref: 005E358C
_swprintf.LIBCMT ref: 005E35BF
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 005E361E
SetDlgItemTextW.USER32(?,00000065,005FA584), ref: 005E3635
GetDlgItem.USER32(?,00000065), ref: 005E363E
GetWindowLongW.USER32(00000000,000000F0), ref: 005E364D
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 005E365C
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 005E3709
_wcslen.LIBCMT ref: 005E375F
_swprintf.LIBCMT ref: 005E3789
SendMessageW.USER32(?,00000080,00000001,?), ref: 005E37D3
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 005E37ED
GetDlgItem.USER32(?,00000068), ref: 005E37F6
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 005E380C
GetDlgItem.USER32(?,00000066), ref: 005E3826
SetWindowTextW.USER32(00000000,00629D9A), ref: 005E3848
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 005E389D
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 005E38B0
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_00012E20,00000000,?), ref: 005E3953
EnableWindow.USER32(00000000,00000000), ref: 005E3A21
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 005E3A63
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 005E3A87

Strings

STARTDLG, xrefs: 005E308D
-el -s2 "-d%s" "-sp%s", xrefs: 005E3418
__tmp_rar_sfx_access_check_%u, xrefs: 005E335C
PDue^^, xrefs: 005E3512
winrarsfxmappingfile.tmp, xrefs: 005E3453
%s, xrefs: 005E3779
LICENSEDLG, xrefs: 005E3948
"%s"%s, xrefs: 005E35AE

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Item$MessageText$Send$Window_swprintf$File$ErrorLast$DialogLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$LICENSEDLG$PDue^^$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3247240745-1969214017
Opcode ID: a60c314818285c6de7ff389b901862ac9d74721e0eff348bbb4281f9f9e40a46
Instruction ID: d0cff9da65978df1cbdb33839ce8fc414c636c6fa402ebfcb6abd80081b5c92f
Opcode Fuzzy Hash: a60c314818285c6de7ff389b901862ac9d74721e0eff348bbb4281f9f9e40a46
Instruction Fuzzy Hash: 5F42F3B1940785BAFB34AB65DC4EFBE3F69BB41700F001416F685A71D2CBB44A45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005D7316 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 327
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 005D7343
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005D7355
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 005D737F
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 005D7629
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005D7643
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005D7657
ReadFile.KERNEL32(00000000,?,00007FFE,005FA888,00000000), ref: 005D7675
CloseHandle.KERNEL32(00000000), ref: 005D76D9
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 005D76F2
CompareStringW.KERNEL32(00000400,00001001,005FA8D4,?,DXGIDebug.dll,?,005FA888,?,00000000,?,00000800), ref: 005D7746
GetFileAttributesW.KERNELBASE(?,?,005FA888,00000800,?,00000000,?,00000800), ref: 005D7770
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 005D77AC

Part of subcall function 005D72B7: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005D72E0
Part of subcall function 005D72B7: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0060F038,?,005D6013,Crypt32.dll,00000000,005D608D,?,?,005D6070,00000000), ref: 005D7300

_swprintf.LIBCMT ref: 005D781E
_swprintf.LIBCMT ref: 005D786A
AllocConsole.KERNEL32 ref: 005D7872
GetCurrentProcessId.KERNEL32 ref: 005D787C
AttachConsole.KERNEL32(00000000), ref: 005D7883
_wcslen.LIBCMT ref: 005D7898
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 005D78A9
WriteConsoleW.KERNEL32(00000000), ref: 005D78B0
Sleep.KERNEL32(00002710), ref: 005D78BB
FreeConsole.KERNEL32 ref: 005D78C1
ExitProcess.KERNEL32 ref: 005D78C9

Strings

SetDllDirectoryW, xrefs: 005D734F
dwmapi.dll, xrefs: 005D73E5, 005D77E1
SetDefaultDllDirectories, xrefs: 005D7379
DXGIDebug.dll, xrefs: 005D73BA, 005D7732
uxtheme.dll, xrefs: 005D77EB
kernel32, xrefs: 005D7339
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 005D7858

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 270162209-3298887752
Opcode ID: f66680dd887c0f4cee38d70857f64e76af38ad5db3bdfe2626264620cce0d04d
Instruction ID: e86a89f609d97c1978819a07bc396c53b25f3dfd798a5f1a52c12176d3301ae0
Opcode Fuzzy Hash: f66680dd887c0f4cee38d70857f64e76af38ad5db3bdfe2626264620cce0d04d
Instruction Fuzzy Hash: 45D15FF10083899BD7319F54D84DAAFBFE8BB88344F10491EF68D96240DBB89548CB63

Uniqueness

Uniqueness Score: -1.00%

Function 005E4D5C Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 103
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005E2DC4: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005E2DD5
Part of subcall function 005E2DC4: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005E2DE6
Part of subcall function 005E2DC4: IsDialogMessageW.USER32(?,?), ref: 005E2DFA
Part of subcall function 005E2DC4: TranslateMessage.USER32(?), ref: 005E2E08
Part of subcall function 005E2DC4: DispatchMessageW.USER32(?), ref: 005E2E12

GetDlgItem.USER32(00000068,00638258), ref: 005E4D7F
ShowWindow.USER32(00000000,00000005,?,?,?,?,005E2746,00000001,?,?,005E301A,005FBDA0,00638258,00638258,00001000,00000000), ref: 005E4DA4
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 005E4DB3
SendMessageW.USER32(00000000,000000C2,00000000,005FA584), ref: 005E4DC1
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 005E4DDB
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 005E4DF5
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 005E4E39
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 005E4E44
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 005E4E57
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 005E4E7E
SendMessageW.USER32(00000000,000000C2,00000000,005FAF2C), ref: 005E4E8D

Strings

\, xrefs: 005E4DE5

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 6b92bb8d5c01db7a6e6b9847d9900ecee678c7122fae10f09683d62aaa44b257
Instruction ID: e31de189d98b6d87d51b9ffa13bdc0cb31d2feb4f475cf2a10eaee593776edfe
Opcode Fuzzy Hash: 6b92bb8d5c01db7a6e6b9847d9900ecee678c7122fae10f09683d62aaa44b257
Instruction Fuzzy Hash: AB3122B1245B40AFF3149F20DC89FAF7FADEB45304F002509F6A69A1E1C7A449488BE6

Uniqueness

Uniqueness Score: -1.00%

Function 005D96BF Relevance: 18.9, APIs: 4, Strings: 6, Instructions: 1417COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005D9C5D
__allrem.LIBCMT ref: 005D9EE5
__allrem.LIBCMT ref: 005D9F68
_wcslen.LIBCMT ref: 005DA770

Strings

zip, xrefs: 005D9DED, 005D9DF7
zx01, xrefs: 005D9D14
z01, xrefs: 005D9D1B, 005D9D25
RP.exe, xrefs: 005D98A0, 005D997F, 005D998A, 005D9996, 005D9997, 005D9A3F, 005D9B2A, 005D9BE3, 005D9C58, 005D9C64, 005D9CA7, 005DA163, 005DA18A, 005DA218, 005DA222, 005DA230, 005DA231, 005DA2AE, 005DA2C7, 005DA2CD, 005DA30F, 005DA310, 005DA40C, 005DA5FF, 005DA628, 005DA636, 005DA696, 005DA6BB, 005DA6D3, 005DA6E7, 005DA6FC, 005DA706, 005DA76B, 005DA777, 005DA805, 005DA894, 005DA8E3
AES-0017, xrefs: 005D9B25
zipx, xrefs: 005D9DE6

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: __allrem_wcslen
String ID: AES-0017$RP.exe$z01$zip$zipx$zx01
API String ID: 3773243035-2143499594
Opcode ID: 5361b494c6e8859321c2dac5c745e0cee889b1ab2eea3fc87fc76ea9cdd5981f
Instruction ID: 09511ede14b9bdf69c41ca5e4a5a24c3e557e79f0c1f422ab5a2b452d0d355c8
Opcode Fuzzy Hash: 5361b494c6e8859321c2dac5c745e0cee889b1ab2eea3fc87fc76ea9cdd5981f
Instruction Fuzzy Hash: BDC2AB71A002169FDB34DF68DC85AEE7BB6FB98300F18546BE805E73A1D7709981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005E505C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 005E5095
ShellExecuteExW.SHELL32(?), ref: 005E51D8
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 005E5210
GetExitCodeProcess.KERNEL32(?,?), ref: 005E524C
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 005E5272
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 005E52D8

Strings

.inf, xrefs: 005E5194
PDue^^, xrefs: 005E51D8
.exe, xrefs: 005E527C

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf$PDue^^
API String ID: 36480843-2337821732
Opcode ID: f0eb57ed1e206b7b6f3ee01db04d944f3444d916d0d052682e16e39ab7dbf3d6
Instruction ID: c94641b22e6e8aab9b02aec45a252ea8e3e1e1f257184ef2e4bd6363feb6858e
Opcode Fuzzy Hash: f0eb57ed1e206b7b6f3ee01db04d944f3444d916d0d052682e16e39ab7dbf3d6
Instruction Fuzzy Hash: F461BE74508BC19ED7389F2698446ABBFE5BB84748F04481EF6C497291FBB08D49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 005F1DA4 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,005ECD8E,005ECD8E,?,?,?,005F1FF5,00000001,00000001,F4E85006), ref: 005F1DFE
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,005F1FF5,00000001,00000001,F4E85006,?,?,?), ref: 005F1E84
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,F4E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 005F1F7E
__freea.LIBCMT ref: 005F1F8B

Part of subcall function 005F0A15: RtlAllocateHeap.NTDLL(00000000,?,?,?,005EB819,?,0000015D,?,?,?,?,005ECCF5,000000FF,00000000,?,?), ref: 005F0A47

__freea.LIBCMT ref: 005F1F94
__freea.LIBCMT ref: 005F1FB9

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 595abd894bde48ee821c70eb2f3eebcb0774dc5287de0152218054465db1e0dc
Instruction ID: dc2095cfd0f7f26038df085bdef82699f3c4ee743aa8d78c966cc7b568182204
Opcode Fuzzy Hash: 595abd894bde48ee821c70eb2f3eebcb0774dc5287de0152218054465db1e0dc
Instruction Fuzzy Hash: AE51B372610A1AEFEB259E64CC45EBB7FAAFB80750F144628FE05D7190EB38DC40C664

Uniqueness

Uniqueness Score: -1.00%

Function 005D79A4 Relevance: 9.1, APIs: 6, Instructions: 104
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 005D7A07

Part of subcall function 005D33B7: GetVersionExW.KERNEL32(?), ref: 005D33E8

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 005D7A2B
FileTimeToSystemTime.KERNEL32(?,?), ref: 005D7A45
TzSpecificLocalTimeToSystemTime.KERNELBASE(00000000,?,?), ref: 005D7A58
SystemTimeToFileTime.KERNEL32(?,?), ref: 005D7A68
SystemTimeToFileTime.KERNEL32(?,?), ref: 005D7A78

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: a82007e4e73fbd00ca5c21b129738b3ab9b6ebdd39fd99044e301293b3d7ed41
Instruction ID: e5c7c26f27b8b0b18539a133361722b70b704e0e79ecc756b60a6fa2b89f2327
Opcode Fuzzy Hash: a82007e4e73fbd00ca5c21b129738b3ab9b6ebdd39fd99044e301293b3d7ed41
Instruction Fuzzy Hash: 194105761083559BC704DFA8D9849ABBBE8BF98744F04491FF989C7210EB34D909CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 005E23FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005D72B7: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005D72E0
Part of subcall function 005D72B7: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0060F038,?,005D6013,Crypt32.dll,00000000,005D608D,?,?,005D6070,00000000), ref: 005D7300

OleInitialize.OLE32(00000000), ref: 005E2414
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 005E244B
SHGetMalloc.SHELL32(00620958), ref: 005E2455

Strings

3To, xrefs: 005E242C
riched20.dll, xrefs: 005E2403

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3To
API String ID: 3498096277-2168385784
Opcode ID: 1582bedbbf454b7c5718c79cb43ba7c3e28e7e382bed249ad8689d4919354cd9
Instruction ID: 2cf9acd9dc7669a89fb5041107addf0caf45d8ee15e8804a3e4fadaead4894cb
Opcode Fuzzy Hash: 1582bedbbf454b7c5718c79cb43ba7c3e28e7e382bed249ad8689d4919354cd9
Instruction Fuzzy Hash: 16F049B1D0024EABDB10AF9AD849AEFFFFCFF94700F00405AE915A2205D7B446058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 005D1FC0 Relevance: 7.6, APIs: 5, Instructions: 119
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?), ref: 005D2052
GetLastError.KERNEL32 ref: 005D205F
CreateFileW.KERNEL32(?,?,?,00000000,00000003,08000000,00000000,?,?,00000800), ref: 005D2092
GetLastError.KERNEL32 ref: 005D209A
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000), ref: 005D20E9

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: ea8faf8a7c799ce9ef9c624d3021896cb8c837180daab6803a01fce65e58db00
Instruction ID: ce536f4c60cb6a7f923932354d46427f1f22463df89d5e9c46b9559b6815ca72
Opcode Fuzzy Hash: ea8faf8a7c799ce9ef9c624d3021896cb8c837180daab6803a01fce65e58db00
Instruction Fuzzy Hash: 674145705457416FD330DF28CD4DBAABB98BB64320F100A1BF5A5922D1D7B4A848CB92

Uniqueness

Uniqueness Score: -1.00%

Function 005E2DC4 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005E2DD5
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005E2DE6
IsDialogMessageW.USER32(?,?), ref: 005E2DFA
TranslateMessage.USER32(?), ref: 005E2E08
DispatchMessageW.USER32(?), ref: 005E2E12

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 393071bd6f5ecc83e2d691e7f53fa9c30afc5033c08758bb91385824a7a7e551
Instruction ID: b86e828949d9b67cb5c818d27ba33f0a9c62297d3fb10de3fcfae88b7afcea53
Opcode Fuzzy Hash: 393071bd6f5ecc83e2d691e7f53fa9c30afc5033c08758bb91385824a7a7e551
Instruction Fuzzy Hash: 4AF0B772D0122AAB9B24ABE29C4CDEB7FBDEE453917006415B616D2054E724D505CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 005E226B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 005E228C
SHAutoComplete.SHLWAPI(?,00000010), ref: 005E22C3

Part of subcall function 005D854C: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,005D3763,?,?,?,005D3710,?,-00000002,?,00000000,?), ref: 005D8562

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 005E22B3

Strings

EDIT, xrefs: 005E2297, 005E22A2, 005E22AF

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 9c38c2b009e58552f682d04f2f800c39fc94fba1f164f0f31b472aa8aa0e80a5
Instruction ID: 313344953594d06747239957d29ddbc3f26955d0b21b3895ed2471c0e7db8edb
Opcode Fuzzy Hash: 9c38c2b009e58552f682d04f2f800c39fc94fba1f164f0f31b472aa8aa0e80a5
Instruction Fuzzy Hash: 73F0C835700218BBDB24DB259D09FAF7BADAF85700F000055BB41E7184DB749E058AA5

Uniqueness

Uniqueness Score: -1.00%

Function 005E54D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 005E54F1
SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 005E552B

Strings

sfxpar, xrefs: 005E5526
sfxcmd, xrefs: 005E54EC

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 27576ffd37c97414eafcb60e0abc17c3c35a74c9e13ae56a63d7a80484cc965c
Instruction ID: 1614ce7af5b4b04045eb82138d58c41d09ed26c9a0d6b0aedd835baff663dc15
Opcode Fuzzy Hash: 27576ffd37c97414eafcb60e0abc17c3c35a74c9e13ae56a63d7a80484cc965c
Instruction Fuzzy Hash: 77F0C271911624A6DB24AF6598099BF7FA8BF18B44B410017FA8597241EB389D00DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 005EB037 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,005EAFE8,00000000,?,0063A628,?,?,?,005EB18B,00000004,InitializeCriticalSectionEx,005FD0B4,InitializeCriticalSectionEx), ref: 005EB044
GetLastError.KERNEL32(?,005EAFE8,00000000,?,0063A628,?,?,?,005EB18B,00000004,InitializeCriticalSectionEx,005FD0B4,InitializeCriticalSectionEx,00000000,?,005EADD2), ref: 005EB04E
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 005EB076

Strings

api-ms-, xrefs: 005EB05B

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 5ec4aafcacb9fa6349e22097cae4e481b112c89d46c03f2b5148828d45c6d2f3
Instruction ID: c84a24f7b2c1a7feaafe1467f7e834601cd145af4f0e1d7386f98b4c90cd3870
Opcode Fuzzy Hash: 5ec4aafcacb9fa6349e22097cae4e481b112c89d46c03f2b5148828d45c6d2f3
Instruction Fuzzy Hash: 96E01271684249B6FB202BA1ED0EF6A3E59BB10B45F104060F94CE40E0EBA6A914D556

Uniqueness

Uniqueness Score: -1.00%

Function 005DDC49 Relevance: 6.3, APIs: 4, Instructions: 313COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 005DDD1E
_strncpy.LIBCMT ref: 005DDE06
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005DDE44
_strncpy.LIBCMT ref: 005DDF1D

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _strncpy$Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 2527496121-0
Opcode ID: 1a1ad8b4ea431f4c0d2b1ec154b5fcc8170c2f405ce10357274dc2681f8d8b19
Instruction ID: a6d85867bf9158f0c54d17200db3c6d2e013df8674d72ea25a170dedaa6da2d3
Opcode Fuzzy Hash: 1a1ad8b4ea431f4c0d2b1ec154b5fcc8170c2f405ce10357274dc2681f8d8b19
Instruction Fuzzy Hash: 30B16EB15053018FC724EF28DC85AAA7BBBFB98300F199A3FE545D7361D770A8058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 005D1E81 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 005D1E91
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 005D1EA9
GetLastError.KERNEL32 ref: 005D1EDB
GetLastError.KERNEL32 ref: 005D1EFA

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: fe3ae8a801f415b036d8273706f59b5acc89a6dc68f0bb5511f69aba9164e4ad
Instruction ID: 2751818946ffcbd60df6d42e764af1e05106126e36df43c9eb8a330d1620fa64
Opcode Fuzzy Hash: fe3ae8a801f415b036d8273706f59b5acc89a6dc68f0bb5511f69aba9164e4ad
Instruction Fuzzy Hash: 21112E70900A05BBDB309F69D80866A3FADFB51361B10492BF866C5390DB749D84DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 005F2174 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,005EB682,00000000,00000000,?,005F211B,005EB682,00000000,00000000,00000000,?,005F2318,00000006,FlsSetValue), ref: 005F21A6
GetLastError.KERNEL32(?,005F211B,005EB682,00000000,00000000,00000000,?,005F2318,00000006,FlsSetValue,005FE690,FlsSetValue,00000000,00000364,?,005F0867), ref: 005F21B2
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,005F211B,005EB682,00000000,00000000,00000000,?,005F2318,00000006,FlsSetValue,005FE690,FlsSetValue,00000000), ref: 005F21C0

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: f7ea968d6f7f5819dc08a6f7fcb16b645a2f19063192baeacb9b863868e44254
Instruction ID: 72fc2f39cda4506156dc3795339a91540ef0863d8bed5004696b7bfea1014bd2
Opcode Fuzzy Hash: f7ea968d6f7f5819dc08a6f7fcb16b645a2f19063192baeacb9b863868e44254
Instruction Fuzzy Hash: 5901F7B264162AABC7215B68AC48EB67F9CBF15761F110A20FB0AD7180D72CD804C6E5

Uniqueness

Uniqueness Score: -1.00%

Function 005F2CD3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 005F2CF8

Strings

, xrefs: 005F2D3D
2_, xrefs: 005F2CEA

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Info
String ID: 2_$
API String ID: 1807457897-3388386149
Opcode ID: bb3659e03a502c35084b5450faabc5068ea5cf12e640a36b4ce6a35fa3b2ae57
Instruction ID: 9f48be57ae309f6ceb54c23ab96220d2e148cfd7a7f6264e9bc6f6e500c41a39
Opcode Fuzzy Hash: bb3659e03a502c35084b5450faabc5068ea5cf12e640a36b4ce6a35fa3b2ae57
Instruction Fuzzy Hash: 2941B9B050429C9EDB258E64CC84AF6BFBDFB55304F2408EDE69AC7142D2399A469F60

Uniqueness

Uniqueness Score: -1.00%

Function 005F2E67 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 005F0795: GetLastError.KERNEL32(?,?,005EBC07,?,?,?,005EB682,00000050,?), ref: 005F0799
Part of subcall function 005F0795: _free.LIBCMT ref: 005F07CC
Part of subcall function 005F0795: SetLastError.KERNEL32(00000000,?), ref: 005F080D
Part of subcall function 005F0795: _abort.LIBCMT ref: 005F0813

Part of subcall function 005F2F8E: _abort.LIBCMT ref: 005F2FC0
Part of subcall function 005F2F8E: _free.LIBCMT ref: 005F2FF4

Part of subcall function 005F2BFB: GetOEMCP.KERNEL32(00000000,?,?,005F2E84,?), ref: 005F2C26

_free.LIBCMT ref: 005F2EDF
_free.LIBCMT ref: 005F2F15

Strings

P[`, xrefs: 005F2F09

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast_abort
String ID: P[`
API String ID: 2991157371-2264928869
Opcode ID: 2d6f5e517e58d107ee011fc9f1ef6e98f15b8c844d6b957923d20bdd3ffadb24
Instruction ID: f8a472ee9e571749954806be04fcc8a38d71ff7fbe20c2f12c3dbc2b479dbc93
Opcode Fuzzy Hash: 2d6f5e517e58d107ee011fc9f1ef6e98f15b8c844d6b957923d20bdd3ffadb24
Instruction Fuzzy Hash: 0131A47190420DAFDB10EF68D849B7ABFE5FF40320F650099EA049B292EB395D41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 005D1D4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,?,RP.exe,?,?,005DBA5F,RP.exe,00000012,RP.exe), ref: 005D1DD4
CreateFileW.KERNEL32(?,?,?,00000000,00000002,00000000,00000000,?,?,00000800,?,RP.exe,?,?,005DBA5F,RP.exe), ref: 005D1E04

Strings

RP.exe, xrefs: 005D1D79

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: RP.exe
API String ID: 823142352-475558011
Opcode ID: 253d7207a9b2ce35325a624aff128abc5de52f8e8725e1d2c73fc0f9a02bbc16
Instruction ID: 88cc85e8ef89c2d188745a4223b63509f10c7dee71d45b85471ea7ec7d60eb17
Opcode Fuzzy Hash: 253d7207a9b2ce35325a624aff128abc5de52f8e8725e1d2c73fc0f9a02bbc16
Instruction Fuzzy Hash: 5D21B171100744AFE330DE29C849BB77BDDFB98355F004A1BF996C62C1D774A8448A62

Uniqueness

Uniqueness Score: -1.00%

Function 005E5E5B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5E48

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

PDue^^, xrefs: 005E5E42
[^^, xrefs: 005E5E5B

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: PDue^^$[^^
API String ID: 697777088-743132393
Opcode ID: 2182fad380c4a91cc589c8885d24f424be5ecb0d5c88350aa4c2e2c51a74b61f
Instruction ID: cf023071dab58823557fff75fa552b2869ecb94ac4b05ec855f760de141c4172
Opcode Fuzzy Hash: 2182fad380c4a91cc589c8885d24f424be5ecb0d5c88350aa4c2e2c51a74b61f
Instruction Fuzzy Hash: 9FB012A22D9242AC310E520B1C07D370A1ED1C5B51330842AF941C41A1E5401D804032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5E51 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5E48

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

PDue^^, xrefs: 005E5E42
Q^^, xrefs: 005E5E51

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: PDue^^$Q^^
API String ID: 697777088-568117567
Opcode ID: 6ff19584cfe6f334a1782e7866b8325e81922d012ce022817d847886ebf22306
Instruction ID: 28168c2de5c8fe05d796fd430d6e1ff6367569081ba8b97443f4bb859885ff38
Opcode Fuzzy Hash: 6ff19584cfe6f334a1782e7866b8325e81922d012ce022817d847886ebf22306
Instruction Fuzzy Hash: 1DB012A22E9142AC310E520B5D07D374A1EE0C5B51330462BF541C4191F5805D404036

Uniqueness

Uniqueness Score: -1.00%

Function 005D263A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,00000000,00000000,005DB889,?,?,?,?,?,005DC07F,ytesWritten,?,005DCA21,00010000), ref: 005D265E
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 005D26A5
WriteFile.KERNELBASE(00000008,?,005DCA21,00010000,00000000,03211475,?,?,?,00000000,00000000,005DB889,?,?,?,?), ref: 005D26D1

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 90200886f79dce9173b82ca1ddbfb03361b0f525c8f8d94ef7c5a4fe028b555e
Instruction ID: 651ce05e7680b429e181ef27ea3734cf08d9c3d1778dfb3917a02ecdd955cc8c
Opcode Fuzzy Hash: 90200886f79dce9173b82ca1ddbfb03361b0f525c8f8d94ef7c5a4fe028b555e
Instruction Fuzzy Hash: 73319275204305AFDB24CF28D908BAA7BA5FBA1711F04491FF88597390CB759948DBA3

Uniqueness

Uniqueness Score: -1.00%

Function 005D2D29 Relevance: 4.6, APIs: 3, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 005D400D: _wcslen.LIBCMT ref: 005D4013

CreateDirectoryW.KERNELBASE(?,00000000,?), ref: 005D2D5A
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?), ref: 005D2D8D
GetLastError.KERNEL32(?,?), ref: 005D2DAA

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 474abb2920a77f33cef4f0fdc64cfa0933f174c757764ddf19721a0e746a0090
Instruction ID: 9d5b4c72d68f93f82ced2dabbb30763b95372af1b1cf09001b39c3d121b5917c
Opcode Fuzzy Hash: 474abb2920a77f33cef4f0fdc64cfa0933f174c757764ddf19721a0e746a0090
Instruction Fuzzy Hash: B3110220200215AAEB35FF288C0DFFE3BA9BF39340F040057F506D6290DA289A85D662

Uniqueness

Uniqueness Score: -1.00%

Function 005F23AC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,F4E85006,00000001,?,000000FF), ref: 005F241D

Strings

LCMapStringEx, xrefs: 005F23BD, 005F23C7

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 66e2e5396e39406f3542196327342ab18e06a3577b8431f41589a09a1c9f25ec
Instruction ID: 746df22844f91a4afc471f333a13ac65695ccbe77688dca591a2f741ab033665
Opcode Fuzzy Hash: 66e2e5396e39406f3542196327342ab18e06a3577b8431f41589a09a1c9f25ec
Instruction Fuzzy Hash: E201257264024DBBCF029F90EC0ADEE7F66FF58750F404115FE0866161CA7A8931EB86

Uniqueness

Uniqueness Score: -1.00%

Function 005F234A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,005F194F), ref: 005F2395

Strings

InitializeCriticalSectionEx, xrefs: 005F235B, 005F2365

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 889a504ffd30b8cfc17eddba224b1f04afdca82b94772b15d3c8a3db14dacdb6
Instruction ID: 5d36a4997a727446e1af20675976c877d9c16ec40194026f21f04f1a949447fe
Opcode Fuzzy Hash: 889a504ffd30b8cfc17eddba224b1f04afdca82b94772b15d3c8a3db14dacdb6
Instruction Fuzzy Hash: 76F0247168120CBBCB106F54DC06CBE7F62FF54751F404014FE08AA2B0CB3A4D10EA81

Uniqueness

Uniqueness Score: -1.00%

Function 005F21EF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 005F222E

Strings

FlsAlloc, xrefs: 005F2200, 005F220A

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 8ddcec44708f96a3684926cb72be29b51c40121a671b4b18900494aaf8eab251
Instruction ID: e2d6ee25ab42fd64c2c79427941579c2d69a3044981fc595a74ff0baae86cb08
Opcode Fuzzy Hash: 8ddcec44708f96a3684926cb72be29b51c40121a671b4b18900494aaf8eab251
Instruction Fuzzy Hash: 9DE0557878120CA7C310AB50AC0AD3EBF95FB65B10F400069FE09A6250CE3E1D00D68A

Uniqueness

Uniqueness Score: -1.00%

Function 005E5B58 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: f0d2a7cb37753d03396511c21a9f49d01be4c33b8ee13c810af34c9c2de504a4
Instruction ID: 8eff286481ccfff1964350207e679ff62dd50721a903bdb1edd4e1d10a6c3ece
Opcode Fuzzy Hash: f0d2a7cb37753d03396511c21a9f49d01be4c33b8ee13c810af34c9c2de504a4
Instruction Fuzzy Hash: D9B012A62A91426C314D961B1C0AC3B492DD0C5B95330451BB242C0191F8C01D414032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5B4E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 9889bdbdf607d73fbe5e8a406f001b9432803f93e928d8c099010fd15a50e91b
Instruction ID: e94906ba326919977c3ff1f8bbdffacab6502ece16307c8c97c2ea49cfbb2420
Opcode Fuzzy Hash: 9889bdbdf607d73fbe5e8a406f001b9432803f93e928d8c099010fd15a50e91b
Instruction Fuzzy Hash: FAB012A62A90426C310D961B1C0AC3B492DD0C6B95330841BB642C0191F8801D014032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5B6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F, 005E5B6C

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: e280680a9d74bd3dfb3e9748176b524a317e5e9ccbbabf163c62cbc8cac9fbbf
Instruction ID: e1446c76b35f92eeb1182c22e699514278952a4823bfbe344d2f9618404a8c9c
Opcode Fuzzy Hash: e280680a9d74bd3dfb3e9748176b524a317e5e9ccbbabf163c62cbc8cac9fbbf
Instruction Fuzzy Hash: C1B012A62A90466C310D961B1C0EC3B492DE0C5B95330441BB242C0191F8801D014032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5B62 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: c56a0f945e83713fb1019bde1e64a06813856b86815c17c3d3786e75720fc3e8
Instruction ID: 800359d73d33d648fcfb5bd607ed103d4b48f27ff09b06cac07d89bc376a6d76
Opcode Fuzzy Hash: c56a0f945e83713fb1019bde1e64a06813856b86815c17c3d3786e75720fc3e8
Instruction Fuzzy Hash: F3B012A62A90426C310D961B1D0AC3B492DD0C5B95330441BB242C0191FC811E025032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5B33 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 4fa5fcd49864e7d1b8a656a9ae2582398feb56e4f30351576dbed3fed3fc18d7
Instruction ID: 8a999ecdba46272a1d22e177b7df47c34c49d685341c8fa8c6babb7b33352707
Opcode Fuzzy Hash: 4fa5fcd49864e7d1b8a656a9ae2582398feb56e4f30351576dbed3fed3fc18d7
Instruction Fuzzy Hash: B5B012962A91867C310D56171C0AC3B491DD0D1B91330852BB242D0191B8C01C454032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5BDA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: c2e97105cf61fe01b09c40a898dc110ac03a72b590b5b5c542a4c2805105a0cc
Instruction ID: cc8439e6c6b61758be2ec9a4d8990897e98e515ebdce0a631d1be172096798f9
Opcode Fuzzy Hash: c2e97105cf61fe01b09c40a898dc110ac03a72b590b5b5c542a4c2805105a0cc
Instruction Fuzzy Hash: BEB012962A90426C311D961B5D0BC3B4A1DD0D5F91730441BB242C0191F8811D025032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5BD0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 02aeabee3c9d6eb72d1fc175c29f20c188071a208c2472e23ab4799587966f6e
Instruction ID: a08d7617f4d4b260846bdf00b4c660b9faabd624fd32f5d4ee8d61e4bc4f5dd7
Opcode Fuzzy Hash: 02aeabee3c9d6eb72d1fc175c29f20c188071a208c2472e23ab4799587966f6e
Instruction Fuzzy Hash: 9FB012962A91426C315D961B1C0BC3B4A1DD0D5B91730851BB242C0191F8C01C414072

Uniqueness

Uniqueness Score: -1.00%

Function 005E5BC6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 12b4a8459a96adb0b1821c11bf2c705b53dd6f2ea67853ffb8507143ff4a3585
Instruction ID: fdfcee091cddf6e2f0cf8ebeec832d7c9057fd8080526d1149f00ccdf4aa34e8
Opcode Fuzzy Hash: 12b4a8459a96adb0b1821c11bf2c705b53dd6f2ea67853ffb8507143ff4a3585
Instruction Fuzzy Hash: A7B012962A90426C311D961B1C0BC3B4A1DD0D6B91730841BB642C4191F8801C014032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5BE4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 461c923b5c79df8c5e15550b6d7cda8fadc84a7c60492ec15f3f4d25f4f5675e
Instruction ID: 1c0befef08799e4dd2f57474a1c9a4895f82b221971ced49b8e2aeb350a13c2e
Opcode Fuzzy Hash: 461c923b5c79df8c5e15550b6d7cda8fadc84a7c60492ec15f3f4d25f4f5675e
Instruction Fuzzy Hash: E0B012962A90466C311D961B1C0FC3B4A1DE0D5B91730481BB242C01D1F8801C014032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5B9E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 065e5dabf1262bf15ab71a44148c53be862f54e945a990e562f802320ac25f19
Instruction ID: 4b84801735e3f61231f262ba23b8875e38db275edd965c8eb7a59f7e867ddd2a
Opcode Fuzzy Hash: 065e5dabf1262bf15ab71a44148c53be862f54e945a990e562f802320ac25f19
Instruction Fuzzy Hash: 16B012962A90426C310D962B1C0AC3B495DD0C7B91330841BB742C4191F9811C014032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5B94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 26b2a3337407a6a30fdf3075073dd9cb96ef62e92cd727722b407cace43034df
Instruction ID: 1dcf9337d1393312a352421cd45786c5bdaf224ee175a3feaaffd1b76707f8ca
Opcode Fuzzy Hash: 26b2a3337407a6a30fdf3075073dd9cb96ef62e92cd727722b407cace43034df
Instruction Fuzzy Hash: 48B012962BA0466C310D961B1C0ED3B495EE4C5B91730441BB286C0191F8801C014032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5B8A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 7ed47dd5d49559cd2fd3f15ccb32f02c3e72cb6bbc35802ba6068f6557319183
Instruction ID: 6f25fc8270776c73b55d75dab6431f9fd3af3703c9cf78535ba2f140c07d988e
Opcode Fuzzy Hash: 7ed47dd5d49559cd2fd3f15ccb32f02c3e72cb6bbc35802ba6068f6557319183
Instruction Fuzzy Hash: ECB012962AB0426C310D961B1D0AC3B491ED0C5BD1730441BB246C0191F8815D025032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5B80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: da10835a30a6303de8751b949e1b6415f524d477d0d61b02d36fe21414497ddf
Instruction ID: fa9590318af4d20fc408c4bd68418160f09ebd3f1b9bd31371c787814d8280a5
Opcode Fuzzy Hash: da10835a30a6303de8751b949e1b6415f524d477d0d61b02d36fe21414497ddf
Instruction Fuzzy Hash: 47B012A62AA1426C314D971B1C0AC3B491ED0C5B91730451BB246C0191F8C01C414132

Uniqueness

Uniqueness Score: -1.00%

Function 005E5BB2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 9a87d1fdb4966d2c3471dbae5173f1f3096989e05b1458568c50cfa45dcbed3c
Instruction ID: 5515d4c5df266e41f349f45b1de19494572b747384dc5fc5c8511e11db51f43b
Opcode Fuzzy Hash: 9a87d1fdb4966d2c3471dbae5173f1f3096989e05b1458568c50cfa45dcbed3c
Instruction Fuzzy Hash: 95B012A62A90426C310D961B1D0AC3B499DD0C6B91730441BB342C4191F9811D025032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5BA8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 5a76057237dfb1ae33a944d613dbd165d17939e52b53b82a1ca56d91972f627b
Instruction ID: 76732a315646699b9c21bcebdd0ab93054711c6df052e753c6a319860f63756d
Opcode Fuzzy Hash: 5a76057237dfb1ae33a944d613dbd165d17939e52b53b82a1ca56d91972f627b
Instruction Fuzzy Hash: 39B012962A91426C314D961B1C0AC3B495DD4C6B91330451BB242C4191F8C01C414032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5D7B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5D5E

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

Pl)uq]^, xrefs: 005E5D58

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: Pl)uq]^
API String ID: 697777088-2269821374
Opcode ID: 87cbe31bfd1abb45cc8b0a3ae17e320e96e4ac2606dda691fbc32eca44e01ee9
Instruction ID: 31be357285f898c6b20d2147cc988499432f370e3e6cc3b4871f7cdbbbca94d0
Opcode Fuzzy Hash: 87cbe31bfd1abb45cc8b0a3ae17e320e96e4ac2606dda691fbc32eca44e01ee9
Instruction Fuzzy Hash: 8FB012A22D9052AC710D520B1E0AE37091DE0D6B51330441AB1C1C41A2F5401F048033

Uniqueness

Uniqueness Score: -1.00%

Function 005E6508 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E651A

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

3To, xrefs: 005E6508, 005E6514

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 3To
API String ID: 697777088-245939750
Opcode ID: 86145c382c275d9aaf43452b0508fac7157e9eca24ebe108797fe14a53ed5d5e
Instruction ID: c000c0b9ec7b29664eeecd499aec01161181028afd0cb2d4ad7437bfa4167fbe
Opcode Fuzzy Hash: 86145c382c275d9aaf43452b0508fac7157e9eca24ebe108797fe14a53ed5d5e
Instruction Fuzzy Hash: A7B012B23AA142BC310D12171E0AD37091DE4D5BD1370885BB081C0192B9401D846032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5D85 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5D5E

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

Pl)uq]^, xrefs: 005E5D58

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: Pl)uq]^
API String ID: 697777088-2269821374
Opcode ID: 0cab9244b9e8850609645515401e7c97568f0d85e42c4d55dbc8100c46965a17
Instruction ID: 1b03558ea6a8b0bb58855a57c2d1109ecc1ebc72f80d076cf6f2703b923deee8
Opcode Fuzzy Hash: 0cab9244b9e8850609645515401e7c97568f0d85e42c4d55dbc8100c46965a17
Instruction Fuzzy Hash: 6FB012A22DA252AC720D520B1D0ED37091DD0C6B91330451AB1C5C41A2E5401E488133

Uniqueness

Uniqueness Score: -1.00%

Function 005E5DAD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5D5E

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

Pl)uq]^, xrefs: 005E5D58, 005E5DAD

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: Pl)uq]^
API String ID: 697777088-2269821374
Opcode ID: 7529d17f224c80a2648c474800121af3e0e4027c27a9c034f2abae9176291f96
Instruction ID: e5404b7142a3ba107bbadc24b38e2c92b7d35902c957ba5433d1120a2d40dda2
Opcode Fuzzy Hash: 7529d17f224c80a2648c474800121af3e0e4027c27a9c034f2abae9176291f96
Instruction Fuzzy Hash: 61B012A22D9252AC720D520B1D0AD37091DD0D6B51330491AB1C1C41A2E5401F488033

Uniqueness

Uniqueness Score: -1.00%

Function 005E5E6F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5E48

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

PDue^^, xrefs: 005E5E42, 005E5E6F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: PDue^^
API String ID: 697777088-1975089016
Opcode ID: 6801bbcfc0b583118dd8b30fba8312a2d01fb456a253756aa3a0a4d5812e84b5
Instruction ID: d626eee426055864360fe8b8bcb13077c23aab2bd4df81bef2215a12dbe1f653
Opcode Fuzzy Hash: 6801bbcfc0b583118dd8b30fba8312a2d01fb456a253756aa3a0a4d5812e84b5
Instruction Fuzzy Hash: 19B012A22D93426C710E520B2D07D3B0A1ED1C5B51330842AF641C41A1E5411D814032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5E36 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5E48

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

PDue^^, xrefs: 005E5E42

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: PDue^^
API String ID: 697777088-1975089016
Opcode ID: 605c8ebea0d4d029f1bf8ec6005e8c9985150fd8360961b048fe29dab0457aee
Instruction ID: 2fb3734a79a4f20aadfc407950166c32ea5733afa74c9f05deb0cec62cb0538d
Opcode Fuzzy Hash: 605c8ebea0d4d029f1bf8ec6005e8c9985150fd8360961b048fe29dab0457aee
Instruction Fuzzy Hash: 05B012B22D9142FC310F12475C07C374B1ED0C5B51330852AF941C4091E5806D40403A

Uniqueness

Uniqueness Score: -1.00%

Function 005E5B7B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 5b69e07eccfbf24cbe83d544d819c9d75a24476817637e567bc1f8d17aa8230d
Instruction ID: 858857a93c798ad1a0dce028fd55a9e00aa684ccfbe68c9a1aeca0d253c0a03e
Opcode Fuzzy Hash: 5b69e07eccfbf24cbe83d544d819c9d75a24476817637e567bc1f8d17aa8230d
Instruction Fuzzy Hash: 6AA012961A90437C300D52131C0AC3B451CD0C5BD1330480AB14380091788018014031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5BC1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: a616e74b0513a7cc5a1f86004adfb33c88514eef74c1fdf3ddd50efca5e9bb47
Instruction ID: 858857a93c798ad1a0dce028fd55a9e00aa684ccfbe68c9a1aeca0d253c0a03e
Opcode Fuzzy Hash: a616e74b0513a7cc5a1f86004adfb33c88514eef74c1fdf3ddd50efca5e9bb47
Instruction Fuzzy Hash: 6AA012961A90437C300D52131C0AC3B451CD0C5BD1330480AB14380091788018014031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5BFD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 284792bdda3d68f7d0fd22afcffde5212fa280d2ef4757de1502d17156a974fe
Instruction ID: 858857a93c798ad1a0dce028fd55a9e00aa684ccfbe68c9a1aeca0d253c0a03e
Opcode Fuzzy Hash: 284792bdda3d68f7d0fd22afcffde5212fa280d2ef4757de1502d17156a974fe
Instruction Fuzzy Hash: 6AA012961A90437C300D52131C0AC3B451CD0C5BD1330480AB14380091788018014031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5BF3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: f72f015aafffaf13b5124853933c05d23318c0878813ba4159660e6ad7ed958a
Instruction ID: 858857a93c798ad1a0dce028fd55a9e00aa684ccfbe68c9a1aeca0d253c0a03e
Opcode Fuzzy Hash: f72f015aafffaf13b5124853933c05d23318c0878813ba4159660e6ad7ed958a
Instruction Fuzzy Hash: 6AA012961A90437C300D52131C0AC3B451CD0C5BD1330480AB14380091788018014031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5C1B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: e3a0b1e109222cd8b2725d5f47fa63f65d42c82b7a5f47ecd7c82db636a85287
Instruction ID: 858857a93c798ad1a0dce028fd55a9e00aa684ccfbe68c9a1aeca0d253c0a03e
Opcode Fuzzy Hash: e3a0b1e109222cd8b2725d5f47fa63f65d42c82b7a5f47ecd7c82db636a85287
Instruction Fuzzy Hash: 6AA012961A90437C300D52131C0AC3B451CD0C5BD1330480AB14380091788018014031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5C11 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: c42371f256fa9c41027308e8b12772ac60c92040e013ca77ccd53bae59588f2e
Instruction ID: 858857a93c798ad1a0dce028fd55a9e00aa684ccfbe68c9a1aeca0d253c0a03e
Opcode Fuzzy Hash: c42371f256fa9c41027308e8b12772ac60c92040e013ca77ccd53bae59588f2e
Instruction Fuzzy Hash: 6AA012961A90437C300D52131C0AC3B451CD0C5BD1330480AB14380091788018014031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5C07 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: a7e1824399e00de04a6edb38566df6ab6ae15a48794277600565750d9c7dfcbb
Instruction ID: 858857a93c798ad1a0dce028fd55a9e00aa684ccfbe68c9a1aeca0d253c0a03e
Opcode Fuzzy Hash: a7e1824399e00de04a6edb38566df6ab6ae15a48794277600565750d9c7dfcbb
Instruction Fuzzy Hash: 6AA012961A90437C300D52131C0AC3B451CD0C5BD1330480AB14380091788018014031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5C39 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 14a456ab9c5a94a6ce0e8c23554a7bea1bf5c8bd20d705f9ea10daccba8de2cd
Instruction ID: 858857a93c798ad1a0dce028fd55a9e00aa684ccfbe68c9a1aeca0d253c0a03e
Opcode Fuzzy Hash: 14a456ab9c5a94a6ce0e8c23554a7bea1bf5c8bd20d705f9ea10daccba8de2cd
Instruction Fuzzy Hash: 6AA012961A90437C300D52131C0AC3B451CD0C5BD1330480AB14380091788018014031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5C2F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 61ef434db44dfd65a947a718af6ae3050abc05c5b7fd8e1a0b8c89dc7a539c3c
Instruction ID: 858857a93c798ad1a0dce028fd55a9e00aa684ccfbe68c9a1aeca0d253c0a03e
Opcode Fuzzy Hash: 61ef434db44dfd65a947a718af6ae3050abc05c5b7fd8e1a0b8c89dc7a539c3c
Instruction Fuzzy Hash: 6AA012961A90437C300D52131C0AC3B451CD0C5BD1330480AB14380091788018014031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5C25 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5B45

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

l[^, xrefs: 005E5B3F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: l[^
API String ID: 697777088-1796215610
Opcode ID: 5430485b5a585ec02b5152679f8e75a1de93045b5ad8057e4e1bacdb2b4b9115
Instruction ID: 858857a93c798ad1a0dce028fd55a9e00aa684ccfbe68c9a1aeca0d253c0a03e
Opcode Fuzzy Hash: 5430485b5a585ec02b5152679f8e75a1de93045b5ad8057e4e1bacdb2b4b9115
Instruction Fuzzy Hash: 6AA012961A90437C300D52131C0AC3B451CD0C5BD1330480AB14380091788018014031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5D51 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5D5E

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

Pl)uq]^, xrefs: 005E5D58

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: Pl)uq]^
API String ID: 697777088-2269821374
Opcode ID: 72f49960c66cda055f5c1967e43240bef59d5de10c759990b866406847084f02
Instruction ID: 76ef548cdc889070105b56f0e878c15c60968f2d27ba0f6fc84e6de0131f4e60
Opcode Fuzzy Hash: 72f49960c66cda055f5c1967e43240bef59d5de10c759990b866406847084f02
Instruction Fuzzy Hash: A3A012921D50527C700D12031D0AC37061CD0C2B913304509F1C1C40A264401A048032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5D76 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5D5E

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

Pl)uq]^, xrefs: 005E5D58

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: Pl)uq]^
API String ID: 697777088-2269821374
Opcode ID: f347eaecd5ddf2c0ee88d23fd050c4a15dbb8bd6c1a47ee1c8513fa2cfa94d90
Instruction ID: b915b49281d716ff499549338822394bc7a267a398e8f93a4b1c303f416541ec
Opcode Fuzzy Hash: f347eaecd5ddf2c0ee88d23fd050c4a15dbb8bd6c1a47ee1c8513fa2cfa94d90
Instruction Fuzzy Hash: 87A012921D9053BC700D12031D0AC37051CD0C6B913304809B0C2C40A264401A048032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5D6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5D5E

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

Pl)uq]^, xrefs: 005E5D58

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: Pl)uq]^
API String ID: 697777088-2269821374
Opcode ID: 6882a3d4ddbc6550ecb1cf08991fc52eb8ad37412ec8222d5b4bae0bddbe3b98
Instruction ID: b915b49281d716ff499549338822394bc7a267a398e8f93a4b1c303f416541ec
Opcode Fuzzy Hash: 6882a3d4ddbc6550ecb1cf08991fc52eb8ad37412ec8222d5b4bae0bddbe3b98
Instruction Fuzzy Hash: 87A012921D9053BC700D12031D0AC37051CD0C6B913304809B0C2C40A264401A048032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5D9E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5D5E

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

Pl)uq]^, xrefs: 005E5D58

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: Pl)uq]^
API String ID: 697777088-2269821374
Opcode ID: 4128de511532b4245f998969fd504e026336773270abafe4433bd44d5d4cb03e
Instruction ID: b915b49281d716ff499549338822394bc7a267a398e8f93a4b1c303f416541ec
Opcode Fuzzy Hash: 4128de511532b4245f998969fd504e026336773270abafe4433bd44d5d4cb03e
Instruction Fuzzy Hash: 87A012921D9053BC700D12031D0AC37051CD0C6B913304809B0C2C40A264401A048032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5D94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5D5E

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

Pl)uq]^, xrefs: 005E5D58

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: Pl)uq]^
API String ID: 697777088-2269821374
Opcode ID: 04e68a754cddf8a04cabe6eb37c371d9ea2cbe44a2b737467563ae0d5f43c1cb
Instruction ID: b915b49281d716ff499549338822394bc7a267a398e8f93a4b1c303f416541ec
Opcode Fuzzy Hash: 04e68a754cddf8a04cabe6eb37c371d9ea2cbe44a2b737467563ae0d5f43c1cb
Instruction Fuzzy Hash: 87A012921D9053BC700D12031D0AC37051CD0C6B913304809B0C2C40A264401A048032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5DA8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5D5E

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

Pl)uq]^, xrefs: 005E5D58

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: Pl)uq]^
API String ID: 697777088-2269821374
Opcode ID: f39007f166ac2fa3231d2c4f546a191e76b4293e07fcd6bcaa42e8f5f0e897cc
Instruction ID: b915b49281d716ff499549338822394bc7a267a398e8f93a4b1c303f416541ec
Opcode Fuzzy Hash: f39007f166ac2fa3231d2c4f546a191e76b4293e07fcd6bcaa42e8f5f0e897cc
Instruction Fuzzy Hash: 87A012921D9053BC700D12031D0AC37051CD0C6B913304809B0C2C40A264401A048032

Uniqueness

Uniqueness Score: -1.00%

Function 005E5E7E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5E48

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

PDue^^, xrefs: 005E5E42

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: PDue^^
API String ID: 697777088-1975089016
Opcode ID: 5b9f79de48df646b90f7427a76b98e6590837047d2111ba4670f18e1f5d7c426
Instruction ID: 6464a4d7de40dab7a3dfaffc28fb3f497b84c91f12492f4f63bff3017732498b
Opcode Fuzzy Hash: 5b9f79de48df646b90f7427a76b98e6590837047d2111ba4670f18e1f5d7c426
Instruction Fuzzy Hash: 54A012A21D91437C300E12031C07C37061DD0C5B913304819F4428409164401D404031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5E6A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5E48

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

PDue^^, xrefs: 005E5E42

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: PDue^^
API String ID: 697777088-1975089016
Opcode ID: 488c0d93d5494c1a14eeffc1f3f07b274c9f0568d1088684260629e08ec0ae6c
Instruction ID: 6464a4d7de40dab7a3dfaffc28fb3f497b84c91f12492f4f63bff3017732498b
Opcode Fuzzy Hash: 488c0d93d5494c1a14eeffc1f3f07b274c9f0568d1088684260629e08ec0ae6c
Instruction Fuzzy Hash: 54A012A21D91437C300E12031C07C37061DD0C5B913304819F4428409164401D404031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5E92 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5E48

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

PDue^^, xrefs: 005E5E42

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: PDue^^
API String ID: 697777088-1975089016
Opcode ID: 99d001d3257b3af38251631688ba0f58a4b27e7904597bc153e56f9c8efa5a54
Instruction ID: 6464a4d7de40dab7a3dfaffc28fb3f497b84c91f12492f4f63bff3017732498b
Opcode Fuzzy Hash: 99d001d3257b3af38251631688ba0f58a4b27e7904597bc153e56f9c8efa5a54
Instruction Fuzzy Hash: 54A012A21D91437C300E12031C07C37061DD0C5B913304819F4428409164401D404031

Uniqueness

Uniqueness Score: -1.00%

Function 005E5E88 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5E48

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Strings

PDue^^, xrefs: 005E5E42

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: PDue^^
API String ID: 697777088-1975089016
Opcode ID: bfa1995098a7d358b7aaebea8309411efe483d9b818564465c13c442c8d1e2bd
Instruction ID: 6464a4d7de40dab7a3dfaffc28fb3f497b84c91f12492f4f63bff3017732498b
Opcode Fuzzy Hash: bfa1995098a7d358b7aaebea8309411efe483d9b818564465c13c442c8d1e2bd
Instruction Fuzzy Hash: 54A012A21D91437C300E12031C07C37061DD0C5B913304819F4428409164401D404031

Uniqueness

Uniqueness Score: -1.00%

Function 005F3030 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 005F2BFB: GetOEMCP.KERNEL32(00000000,?,?,005F2E84,?), ref: 005F2C26

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,005F2EC9,?,00000000), ref: 005F30A4
GetCPInfo.KERNEL32(00000000,005F2EC9,?,?,?,005F2EC9,?,00000000), ref: 005F30B7

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 845fc1ce8971226b32ede36699d72e8314ffb94fe78ffabfbf6b31024cfe514a
Instruction ID: 1e9bb8b512e3ff325ec7c832c52bf0d985a52dc41eef4be4c417c528776191f9
Opcode Fuzzy Hash: 845fc1ce8971226b32ede36699d72e8314ffb94fe78ffabfbf6b31024cfe514a
Instruction Fuzzy Hash: 0951167090434E9EEB249F75C885ABBBFE5FF41300F14846ED6968B251D73C9A45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005D2137 Relevance: 3.1, APIs: 2, Instructions: 140COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?), ref: 005D22C3
GetLastError.KERNEL32 ref: 005D22D2

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ef9c83f321d137438b2f771eeda9929b9401c189998bbd91e80e80dc69f07529
Instruction ID: d5485a6aa8e245eccf35b40f545eccb2434ed38404da310ef8d6a1d225ace510
Opcode Fuzzy Hash: ef9c83f321d137438b2f771eeda9929b9401c189998bbd91e80e80dc69f07529
Instruction Fuzzy Hash: AE41F6382043418BC7349F98C8846BABBA5FBB8360F10892FE955C3341D7749C85DB62

Uniqueness

Uniqueness Score: -1.00%

Function 005D292A Relevance: 3.1, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?), ref: 005D2A55
RemoveDirectoryW.KERNEL32(?,?,?,00000800), ref: 005D2A81

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: 23cef35ab73fbefc3595966976868497bddfacd58a74391c1a0abc76de4e3cdb
Instruction ID: c51cee93ae95adefea67b9883c0bfde280804eebbc127332104c082a6696e929
Opcode Fuzzy Hash: 23cef35ab73fbefc3595966976868497bddfacd58a74391c1a0abc76de4e3cdb
Instruction Fuzzy Hash: 603115716413565ADB30EF788C49AEF7BD8FFA5340F40042BF985C3241EBB4998987A1

Uniqueness

Uniqueness Score: -1.00%

Function 005D24C2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?), ref: 005D24DC
SetFileTime.KERNELBASE(?,?,?,?), ref: 005D2590

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 146aa010a2f8dc457f9a197bcd45297553e4c7b1f30a4b87547fcc09bce81bca
Instruction ID: 5f69bb06c62b5f70f63804a1e640be92986a53ab139762b06d4d785c8ba236aa
Opcode Fuzzy Hash: 146aa010a2f8dc457f9a197bcd45297553e4c7b1f30a4b87547fcc09bce81bca
Instruction Fuzzy Hash: B121C1312492469BC725DF28D8A5EAABFE8BFA5304F04481FF4C587251D329E90CD762

Uniqueness

Uniqueness Score: -1.00%

Function 005EAF97 Relevance: 3.1, APIs: 2, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0063A628,?,?,?,005EB18B,00000004,InitializeCriticalSectionEx,005FD0B4,InitializeCriticalSectionEx,00000000,?,005EADD2,0063A628,00000FA0), ref: 005EB01A
GetProcAddress.KERNEL32(00000000,?), ref: 005EB024

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID:
API String ID: 3013587201-0
Opcode ID: d2134c71d7be79c399e25117a7a2bbefd1a93bfcb947231c557c92b412994a2a
Instruction ID: 27d9bb776334e8048585692dd9b42fc0e184fd2d3cc0f07c12db4518526705a5
Opcode Fuzzy Hash: d2134c71d7be79c399e25117a7a2bbefd1a93bfcb947231c557c92b412994a2a
Instruction Fuzzy Hash: 481124316002559FAF1BCF66E8489AB7BA9FB063507140565D9A1D7200EB30FD01DB91

Uniqueness

Uniqueness Score: -1.00%

Function 005D25A0 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 005D25E7
GetLastError.KERNEL32 ref: 005D25F4

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: d3e3695f099522d60ea492c52065fb6a30d607a664fb07b6df682f64893a2121
Instruction ID: 60f502e123e0083fe0d7d7576fa610a9c8c8ccda9b5f94bc9934345e2dc8ed31
Opcode Fuzzy Hash: d3e3695f099522d60ea492c52065fb6a30d607a664fb07b6df682f64893a2121
Instruction Fuzzy Hash: 0011C270600711ABD7348A2CD848BA67BE9BF54370F604A6BE052D26D0EB74FD45DA61

Uniqueness

Uniqueness Score: -1.00%

Function 005F1B47 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005F1B68

Part of subcall function 005F0A15: RtlAllocateHeap.NTDLL(00000000,?,?,?,005EB819,?,0000015D,?,?,?,?,005ECCF5,000000FF,00000000,?,?), ref: 005F0A47

HeapReAlloc.KERNEL32(00000000,?,?,00000004,00000000,?,005F3447,?,00000004,00000000,?,?,?,005EFD26,?,00000000), ref: 005F1BA4

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 9c5cdf2072fd9ccab9dbe8e105ece6021391bc4fbb2f06f0f146b5e454d254d9
Instruction ID: 23e7d708a020a16332b0307625c750fb9d000e90626c7dacd23ac6518549773d
Opcode Fuzzy Hash: 9c5cdf2072fd9ccab9dbe8e105ece6021391bc4fbb2f06f0f146b5e454d254d9
Instruction Fuzzy Hash: DAF0C231200A0EE68B212A75AC08E7B3F18BFC1BB0B144026FA54971D2FE3CD80195A9

Uniqueness

Uniqueness Score: -1.00%

Function 005D2F82 Relevance: 3.0, APIs: 2, Instructions: 38COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,?,?,?,005D2DA6,?,?), ref: 005D2FA2

Part of subcall function 005D3C9D: _wcslen.LIBCMT ref: 005D3CD8

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,?,005D2DA6,?,?), ref: 005D2FD1

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 79734788734a3083a044046203dc5bae99bc97cdf20093a72302db82996c57be
Instruction ID: ee0ebb8c7aa714cf621ae95bdc9321f7ef97604620b1c3def1f53fba435f13fa
Opcode Fuzzy Hash: 79734788734a3083a044046203dc5bae99bc97cdf20093a72302db82996c57be
Instruction Fuzzy Hash: 39F0F03020121AABDB10AF249C09AEF7BACBF18344F408056F945E3251DB38DE48DB65

Uniqueness

Uniqueness Score: -1.00%

Function 005D2A9E Relevance: 3.0, APIs: 2, Instructions: 36fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,?,005D1E7B,?,?,005D1CB2,?,?,?,B0DADE4A,?,005F9AB4,000000FF), ref: 005D2ABB

Part of subcall function 005D3C9D: _wcslen.LIBCMT ref: 005D3CD8

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,?,005D1E7B,?,?,005D1CB2,?,?,?,B0DADE4A), ref: 005D2AE7

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 927d3a223062e68f09aee468d301f6c4ef3c0a9bf5a82992d208a15cabd731a3
Instruction ID: a522e5c21b17a07f726e8257832a700ebc8fbbaf5bb449ecfd2e4cdd9485e061
Opcode Fuzzy Hash: 927d3a223062e68f09aee468d301f6c4ef3c0a9bf5a82992d208a15cabd731a3
Instruction Fuzzy Hash: 51F024302112299BDB10DF349C08EEF77ACBF28340F404067BA41D3240EE78EE48ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 005D2B16 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 005D2B33

Part of subcall function 005D3C9D: _wcslen.LIBCMT ref: 005D3CD8

GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 005D2B5D

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: dd12d2c3e9ec59da0bb532f079a034b7fba6ad1104cc43ccade23f3003ac0093
Instruction ID: c8cf6c7b1a3656a6ed5148ebd63362261c3846a2d565caf12e73b9313824fe90
Opcode Fuzzy Hash: dd12d2c3e9ec59da0bb532f079a034b7fba6ad1104cc43ccade23f3003ac0093
Instruction Fuzzy Hash: 30F0B4316001189BD720EF689C089EEB7ACBB59761F0001A7FA85E3290DA789D049B95

Uniqueness

Uniqueness Score: -1.00%

Function 005E57C2 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 005E57F8

Part of subcall function 005D30BD: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005D30D0

SetDlgItemTextW.USER32(00000065,?), ref: 005E580F

Part of subcall function 005E2DC4: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005E2DD5
Part of subcall function 005E2DC4: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005E2DE6
Part of subcall function 005E2DC4: IsDialogMessageW.USER32(?,?), ref: 005E2DFA
Part of subcall function 005E2DC4: TranslateMessage.USER32(?), ref: 005E2E08
Part of subcall function 005E2DC4: DispatchMessageW.USER32(?), ref: 005E2E12

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 094a723dd1ce9f48e6e6a3fa7d216a6f5a4d6ee0deb24ba45ef0f88ec60b2405
Instruction ID: a755a3119f935377db328c3cb9a96c5cdce53971029f51bbcb46999b49bd00e2
Opcode Fuzzy Hash: 094a723dd1ce9f48e6e6a3fa7d216a6f5a4d6ee0deb24ba45ef0f88ec60b2405
Instruction Fuzzy Hash: 5FF05931A012496BEB11EF69CC0EEDF7FACAF08341F040092F245E31A3DA749A018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 005EF86C Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 005F3370: GetEnvironmentStringsW.KERNEL32 ref: 005F3379
Part of subcall function 005F3370: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005F339C
Part of subcall function 005F3370: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005F33C2
Part of subcall function 005F3370: _free.LIBCMT ref: 005F33D5
Part of subcall function 005F3370: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 005F33E4

_free.LIBCMT ref: 005EF8B2
_free.LIBCMT ref: 005EF8B9

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 400815659-0
Opcode ID: 32315672285296d03d0af57288c0164927cf98d83683eea8d35bc781ab3b74c4
Instruction ID: 144b3ddc6091ad6b7cf877822613a08e406904b06fe35b3a19edc1ccdcc116ef
Opcode Fuzzy Hash: 32315672285296d03d0af57288c0164927cf98d83683eea8d35bc781ab3b74c4
Instruction Fuzzy Hash: 4FE0E52B60859202B22932BB6C4AA3E1E127FC1371F141776FA95C64C3DE58880362D7

Uniqueness

Uniqueness Score: -1.00%

Function 005D72B7 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005D72E0
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0060F038,?,005D6013,Crypt32.dll,00000000,005D608D,?,?,005D6070,00000000), ref: 005D7300

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 7daa724ff9f0f890982e1677753e43192b0c05ff91f5370628197482d4661557
Instruction ID: e7e764008087ba15c5afd7aa3cf55ada4e38ccd31bf780f0bf515360a6e8152e
Opcode Fuzzy Hash: 7daa724ff9f0f890982e1677753e43192b0c05ff91f5370628197482d4661557
Instruction Fuzzy Hash: B0F05471A00159ABCB11DF69DC09EDFBBBCAB59741F004066B645D3110DA78EE48CA65

Uniqueness

Uniqueness Score: -1.00%

Function 005D53E8 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

LoadStringW.USER32(005D16CF,?,?,005D16CF), ref: 005D5418
LoadStringW.USER32(005D16CF,?,?), ref: 005D542F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: db2397d802893f46e3c5e44006725c37f4a4b3c31809e46f88417ff74ba990af
Instruction ID: 97c6ece7d99a72ffda4330c18f058b9bcb4f5f94fa6cdce3d8f0f0476556e719
Opcode Fuzzy Hash: db2397d802893f46e3c5e44006725c37f4a4b3c31809e46f88417ff74ba990af
Instruction Fuzzy Hash: E4F0F831100219BBDF211F55EC09CEB7F6AFF55391B04A416FE0486230D73298A1EBE0

Uniqueness

Uniqueness Score: -1.00%

Function 005E2461 Relevance: 3.0, APIs: 2, Instructions: 31comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,005F9DB5,000000FF), ref: 005E249F
OleUninitialize.OLE32(?,?,?,?,005F9DB5,000000FF), ref: 005E24A4

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 7d3f3c31de36b0e227ca47ada53d6d733b89822bf0995040e74e42eb72233b87
Instruction ID: 62a8174259beef230df3937b860f3561259b17e68c5eb54f8b03614604eae320
Opcode Fuzzy Hash: 7d3f3c31de36b0e227ca47ada53d6d733b89822bf0995040e74e42eb72233b87
Instruction Fuzzy Hash: 84F08276644A44AFDB00DF49DC05B5AFBA9FB89B60F004226E916D3761DB35A800CA90

Uniqueness

Uniqueness Score: -1.00%

Function 005E1A6D Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 005E1A8E
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 005E1A95

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: cfc58dc706ac00789025a8bd3c0e4f77d9ce145b004cd87c63d90e404b833308
Instruction ID: 46f161c64926bf8c305f42bb729b9d3ee23c390c4259037876a940bb154efb3a
Opcode Fuzzy Hash: cfc58dc706ac00789025a8bd3c0e4f77d9ce145b004cd87c63d90e404b833308
Instruction Fuzzy Hash: 29E06DB5901209EFCB24DF45D5056ADBBE8FB04390F10806BE88693200D270AE409B90

Uniqueness

Uniqueness Score: -1.00%

Function 005E9FAC Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005E9FCA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 005E9FD5

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 9ce56593044fc24e05b28afe3149015877642e78baa4cde1b29c64b0631fbb26
Instruction ID: 20a61ef25d89ebb05f8c5fe4ca714b157169389d16a4783e27803eff7dc7a1a9
Opcode Fuzzy Hash: 9ce56593044fc24e05b28afe3149015877642e78baa4cde1b29c64b0631fbb26
Instruction Fuzzy Hash: 20D023705243C3047E0D7773380E5571F453BC17757A00746F0F0C55C1EF214180A595

Uniqueness

Uniqueness Score: -1.00%

Function 005D11D1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 005D11E6
ShowWindow.USER32(00000000), ref: 005D11ED

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: c453a8b1da6a677a2e3eebcc4b08ce45c8b86d632007a95ca05552d360b64b90
Instruction ID: c1224bcaad395ba5a71db939f2a2f71357b460580c1fe764befff9fde1128a92
Opcode Fuzzy Hash: c453a8b1da6a677a2e3eebcc4b08ce45c8b86d632007a95ca05552d360b64b90
Instruction Fuzzy Hash: 7BC01232058240BECB010BB0DC19D2EBBAAABA5312F00E909B2A5C0060C338C010DB91

Uniqueness

Uniqueness Score: -1.00%

Function 005DBCE6 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 005DBD07

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: b82a011533106c98191ed00dd4eba617e8eea2c8686256a521a9a46b93368216
Instruction ID: 51704707e73d79fad8ee6f47d4394f05255c29d02d69f351f964eeeefe7ff51f
Opcode Fuzzy Hash: b82a011533106c98191ed00dd4eba617e8eea2c8686256a521a9a46b93368216
Instruction Fuzzy Hash: B7317376701210CFDB14DF2CAC54BA97BA7FBA8710B1A913BE905D7361D730AC058B91

Uniqueness

Uniqueness Score: -1.00%

Function 005F20D8 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 005F2138

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 06f00cba8407240f8f5fa92b64db9210183f99d8d1543acc43928ee81d4b3ecd
Instruction ID: cf6a9489ff84cd2f69b77aac07694cd6b8811159816de0496d4cd492eaf77967
Opcode Fuzzy Hash: 06f00cba8407240f8f5fa92b64db9210183f99d8d1543acc43928ee81d4b3ecd
Instruction Fuzzy Hash: E71123B7A406299BDB26DE28EC41C7B7B96BB80360F164220FF15AB254DB34DC01CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 005F38B9 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 005F2576: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,005F07C3,00000001,00000364,?,005EBC07,?,?,?,005EB682,00000050,?), ref: 005F25B7

_free.LIBCMT ref: 005F3925

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction ID: d4f435e0dd67d8a27fc9378735e64dd805b1315593ed0c142ada2551fe48a79f
Opcode Fuzzy Hash: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction Fuzzy Hash: F301D6726003096BE7218E65D88596AFFE9FB85370F25092DE694872C0EA74A905C764

Uniqueness

Uniqueness Score: -1.00%

Function 005DB94A Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005DB951

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: bb78e5d4d670b3321c937dfe3ad842fe9172b63b6b1a4cb27f655631b3a779db
Instruction ID: d0f943c547ef7b651f75a36c0f6cdea4c885465286881c10565f9c89954ea712
Opcode Fuzzy Hash: bb78e5d4d670b3321c937dfe3ad842fe9172b63b6b1a4cb27f655631b3a779db
Instruction Fuzzy Hash: 45F022B2B00286DBAB14AB7D485656DAEE6BB943907040527E5A6E3391DF388D014661

Uniqueness

Uniqueness Score: -1.00%

Function 005F2576 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,005F07C3,00000001,00000364,?,005EBC07,?,?,?,005EB682,00000050,?), ref: 005F25B7

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4c4275a522bdc637854b11478a49dd306da407decde062b42be5e855ba8583e1
Instruction ID: 73cfef91d8b9676f0d1525a597bcac8f91882662a87b4117d6b74b56b35b35f1
Opcode Fuzzy Hash: 4c4275a522bdc637854b11478a49dd306da407decde062b42be5e855ba8583e1
Instruction Fuzzy Hash: 63F0B4B114522D679B212A729C2AE7A3F49BB81760F148021EA08AF185EA6CDD0096F1

Uniqueness

Uniqueness Score: -1.00%

Function 005D1297 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005D129E

Part of subcall function 005D5F37: __EH_prolog3.LIBCMT ref: 005D5F3E

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 89a7f830b9219e53a3687fe9b3a62c1594ceed37cc9a3febf733f2bf900622ce
Instruction ID: bf7f1e92625db5cf10b326331b7dc8f76e0751d1c97309c25e4cf36dd97f8479
Opcode Fuzzy Hash: 89a7f830b9219e53a3687fe9b3a62c1594ceed37cc9a3febf733f2bf900622ce
Instruction Fuzzy Hash: 95011A70906B4ADAD725EBB895596DEFEE07FA4300F50044FA0AA43382DFB82705CA52

Uniqueness

Uniqueness Score: -1.00%

Function 005F0A15 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,005EB819,?,0000015D,?,?,?,?,005ECCF5,000000FF,00000000,?,?), ref: 005F0A47

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 507ae863e168053d9c4b9530768797af4d107baa2a7138847538d5c54d94ae07
Instruction ID: bba5e8f39b8d1e7cbe9f22c460f950543bd598cbf216c0bb3e3309fc85554a20
Opcode Fuzzy Hash: 507ae863e168053d9c4b9530768797af4d107baa2a7138847538d5c54d94ae07
Instruction Fuzzy Hash: A1E0E53211075E5BD72126719C09B7B7F88BB813A0F1D7020EFC5920C3DB68CC40C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 005D1D00 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,005D1CB9,?,?,?,B0DADE4A,?,005F9AB4,000000FF), ref: 005D1D1B

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e7ba10d32a697c7dd48c934c40ff90ff819b30e513dd925f5c1927cb86065d93
Instruction ID: a4943017cae2e6ec9972b502b4f1a6f97965c50a99caf6cca6e94c3d8a88672d
Opcode Fuzzy Hash: e7ba10d32a697c7dd48c934c40ff90ff819b30e513dd925f5c1927cb86065d93
Instruction Fuzzy Hash: 95F0BE30481F15AEDB30AE28C448392BBEABB15321F045B1FC0F24BAE0E370698D8A00

Uniqueness

Uniqueness Score: -1.00%

Function 005D3102 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 005D3230: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,005D3127,000000FF,?,?), ref: 005D326E
Part of subcall function 005D3230: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,005D3127,000000FF,?,?), ref: 005D329E
Part of subcall function 005D3230: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,005D3127,000000FF,?,?), ref: 005D32AA

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 005D312D

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 27269a0f7390df52d8c791af35ab41cf592e5e46b99c398692d4ce09238f74ed
Instruction ID: df9a12b6624a41ff15213d403c14dca59ab4b1ab71fb8691cac619b994358a6d
Opcode Fuzzy Hash: 27269a0f7390df52d8c791af35ab41cf592e5e46b99c398692d4ce09238f74ed
Instruction Fuzzy Hash: CCF05435409792AACB725BFC8408BCB7F947F66371F048A4BF1FD52291C2655095D723

Uniqueness

Uniqueness Score: -1.00%

Function 005D2796 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 005D27BF

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e90a2e59d57a5f975f9a5411467612b07dfdae7439d66803f9730f76c4d5031a
Instruction ID: 773a425a7b65e76d427077cefbaac1495d5499385538c3449c5001ab02c93177
Opcode Fuzzy Hash: e90a2e59d57a5f975f9a5411467612b07dfdae7439d66803f9730f76c4d5031a
Instruction Fuzzy Hash: 8DE026722011024B873CE738C15A91E7AD1BFB0366B24862FF06AC67C2EB30CD108305

Uniqueness

Uniqueness Score: -1.00%

Function 005E1CD6 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 005E1CDC

Part of subcall function 005E1A6D: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 005E1A8E

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 4ef5063e488502806db15625da35d28d8a145a19936063d8a6f5dd054aa64087
Instruction ID: 02860ca32ca8d447e054c04c743d6243921abef4714b297cee0df6439c61074e
Opcode Fuzzy Hash: 4ef5063e488502806db15625da35d28d8a145a19936063d8a6f5dd054aa64087
Instruction Fuzzy Hash: F8D0A73024064A76DF092B228C0697E7EE9BB50380F1080317CC5C5140EDB1CD105595

Uniqueness

Uniqueness Score: -1.00%

Function 005E5636 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,005D80C7), ref: 005E565B

Part of subcall function 005E2DC4: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005E2DD5
Part of subcall function 005E2DC4: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005E2DE6
Part of subcall function 005E2DC4: IsDialogMessageW.USER32(?,?), ref: 005E2DFA
Part of subcall function 005E2DC4: TranslateMessage.USER32(?), ref: 005E2E08
Part of subcall function 005E2DC4: DispatchMessageW.USER32(?), ref: 005E2E12

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 6a44ec4e26ce821f2683005ed4f3606cd8858d2a2c936c1a4456a5c438adc745
Instruction ID: 8411c5fa58fe54e12d4bc4810f9bf211a170da73c903ac21990c3a80cf41cc4f
Opcode Fuzzy Hash: 6a44ec4e26ce821f2683005ed4f3606cd8858d2a2c936c1a4456a5c438adc745
Instruction Fuzzy Hash: 3CD09E31144301BAE7162B51CE06F0B7EA6BB88B04F405555B389340F2C7629D629F15

Uniqueness

Uniqueness Score: -1.00%

Function 005E5E97 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E5E9F

Part of subcall function 005E617C: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E6187
Part of subcall function 005E617C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E61EF
Part of subcall function 005E617C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6200

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 8f9739340cc994834dbbfd9a99b3e2c4b6cbbccb5d8666f3513c3337ef8fae61
Instruction ID: ab33540f9066a9943bb038c99b6f4c1767a27bb37394bae06e87f1e4ef14b897
Opcode Fuzzy Hash: 8f9739340cc994834dbbfd9a99b3e2c4b6cbbccb5d8666f3513c3337ef8fae61
Instruction Fuzzy Hash: 0FA002F72E91537C750E62576D0BC7B563DD4EAFA233185AEF440C81E2AC812D458032

Uniqueness

Uniqueness Score: -1.00%

Function 005D2629 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,005DAF3C), ref: 005D262C

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 32d979d4a2ddebe0af331253e8334dc35ea12efa7f8482bb53226ae53a86ef29
Instruction ID: 1105c5c6c31b486b8badbc427d67318cb6c452a56560a98f4cd2fd109ff7f535
Opcode Fuzzy Hash: 32d979d4a2ddebe0af331253e8334dc35ea12efa7f8482bb53226ae53a86ef29
Instruction Fuzzy Hash: 1FA01230440109468D001B30D9080183711E7207C030001A4500ACA061CB16480BD602

Uniqueness

Uniqueness Score: -1.00%

Function 005E22D8 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?), ref: 005E22DC

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 60cadbd3ecf926485f007ec2d91dc7d32d91f92e2415eb7b737c0170e8f00267
Instruction ID: ecfa21fa4391ba07414e7554721debf091267bd714f578f6e92e9812d26d58e9
Opcode Fuzzy Hash: 60cadbd3ecf926485f007ec2d91dc7d32d91f92e2415eb7b737c0170e8f00267
Instruction Fuzzy Hash: 44A012701001008782000B209E89D0E76595F60600B04C0246009C0030CB348868F502

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 005E3AC0 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 240windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005D11F6: GetDlgItem.USER32(00000000,00003021), ref: 005D123A
Part of subcall function 005D11F6: SetWindowTextW.USER32(00000000,005FA584), ref: 005D1250

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 005E3B62
EndDialog.USER32(?,00000006), ref: 005E3B75
GetDlgItem.USER32(?,0000006C), ref: 005E3B91
SetFocus.USER32(00000000), ref: 005E3B98
SetDlgItemTextW.USER32(?,00000065,?), ref: 005E3BCC
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 005E3BFF
FindFirstFileW.KERNEL32(?,?), ref: 005E3C15

Part of subcall function 005E22EA: FileTimeToSystemTime.KERNEL32(?,?), ref: 005E2310
Part of subcall function 005E22EA: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 005E2327
Part of subcall function 005E22EA: SystemTimeToFileTime.KERNEL32(?,?), ref: 005E233B
Part of subcall function 005E22EA: FileTimeToSystemTime.KERNEL32(?,?), ref: 005E234C
Part of subcall function 005E22EA: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 005E2364
Part of subcall function 005E22EA: GetTimeFormatW.KERNEL32(00000400,?,?,00000000,00000000,00000032), ref: 005E2388
Part of subcall function 005E22EA: _swprintf.LIBCMT ref: 005E23A7

_swprintf.LIBCMT ref: 005E3C64

Part of subcall function 005D30BD: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005D30D0

SetDlgItemTextW.USER32(?,0000006A,?), ref: 005E3C77
FindClose.KERNEL32(00000000), ref: 005E3C7E
_swprintf.LIBCMT ref: 005E3CD3
SetDlgItemTextW.USER32(?,00000068,?), ref: 005E3CE6
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 005E3D00
_swprintf.LIBCMT ref: 005E3D39
SetDlgItemTextW.USER32(?,0000006B,?), ref: 005E3D4C
_swprintf.LIBCMT ref: 005E3D9C
SetDlgItemTextW.USER32(?,00000069,?), ref: 005E3DAF

Part of subcall function 005E2758: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 005E278E
Part of subcall function 005E2758: GetNumberFormatW.KERNEL32(00000400,00000000,?,0060560C,?,?), ref: 005E27D7

Strings

REPLACEFILEDLG, xrefs: 005E3AFC
%s %s, xrefs: 005E3C51, 005E3C5D, 005E3CC9, 005E3D2F, 005E3D92
y^^, xrefs: 005E3BEC
8]^, xrefs: 005E3B6D

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Item$Time$Text$_swprintf$FileSystem$FormatMessageSend$Find$CloseDateDialogFirstFocusInfoLocalLocaleNumberSpecificWindow__vswprintf_c_l
String ID: %s %s$8]^$REPLACEFILEDLG$y^^
API String ID: 3464475507-2729618869
Opcode ID: 14900a15cbf2b56aa14324f17161ec1515c0e82fc95bb07d9ad46aefb3af9506
Instruction ID: 3f0dd5e8f0e3bfe9880a6543427b4f47387e7ca924af556a68aebed65d5f9d82
Opcode Fuzzy Hash: 14900a15cbf2b56aa14324f17161ec1515c0e82fc95bb07d9ad46aefb3af9506
Instruction Fuzzy Hash: 6C719072644384BBE3349B659C4DFFF7BADBB85751F00081AB78AD3180D7759A048B62

Uniqueness

Uniqueness Score: -1.00%

Function 005F4D2E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 005F4E74

Strings

1#INF, xrefs: 005F6081
1#IND, xrefs: 005F606C
1#SNAN, xrefs: 005F6073
1#QNAN, xrefs: 005F607A

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 004ea25de6cfb3fe23f8c307599bf263a56be38b43df9f7b2ccc90c06f72e696
Instruction ID: ed634758668c7a5663378a1960a7de04be5171ff5590e8ff8286d1e3e872fd49
Opcode Fuzzy Hash: 004ea25de6cfb3fe23f8c307599bf263a56be38b43df9f7b2ccc90c06f72e696
Instruction Fuzzy Hash: 6BC23871E04A2C8FDB25CE289D447EABBB9FB44305F1545EAD64DE7240E778AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 005E7150 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 005E715C
IsDebuggerPresent.KERNEL32 ref: 005E7228
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005E7248
UnhandledExceptionFilter.KERNEL32(?), ref: 005E7252

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1c4415b687fac4fb30482e732e44ed639b0cac4cf0cb65fc82f5a6551c325684
Instruction ID: 25812dcb124f9238f8c4c85f32cd702844c4c3758d4d1599af7c580c6c8874c1
Opcode Fuzzy Hash: 1c4415b687fac4fb30482e732e44ed639b0cac4cf0cb65fc82f5a6551c325684
Instruction Fuzzy Hash: A7313AB5D0521D9BDF20DFA5D989BCDBBB8BF08300F10419AE44CAB250EB745A84DF05

Uniqueness

Uniqueness Score: -1.00%

Function 005E5FC2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,005E5F07,0000001C,005E60FC,00000000,?,?,?,?,?,?,?,005E5F07,00000004,0063A284,005E618C), ref: 005E5FD3
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,005E5F07,00000004,0063A284,005E618C), ref: 005E5FEE

Strings

D, xrefs: 005E5FE2

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 877b1c44c35a2cd2b59b2ec41ba99dbdcfb9b35006d57f0993f8997ea2ae59d1
Instruction ID: a3f85d4ddb830a4cef306a58f0656982a91ea2b725b6a659f9201aa89cdc713b
Opcode Fuzzy Hash: 877b1c44c35a2cd2b59b2ec41ba99dbdcfb9b35006d57f0993f8997ea2ae59d1
Instruction Fuzzy Hash: 3D01D8726001195BCB14DE25CC05AEE7FA9AFD4364F08C120ED59D7241EA38D805C680

Uniqueness

Uniqueness Score: -1.00%

Function 005EB27F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 005EB377
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 005EB381
UnhandledExceptionFilter.KERNEL32(005F04F0,?,?,?,?,?,00000000), ref: 005EB38E

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 212de10ee255369e992052b532023ff70efb0406d8e0d02425dd4604b513c62a
Instruction ID: d10cf4fb067c8429e984666d1cbe5ba6770d81b41d33588357fd54b2e2e4e8c6
Opcode Fuzzy Hash: 212de10ee255369e992052b532023ff70efb0406d8e0d02425dd4604b513c62a
Instruction Fuzzy Hash: DD31F4B4D0121D9BCB25DF69D889B9DBBB8BF08310F5045DAE80CA7250E7349F858F45

Uniqueness

Uniqueness Score: -1.00%

Function 005F4880 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49489749f54f28f3097e8714dfbf17a7810cc0e3605ef14d33faeef21e6f23b
Instruction ID: ac3efdae5ed37522ffc6e9390c9f76379e4f3f3e896f6ea3f6a3a62540dd299f
Opcode Fuzzy Hash: c49489749f54f28f3097e8714dfbf17a7810cc0e3605ef14d33faeef21e6f23b
Instruction Fuzzy Hash: 6D023B71E002199BDF14CFA9C8806AEBBF1FF88314F25816AD919E7345D735AE418F94

Uniqueness

Uniqueness Score: -1.00%

Function 005E2758 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 005E278E
GetNumberFormatW.KERNEL32(00000400,00000000,?,0060560C,?,?), ref: 005E27D7

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 2a7ab44aced036fbfc1bb9f1025dbab7b4322d1a785571710eea478da6a7d599
Instruction ID: da1a0c68e63c5a955f1520e88790c855fad7ff8c5f4cc343c4b11c3cc60de53c
Opcode Fuzzy Hash: 2a7ab44aced036fbfc1bb9f1025dbab7b4322d1a785571710eea478da6a7d599
Instruction Fuzzy Hash: 22118E75260308AAE710DF64DC05FAF77BAFF48300F40542AB902E72A1D774AA05CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 005D193A Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(005D1AB5,?,00000400), ref: 005D193A
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 005D195B

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 2e76a3590e88fd344ac141f88b0695df1c629dbf95df75acdefbbebee716cbeb
Instruction ID: 4a7bcdcc462a8b09421d0758c5f64e4f2e5080aa286ffd7c7d5c13699441ff17
Opcode Fuzzy Hash: 2e76a3590e88fd344ac141f88b0695df1c629dbf95df75acdefbbebee716cbeb
Instruction Fuzzy Hash: 23D0C971384300BBFA210F615C1AF2A7B9DBB65B52F14C406F759E90E0DA749428F62E

Uniqueness

Uniqueness Score: -1.00%

Function 005DCD21 Relevance: 1.9, Strings: 1, Instructions: 621COMMON

Download Yara Rule

Strings

RP.exe, xrefs: 005DCD36

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID:
String ID: RP.exe
API String ID: 0-475558011
Opcode ID: 2d5e19679cd6952ff4f8871ab6d6cfe77991bbd8d20b29498c6d4e57c2573546
Instruction ID: 0045ad21a4a0681ae7610d8f30a0a148034c9bd90c6b422e8bb39525080550a9
Opcode Fuzzy Hash: 2d5e19679cd6952ff4f8871ab6d6cfe77991bbd8d20b29498c6d4e57c2573546
Instruction Fuzzy Hash: D522AD715047528BCB34DF6CD88456ABFB6FBD4320F144A2FE89297391E770A905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 005F8E34 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,005F8E2F,?,?,00000008,?,?,005F8ACF,00000000), ref: 005F9061

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 9e69fc5dcf07abc0104306f80a4de10cbe95eba1291e5b5b88d5cf9b433eefc5
Instruction ID: dd17238cfe75e9732fa9791f65afa729e5ed7fcc3f6471ab41f474d512061511
Opcode Fuzzy Hash: 9e69fc5dcf07abc0104306f80a4de10cbe95eba1291e5b5b88d5cf9b433eefc5
Instruction Fuzzy Hash: 22B14A312106099FD715CF28C48AB757FE1FF45364F298658EAAACF2A1C739E981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 005D33B7 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 005D33E8

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 12d4eabf7c03c7d0a3c46a89f16fb255124a706fd653569f73523482f8b78e0c
Instruction ID: 0c747b4097d4234e2c64d964e3ce599f6631958d0ec080eba07a538b7508f35d
Opcode Fuzzy Hash: 12d4eabf7c03c7d0a3c46a89f16fb255124a706fd653569f73523482f8b78e0c
Instruction Fuzzy Hash: 21018171E44248CFDB24CF68EC497AE7BB2BB58304F50521AD91A93391DB78AD05CF41

Uniqueness

Uniqueness Score: -1.00%

Function 005E72F5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00017310,005E6DB5), ref: 005E72FA

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 115cf1740f22df311c197eca1abae4832669e8cb3329f73ad771242b32ee496f
Instruction ID: f28ed04af6008d0bcac454c1bbfb1808990606c534b2bcd0ba1355b6b27d727d
Opcode Fuzzy Hash: 115cf1740f22df311c197eca1abae4832669e8cb3329f73ad771242b32ee496f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 005D7228 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

, xrefs: 005D725B

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 934ccf0cd4b67d897cb7c2438ec395f92651c0feaeced376863ec7c5dca47e2e
Instruction ID: a0740e1a5104b62a2093559a461f5e4c19976c132e94b62ea4723596b135736c
Opcode Fuzzy Hash: 934ccf0cd4b67d897cb7c2438ec395f92651c0feaeced376863ec7c5dca47e2e
Instruction Fuzzy Hash: 08113D7590C74A9ED7398F6D884575ABBE5FB08704F10C82FE4AAE2781E371A540CB44

Uniqueness

Uniqueness Score: -1.00%

Function 005F3470 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 005F3470

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: eaddb882bb3d8c36d1d7a0c0cde8b2354fe64a3684f960dcb2a1c1a0ad31a874
Instruction ID: f34942384d8322df711ba5fb4c6d0280c6485c0fbda385aa37356002d4e0928a
Opcode Fuzzy Hash: eaddb882bb3d8c36d1d7a0c0cde8b2354fe64a3684f960dcb2a1c1a0ad31a874
Instruction Fuzzy Hash: 93A012702001018F43004F315A0C209369A550418070150145008C0120DB3C4414EF03

Uniqueness

Uniqueness Score: -1.00%

Function 005D61C8 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a84525bc548eb4d4a82d1c1ab340644d5272c3bb2f45bad087f188ab8d8dd17c
Instruction ID: 509f2ee488e9dd27150b78c2d8d8d112732e318076e08ff2fd473c1d48f879a0
Opcode Fuzzy Hash: a84525bc548eb4d4a82d1c1ab340644d5272c3bb2f45bad087f188ab8d8dd17c
Instruction Fuzzy Hash: 21524972A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Uniqueness

Uniqueness Score: -1.00%

Function 005D5769 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb976404bbbedd12ae205243a757240b779681391ce8c29cba82dcd37f6840c
Instruction ID: bbcaaa6df370474d733709a15faf57325ef1cb077b517586189cf10809c40510
Opcode Fuzzy Hash: 4eb976404bbbedd12ae205243a757240b779681391ce8c29cba82dcd37f6840c
Instruction Fuzzy Hash: 67D13C745082D18FC704CF19E89086BBFF1AB9A310B489A5FF5D587392C235EA1ADF61

Uniqueness

Uniqueness Score: -1.00%

Function 005EC75C Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d50ad095a4287b724dc8df1a2f4542f7022b17b6bdcfbf93d4f4b015bfb542
Instruction ID: e42dd61862bc5a75f531832cb0199277ed844ecb194abf1b63458b9480588d4b
Opcode Fuzzy Hash: 38d50ad095a4287b724dc8df1a2f4542f7022b17b6bdcfbf93d4f4b015bfb542
Instruction Fuzzy Hash: 5061CD726047C956DE3C9A2B8A49BBE2F96FB41340F14081EE9C3DB282D711EC43C755

Uniqueness

Uniqueness Score: -1.00%

Function 005EC52D Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: c44dcf049fd294cb2a4e493c4c61cc0ee4c30d54779daa6ef0b02d37a5b8244d
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 655177B26006C54BDF3C892F49997BF2F95BB42304F18192BE5C3CB292C645EE439351

Uniqueness

Uniqueness Score: -1.00%

Function 005D5D20 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798a5a787dcccb3e87eba68ab1b92fb4fc0f5f22ced7bbbbefdd573c48c40eea
Instruction ID: caa550556263ecf0090042122ec21b292b7a8cd452f7e58caa4396fb98c339d6
Opcode Fuzzy Hash: 798a5a787dcccb3e87eba68ab1b92fb4fc0f5f22ced7bbbbefdd573c48c40eea
Instruction Fuzzy Hash: 2C51D2315087964EC721EF2CC54446FBFE5BEDA314F4A489BE4D64B242E220DB4ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 005D5064 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 240COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 005D50A4

Part of subcall function 005D30BD: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005D30D0

Part of subcall function 005D836E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,005D50C0,?,00000000,00000000,?,?,?,005D50C0,?,?,00000050), ref: 005D838B

SetDlgItemTextW.USER32(?,00605154,?), ref: 005D511E
GetWindowRect.USER32(?,?), ref: 005D5154
GetClientRect.USER32(?,?), ref: 005D5160
GetWindowLongW.USER32(?,000000F0), ref: 005D520B
GetWindowRect.USER32(?,?), ref: 005D523B
SetWindowTextW.USER32(?,?), ref: 005D526A
GetSystemMetrics.USER32(00000008), ref: 005D5272
GetWindow.USER32(?,00000005), ref: 005D527D
GetWindowRect.USER32(00000000,?), ref: 005D52AD
GetWindow.USER32(00000000,00000002), ref: 005D531F

Strings

CAPTION, xrefs: 005D5252
v[^, xrefs: 005D522F, 005D5316
$%s:, xrefs: 005D508D
TQ`, xrefs: 005D50D9
d, xrefs: 005D5180

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_swprintf
String ID: $%s:$CAPTION$TQ`$d$v[^
API String ID: 3208934588-4219603923
Opcode ID: 0759657c4539853bde7b84870c28c336e458d6571883e483a9d7b4cc3e9f3093
Instruction ID: 7eb5f2618db8914c9226daa56f41ef50dfaf6355e4b6ea58808374c553959e6b
Opcode Fuzzy Hash: 0759657c4539853bde7b84870c28c336e458d6571883e483a9d7b4cc3e9f3093
Instruction Fuzzy Hash: 12818C72508301AFD724DF68CD89A6FBBE9FBC9704F40191EFA8596250E774E8098B52

Uniqueness

Uniqueness Score: -1.00%

Function 005F3F62 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 005F3FA6

Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3B5E
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3B70
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3B82
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3B94
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3BA6
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3BB8
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3BCA
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3BDC
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3BEE
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3C00
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3C12
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3C24
Part of subcall function 005F3B41: _free.LIBCMT ref: 005F3C36

_free.LIBCMT ref: 005F3F9B

Part of subcall function 005F08EA: RtlFreeHeap.NTDLL(00000000,00000000,?,005F3CD6,?,00000000,?,00000000,?,005F3CFD,?,00000007,?,?,005F40FA,?), ref: 005F0900
Part of subcall function 005F08EA: GetLastError.KERNEL32(?,?,005F3CD6,?,00000000,?,00000000,?,005F3CFD,?,00000007,?,?,005F40FA,?,?), ref: 005F0912

_free.LIBCMT ref: 005F3FBD
_free.LIBCMT ref: 005F3FD2
_free.LIBCMT ref: 005F3FDD
_free.LIBCMT ref: 005F3FFF
_free.LIBCMT ref: 005F4012
_free.LIBCMT ref: 005F4020
_free.LIBCMT ref: 005F402B
_free.LIBCMT ref: 005F4063
_free.LIBCMT ref: 005F406A
_free.LIBCMT ref: 005F4087
_free.LIBCMT ref: 005F409F

Strings

HX`, xrefs: 005F404E

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: HX`
API String ID: 161543041-3189289838
Opcode ID: 7fa0f5825d1edb474a60ded467dcff76e630039a66f31312ee362d2f15a6b234
Instruction ID: 1fae2d2ff6d7638c21e9bd4cd5768d188edfc1beb16e0c89e34f95c039474ed3
Opcode Fuzzy Hash: 7fa0f5825d1edb474a60ded467dcff76e630039a66f31312ee362d2f15a6b234
Instruction Fuzzy Hash: 0A315E3190020A9FEB20AA78D849B7BBBE9FF40750F14542AF649DB191DF3DAD84DB50

Uniqueness

Uniqueness Score: -1.00%

Function 005E4F4E Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 005E4F80
GetClassNameW.USER32(00000000,?,00000800), ref: 005E4FAC

Part of subcall function 005D854C: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,005D3763,?,?,?,005D3710,?,-00000002,?,00000000,?), ref: 005D8562

GetWindowLongW.USER32(00000000,000000F0), ref: 005E4FC8
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 005E4FDF
GetObjectW.GDI32(00000000,00000018,?), ref: 005E4FF3
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 005E501C
DeleteObject.GDI32(00000000), ref: 005E5023
GetWindow.USER32(00000000,00000002), ref: 005E502C

Strings

STATIC, xrefs: 005E4FB2
Pl)uq]^, xrefs: 005E4FF3

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: Pl)uq]^$STATIC
API String ID: 3820355801-1210463451
Opcode ID: 1b950b338da2f55a01d959dd164b090fa2b752f423bf6fc754d6f16686098884
Instruction ID: 048ba72ffbc15dd396d487ce6ea504cb6194242c312070b736845bee2e2122d6
Opcode Fuzzy Hash: 1b950b338da2f55a01d959dd164b090fa2b752f423bf6fc754d6f16686098884
Instruction Fuzzy Hash: C5216772240B91BBE3346B218C4EFAF7B9DBF84700F002411FAD1E6092DB788C4146E1

Uniqueness

Uniqueness Score: -1.00%

Function 005E1575 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 005E15AA
GetWindowRect.USER32(?,?), ref: 005E15F1
ShowWindow.USER32(?,00000005,00000000), ref: 005E168C
SetWindowTextW.USER32(?,00000000), ref: 005E1694
ShowWindow.USER32(00000000,00000005), ref: 005E16AA

Strings

\^, xrefs: 005E16B3
l[^, xrefs: 005E15FF, 005E1633
*\^, xrefs: 005E1608
RarHtmlClassName, xrefs: 005E1651

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Window$Show$RectText
String ID: \^$*\^$RarHtmlClassName$l[^
API String ID: 3937224194-2599507766
Opcode ID: 38733cbcf00a858cc30513292cca2b2e3fde859698d40791d6220a40cadadeb1
Instruction ID: 6002c39b9049ab76a3d1314b31ea96d4a15a9ba8542623ce08cbc07df999228b
Opcode Fuzzy Hash: 38733cbcf00a858cc30513292cca2b2e3fde859698d40791d6220a40cadadeb1
Instruction Fuzzy Hash: FF41C371504341AFCB249F66DD49B5B7FE9FF88711F04151AFA8996152DB30DC00CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 005F06A1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005F06B5

Part of subcall function 005F08EA: RtlFreeHeap.NTDLL(00000000,00000000,?,005F3CD6,?,00000000,?,00000000,?,005F3CFD,?,00000007,?,?,005F40FA,?), ref: 005F0900
Part of subcall function 005F08EA: GetLastError.KERNEL32(?,?,005F3CD6,?,00000000,?,00000000,?,005F3CFD,?,00000007,?,?,005F40FA,?,?), ref: 005F0912

_free.LIBCMT ref: 005F06C1
_free.LIBCMT ref: 005F06CC
_free.LIBCMT ref: 005F06D7
_free.LIBCMT ref: 005F06E2
_free.LIBCMT ref: 005F06ED
_free.LIBCMT ref: 005F06F8
_free.LIBCMT ref: 005F0703
_free.LIBCMT ref: 005F070E
_free.LIBCMT ref: 005F071C

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: cc877b465a82be6094d8a8124dfb71cdb1415e2869cb08b152c0e0217c37cf98
Instruction ID: be038ca43e4db3a9d003a9666b4ea2e1361bd72713e163928966046255ed4f03
Opcode Fuzzy Hash: cc877b465a82be6094d8a8124dfb71cdb1415e2869cb08b152c0e0217c37cf98
Instruction Fuzzy Hash: B311A77650010DAFCB01FF94C866CED7FA5FF44790B4590A1FA088B2A3DA35EA51EB80

Uniqueness

Uniqueness Score: -1.00%

Function 005EA254 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 005EA373
___TypeMatch.LIBVCRUNTIME ref: 005EA481
_UnwindNestedFrames.LIBCMT ref: 005EA5D3
CallUnexpected.LIBVCRUNTIME ref: 005EA5EE
_abort.LIBCMT ref: 005EA5F3

Strings

csm, xrefs: 005EA2FE
csm, xrefs: 005EA3AA
csm, xrefs: 005EA291

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: ebd0a8910bda4cbfce463140865651865fd69ca7dcdc82b16d727be0753bcce3
Instruction ID: 368bc833ce1479b27c4d01df52a6878dd70e243bd7eca388e229f321f339eacb
Opcode Fuzzy Hash: ebd0a8910bda4cbfce463140865651865fd69ca7dcdc82b16d727be0753bcce3
Instruction Fuzzy Hash: 56B17C7180029AEFCF1DDFA6C8859AEBFB5FF54310B14445AE8916B242D730EE51CB92

Uniqueness

Uniqueness Score: -1.00%

Function 005F6ACD Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,005F7242,00000000,00000000,00000000,00000000,00000000,005EC832), ref: 005F6B0F
__fassign.LIBCMT ref: 005F6B8A
__fassign.LIBCMT ref: 005F6BA5
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 005F6BCB
WriteFile.KERNEL32(?,00000000,00000000,Br_,00000000,?,?,?,?,?,?,?,?,?,005F7242,00000000), ref: 005F6BEA
WriteFile.KERNEL32(?,00000000,00000001,Br_,00000000,?,?,?,?,?,?,?,?,?,005F7242,00000000), ref: 005F6C23

Strings

Br_, xrefs: 005F6BDE, 005F6C16, 005F6BE1, 005F6C19

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID: Br_
API String ID: 1324828854-1786959789
Opcode ID: b8c12d71383d37abb268c643eba8f30b65d2bbac536851350909c521c21535a7
Instruction ID: c9142514ff23929398381cd965894f421b07fcebdffacdf97d53dbf23c21bdd1
Opcode Fuzzy Hash: b8c12d71383d37abb268c643eba8f30b65d2bbac536851350909c521c21535a7
Instruction Fuzzy Hash: 2951B5B0E002499FCB10CFA8D885AFEBBF8FF08310F14455AE695E7291D735A941CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 005E0D51 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005E0D76
_wcslen.LIBCMT ref: 005E0E16
GlobalAlloc.KERNEL32(00000040,?), ref: 005E0E25
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 005E0E46

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 005E0DA0
utf-8"></head>, xrefs: 005E0DAB
<html>, xrefs: 005E0D95, 005E0DCE
</html>, xrefs: 005E0DF7

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _wcslen$AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1116704506-4209811716
Opcode ID: 770e43f87a25fe1abdb64e607fb441d9022c75273716e6e06b64fc6e9ba53f86
Instruction ID: a9bc1e2fb30fe7760ddd87b8c79fc33eb82e75f3350e8bba6bcad4143de817dd
Opcode Fuzzy Hash: 770e43f87a25fe1abdb64e607fb441d9022c75273716e6e06b64fc6e9ba53f86
Instruction Fuzzy Hash: 5C3139321143927AE72CAB229C0AF6F7F9CFF81720F140819F585961C1EBB4998483A1

Uniqueness

Uniqueness Score: -1.00%

Function 005E2E20 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005D11F6: GetDlgItem.USER32(00000000,00003021), ref: 005D123A
Part of subcall function 005D11F6: SetWindowTextW.USER32(00000000,005FA584), ref: 005D1250

EndDialog.USER32(?,00000001), ref: 005E2E70
SendMessageW.USER32(?,00000080,00000001,?), ref: 005E2E97
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 005E2EB0
SetWindowTextW.USER32(?,?), ref: 005E2EC1
GetDlgItem.USER32(?,00000065), ref: 005E2ECA
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 005E2EDE
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 005E2EF4

Strings

LICENSEDLG, xrefs: 005E2E34

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 9a91eb864801bc5dd3112a13b34f4cc6af7794378235030b3076213db65a7eef
Instruction ID: b08ec8de595cc40ec86b9434de02778110b9f473926bc06140c76fe70cd5d872
Opcode Fuzzy Hash: 9a91eb864801bc5dd3112a13b34f4cc6af7794378235030b3076213db65a7eef
Instruction Fuzzy Hash: 1021E7322146557FE7295B22EC49E7B3F7EFB86B41F006404F781920A4CB52990197B1

Uniqueness

Uniqueness Score: -1.00%

Function 005E22EA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 005E2310
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 005E2327
SystemTimeToFileTime.KERNEL32(?,?), ref: 005E233B
FileTimeToSystemTime.KERNEL32(?,?), ref: 005E234C
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 005E2364
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,00000000,00000032), ref: 005E2388
_swprintf.LIBCMT ref: 005E23A7

Strings

%s %s, xrefs: 005E239E

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Time$System$File$Format$DateLocalSpecific_swprintf
String ID: %s %s
API String ID: 385609497-2939940506
Opcode ID: d1843a27ce34e1126221324ee1c850e7e5b88d66cfae266eb84a1d0f4eb446de
Instruction ID: c5a3bbcaa074f749f2ab92cf39c3a63eea9e779cbd758c9e16dae40fa250f28d
Opcode Fuzzy Hash: d1843a27ce34e1126221324ee1c850e7e5b88d66cfae266eb84a1d0f4eb446de
Instruction Fuzzy Hash: B12121B250024DABDB10DFA5DD48EEF77BCFF59300F104556BA09D7112EA34AA09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 005E139E Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005E13AA

Strings

>, xrefs: 005E13EB
<style>, xrefs: 005E14D0
</p>, xrefs: 005E1488
<br>, xrefs: 005E149E
</style>, xrefs: 005E14F2

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 806be2df7f3c4d8625b6e66235190d3be0430e7c05b2764eed60d545361fa0ed
Instruction ID: fee4787304f44421d766569f710868e881217603aaf3d1b12cc51c318b2a08b0
Opcode Fuzzy Hash: 806be2df7f3c4d8625b6e66235190d3be0430e7c05b2764eed60d545361fa0ed
Instruction Fuzzy Hash: 53512976740BA395DF385A1A981277A7BE0FFA0750F64042BF9C18B3C0FBB48D418269

Uniqueness

Uniqueness Score: -1.00%

Function 005E9B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005E9BC7
___except_validate_context_record.LIBVCRUNTIME ref: 005E9BCF
_ValidateLocalCookies.LIBCMT ref: 005E9C58
__IsNonwritableInCurrentImage.LIBCMT ref: 005E9C83
_ValidateLocalCookies.LIBCMT ref: 005E9CD8

Strings

csm, xrefs: 005E9C6D

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b95685e6a33a044167ef2693c797146eae7c9dfff3928a4f2dd30da8fa9e7b8c
Instruction ID: 9afc530ebf0fbcc98bcb7d53bf84f7fd426b04a6032b18f2d630ac9efe7cb8f5
Opcode Fuzzy Hash: b95685e6a33a044167ef2693c797146eae7c9dfff3928a4f2dd30da8fa9e7b8c
Instruction Fuzzy Hash: E041E574A002899BCF18EF6AC884A9EBFF5BF44314F248195E858AB352C735AD05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005E0FF5 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005E0FFE
_wcslen.LIBCMT ref: 005E1033

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 005E1027
 , xrefs: 005E10C1
<br>, xrefs: 005E107F
, xrefs: 005E1050

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: c0c658c1710ba3ca216ff11c7cb0ccc759b0c371f960e00cdaabe953f5e52ca4
Instruction ID: 9de862ace2c48b79d2981f238a684c2e954ff32a880062436a4bf3f25b2c78fa
Opcode Fuzzy Hash: c0c658c1710ba3ca216ff11c7cb0ccc759b0c371f960e00cdaabe953f5e52ca4
Instruction Fuzzy Hash: BA315C75A447C697E63CAB529C0A77B7BA4FB90360F10441EF4D5571C1FB74A8C083A4

Uniqueness

Uniqueness Score: -1.00%

Function 005E2189 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 005E2192
GetObjectW.GDI32(?,00000018,?), ref: 005E21C1
ReleaseDC.USER32(00000000,?), ref: 005E2259

Strings

L]^, xrefs: 005E21E5
Pl)uq]^, xrefs: 005E21C1
g]^, xrefs: 005E219F, 005E21AC

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ObjectRelease
String ID: L]^$Pl)uq]^$g]^
API String ID: 1429681911-3318884370
Opcode ID: ad20e22fb66cdf720945ebe67f9281f76aabb0c95267800e05f222e0d3421bfa
Instruction ID: fe14ec1e6a55d79fe0ea49a62020df952c210884494732142b9cc92d8e3ea292
Opcode Fuzzy Hash: ad20e22fb66cdf720945ebe67f9281f76aabb0c95267800e05f222e0d3421bfa
Instruction Fuzzy Hash: 1821E672108304EFD305AFA1DC48D6FBFFAFB88355F006829FB5692220D73599548BA2

Uniqueness

Uniqueness Score: -1.00%

Function 005F3CE4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005F3CA8: _free.LIBCMT ref: 005F3CD1

_free.LIBCMT ref: 005F3D32

Part of subcall function 005F08EA: RtlFreeHeap.NTDLL(00000000,00000000,?,005F3CD6,?,00000000,?,00000000,?,005F3CFD,?,00000007,?,?,005F40FA,?), ref: 005F0900
Part of subcall function 005F08EA: GetLastError.KERNEL32(?,?,005F3CD6,?,00000000,?,00000000,?,005F3CFD,?,00000007,?,?,005F40FA,?,?), ref: 005F0912

_free.LIBCMT ref: 005F3D3D
_free.LIBCMT ref: 005F3D48
_free.LIBCMT ref: 005F3D9C
_free.LIBCMT ref: 005F3DA7
_free.LIBCMT ref: 005F3DB2
_free.LIBCMT ref: 005F3DBD

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction ID: 6f74a80f76a03372bfe990d496157bfcc03692b81973d933c7a4ae75d2f56028
Opcode Fuzzy Hash: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction Fuzzy Hash: 4311307155070DBBEA20B7B0CC1BFEBBF9C7F80741F440C25B39A66092D66DBA155650

Uniqueness

Uniqueness Score: -1.00%

Function 005E2F3D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 005E2F4D
GetObjectW.GDI32(00000000,00000018,?), ref: 005E2F72
DeleteObject.GDI32(00000000), ref: 005E2FA4
DeleteObject.GDI32(00000000), ref: 005E2FC7

Part of subcall function 005E1D72: FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,005E2F9D,00000066), ref: 005E1D85
Part of subcall function 005E1D72: SizeofResource.KERNEL32(00000000,?,?,?,005E2F9D,00000066), ref: 005E1D9C
Part of subcall function 005E1D72: LoadResource.KERNEL32(00000000,?,?,?,005E2F9D,00000066), ref: 005E1DB3
Part of subcall function 005E1D72: LockResource.KERNEL32(00000000,?,?,?,005E2F9D,00000066), ref: 005E1DC2
Part of subcall function 005E1D72: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,005E2F9D,00000066), ref: 005E1DDD
Part of subcall function 005E1D72: GlobalLock.KERNEL32(00000000,?,?,?,?,?,005E2F9D,00000066), ref: 005E1DEE
Part of subcall function 005E1D72: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 005E1E57
Part of subcall function 005E1D72: GlobalUnlock.KERNEL32(00000000), ref: 005E1E76
Part of subcall function 005E1D72: GlobalFree.KERNEL32(00000000), ref: 005E1E7D

Strings

], xrefs: 005E2F7A
Pl)uq]^, xrefs: 005E2F72

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: Pl)uq]^$]
API String ID: 1428510222-1829818692
Opcode ID: 03fcbad43893c1a7f000551d75655450bd5426303fdaea3cf01708ebbc7f1c22
Instruction ID: f471f92f5de100c203ed90b29510fef4486c88dc13c1a7030317594ec3cc53d1
Opcode Fuzzy Hash: 03fcbad43893c1a7f000551d75655450bd5426303fdaea3cf01708ebbc7f1c22
Instruction Fuzzy Hash: C101D232940A9667C71927668E0AB7F7E7FBFC1B51F140014F9A0B7295DB718C0546E0

Uniqueness

Uniqueness Score: -1.00%

Function 005E5F0D Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,005E5F88,005E5EEB,005E618C), ref: 005E5F24
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 005E5F3A
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 005E5F4F

Strings

KERNEL32.DLL, xrefs: 005E5F1F
AcquireSRWLockExclusive, xrefs: 005E5F34
ReleaseSRWLockExclusive, xrefs: 005E5F44

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: cc63c104126aef520530f60c1947313af4689c00e15b5cb9902981bf701f0a6b
Instruction ID: fa4c6a28ffcb61b405857fc4472763724baaca9b8984e456e070394aa16e8079
Opcode Fuzzy Hash: cc63c104126aef520530f60c1947313af4689c00e15b5cb9902981bf701f0a6b
Instruction Fuzzy Hash: 46F04CF2321A929B5F250FF22C882372FCDBA1530C304053AE6E1C6100FA26CC46A2D2

Uniqueness

Uniqueness Score: -1.00%

Function 005EFF10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005EFF2E

Part of subcall function 005F08EA: RtlFreeHeap.NTDLL(00000000,00000000,?,005F3CD6,?,00000000,?,00000000,?,005F3CFD,?,00000007,?,?,005F40FA,?), ref: 005F0900
Part of subcall function 005F08EA: GetLastError.KERNEL32(?,?,005F3CD6,?,00000000,?,00000000,?,005F3CFD,?,00000007,?,?,005F40FA,?,?), ref: 005F0912

_free.LIBCMT ref: 005EFF40
_free.LIBCMT ref: 005EFF53
_free.LIBCMT ref: 005EFF64
_free.LIBCMT ref: 005EFF75

Strings

P[`, xrefs: 005EFF24

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: P[`
API String ID: 776569668-2264928869
Opcode ID: 276724a6d3349ae939ca7fe4da97b9a28398bc5b2a1d3dfbf3b9855f454859b4
Instruction ID: 6cda0770cce1ac3f87b840f52b500c7c915b2e0cf5231e3e3620444b6ed44c99
Opcode Fuzzy Hash: 276724a6d3349ae939ca7fe4da97b9a28398bc5b2a1d3dfbf3b9855f454859b4
Instruction Fuzzy Hash: 08F01D704006158BC705AFA5EC5D82A7F62BB15B103487126F451523F1CB391803EFC6

Uniqueness

Uniqueness Score: -1.00%

Function 005E9F1A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,005E9F11,005E9E9C,005E7354), ref: 005E9F28
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 005E9F36
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005E9F4F
SetLastError.KERNEL32(00000000,005E9F11,005E9E9C,005E7354), ref: 005E9FA1

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0bc16300cd67c118ef5341049206605599e4defd9bda8de46e21620412b2c64b
Instruction ID: a2a19177d14961fa979f5d5dc08e865a9d031d8979a5d0fa72408abb273168a3
Opcode Fuzzy Hash: 0bc16300cd67c118ef5341049206605599e4defd9bda8de46e21620412b2c64b
Instruction Fuzzy Hash: 4101243261D6926EF72E2AB7BC8D66B2E55FB52771B600329F1B0C10F0FF124C409544

Uniqueness

Uniqueness Score: -1.00%

Function 005F0795 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,005EBC07,?,?,?,005EB682,00000050,?), ref: 005F0799
_free.LIBCMT ref: 005F07CC
_free.LIBCMT ref: 005F07F4
SetLastError.KERNEL32(00000000,?), ref: 005F0801
SetLastError.KERNEL32(00000000,?), ref: 005F080D
_abort.LIBCMT ref: 005F0813

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 27dba8541a67f3806aee811f92cb8986576d9c406333460fb61116d83771726a
Instruction ID: 114d0200ca39e1231272ea96ca3e2efe2ed4f8498b5c5487cd8b72a29800e045
Opcode Fuzzy Hash: 27dba8541a67f3806aee811f92cb8986576d9c406333460fb61116d83771726a
Instruction Fuzzy Hash: 0FF0F47514560A67C6113724BC4EA3F2E1ABFD07A1F391424F708E31E3EE3D8C02A9A2

Uniqueness

Uniqueness Score: -1.00%

Function 005E5540 Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 005E554C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005E5566
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005E5577
TranslateMessage.USER32(?), ref: 005E5581
DispatchMessageW.USER32(?), ref: 005E558B
WaitForSingleObject.KERNEL32(?,0000000A), ref: 005E5596

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: f59fb05b32747a3d1878b71d841e10ab4a88bd3a72c0a45e7a63e1b23ccb8b18
Instruction ID: 74a2e66fbcfa3929f84cf2ac002743e487eaf4cd30170302e6d4f0ed48fea7db
Opcode Fuzzy Hash: f59fb05b32747a3d1878b71d841e10ab4a88bd3a72c0a45e7a63e1b23ccb8b18
Instruction Fuzzy Hash: 5DF03772A01229ABCB206BA6DC4CDDF7F6EFF52395B005422F65AD2054E7388605CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 005E297A Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 005E2ADB
GetDlgItemTextW.USER32(?,00000066,00001000,00000200), ref: 005E2AF1
SetDlgItemTextW.USER32(?,00000067,?), ref: 005E2B19

Strings

GETPASSWORD1, xrefs: 005E2AA8
Software\WinRAR SFX, xrefs: 005E29C4

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ItemText$Dialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 1770891597-1315819833
Opcode ID: 0bc475e3954ce50ad6e70d1465c00c9a5d65d1441cbdd2c2c0ed56951036a25c
Instruction ID: 3d648526521d40ce130e8b37ed2f06a3316ecfb7de805d0f6f16206143d297cb
Opcode Fuzzy Hash: 0bc475e3954ce50ad6e70d1465c00c9a5d65d1441cbdd2c2c0ed56951036a25c
Instruction Fuzzy Hash: 2841B171A40289AAEB34AF65DC49BFF7BADFB48300F10043AF685E3185DB7499458B61

Uniqueness

Uniqueness Score: -1.00%

Function 005D3C9D Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005D3CD8
GetCurrentDirectoryW.KERNEL32(000007FF,00000000,?,?,?,000000FF,?,?,005D2ADC,000000FF,?,00000800,?,?,?,005D1E7B), ref: 005D3D81
_wcslen.LIBCMT ref: 005D3DEF

Strings

UNC, xrefs: 005D3D67
\\?\, xrefs: 005D3D0F, 005D3D5B, 005D3DB7, 005D3E06

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 5d44ddf00d0a968745eb8e4b22f8bb0396e30e0d5abc23cfedf8d314296d10e1
Instruction ID: 886993416e2392e07bb036c79fa0cd3daeaf09e95eab7c7623c2367327a4c131
Opcode Fuzzy Hash: 5d44ddf00d0a968745eb8e4b22f8bb0396e30e0d5abc23cfedf8d314296d10e1
Instruction Fuzzy Hash: 1C41D771904385A6D730AF688889DFF7FEDFF99780F04081BF58492381E7789A448A63

Uniqueness

Uniqueness Score: -1.00%

Function 005E4EB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 005D11F6: GetDlgItem.USER32(00000000,00003021), ref: 005D123A
Part of subcall function 005D11F6: SetWindowTextW.USER32(00000000,005FA584), ref: 005D1250

EndDialog.USER32(?,00000001), ref: 005E4EFB
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 005E4F11
SetDlgItemTextW.USER32(?,00000066,?), ref: 005E4F25
SetDlgItemTextW.USER32(?,00000068), ref: 005E4F34

Strings

RENAMEDLG, xrefs: 005E4EC8

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 60b27dbf6c72a12647185197410f5b6760321f082d1ee4dc383f84df620e0edf
Instruction ID: 086a78b8d5f11d292974b29ad200a8256840246a84d453c7be0fa2224f7c8e4f
Opcode Fuzzy Hash: 60b27dbf6c72a12647185197410f5b6760321f082d1ee4dc383f84df620e0edf
Instruction Fuzzy Hash: FC012433684354BAD3144FAA9C08FAB7F6EFB99B02F101801F381A21D0C7A259048FE6

Uniqueness

Uniqueness Score: -1.00%

Function 005EF477 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,005EF428,005F03B2,?,005EF3C8,005F03B2,00602D88,0000000C,005EF51F,005F03B2,00000002), ref: 005EF497
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005EF4AA
FreeLibrary.KERNEL32(00000000,?,?,?,005EF428,005F03B2,?,005EF3C8,005F03B2,00602D88,0000000C,005EF51F,005F03B2,00000002,00000000), ref: 005EF4CD

Strings

mscoree.dll, xrefs: 005EF490
CorExitProcess, xrefs: 005EF4A2

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0e6bfe7413499620dea1340e1e4df7c6cfffcff9a30ab2c1953bb08da798a243
Instruction ID: 45edd9c400950f713594488cc86a334f9d0031452b3294e4eed989c8f0bd7c93
Opcode Fuzzy Hash: 0e6bfe7413499620dea1340e1e4df7c6cfffcff9a30ab2c1953bb08da798a243
Instruction Fuzzy Hash: C0F03170650208FBDB159BA5EC0DBAEBFB9FB04755F004165B809A21A0CF399E44DB91

Uniqueness

Uniqueness Score: -1.00%

Function 005D6000 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 005D72B7: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005D72E0
Part of subcall function 005D72B7: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0060F038,?,005D6013,Crypt32.dll,00000000,005D608D,?,?,005D6070,00000000), ref: 005D7300

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 005D601F
GetProcAddress.KERNEL32(0060F038,CryptUnprotectMemory), ref: 005D602F

Strings

CryptProtectMemory, xrefs: 005D6019
Crypt32.dll, xrefs: 005D6009
CryptUnprotectMemory, xrefs: 005D6025

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 5c423de7dfc34aab240c245a07a486b61a33c2b978b77f3bf723699cd915e2d4
Instruction ID: 8a696f35f40c0e61b91ab613464ba5d00ed70357b26f59b5847c858420cf1e40
Opcode Fuzzy Hash: 5c423de7dfc34aab240c245a07a486b61a33c2b978b77f3bf723699cd915e2d4
Instruction Fuzzy Hash: DDE04FB0401B45AED7316B78A80CA527FE4BB28701B00885FA59DD2741DAB9E445CB63

Uniqueness

Uniqueness Score: -1.00%

Function 005E9FFD Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 005EA0C4
___AdjustPointer.LIBCMT ref: 005EA0E7
_abort.LIBCMT ref: 005EA135
___AdjustPointer.LIBCMT ref: 005EA183

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 726db55ee938a800feaed7e600fb2a5f176a429f00ded4470c5bd0cd7d77d948
Instruction ID: 72fde2bac0ae42d5edb0b4ac40542ef327801a398c38d02151fc166560bc5c98
Opcode Fuzzy Hash: 726db55ee938a800feaed7e600fb2a5f176a429f00ded4470c5bd0cd7d77d948
Instruction Fuzzy Hash: D351F272A04286AFDB2D8F26D849B7A7FA5FF44710F14052DE8818B291E731FD80D792

Uniqueness

Uniqueness Score: -1.00%

Function 005F3370 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 005F3379
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005F339C

Part of subcall function 005F0A15: RtlAllocateHeap.NTDLL(00000000,?,?,?,005EB819,?,0000015D,?,?,?,?,005ECCF5,000000FF,00000000,?,?), ref: 005F0A47

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005F33C2
_free.LIBCMT ref: 005F33D5
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 005F33E4

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: f27056e9904d069e158bd85d2fe1a264ad7f46c9fa0a7aec1a0250b0cfee44c2
Instruction ID: 03af6b74eed3fa1e557ec911e263fe7e9dafb0f11441b05e656fa96e2cb897c3
Opcode Fuzzy Hash: f27056e9904d069e158bd85d2fe1a264ad7f46c9fa0a7aec1a0250b0cfee44c2
Instruction Fuzzy Hash: AB01756260125D7F77215AA66C8CC7B6E6DFEC2B613150529FA08C3184DEA88D05D1B1

Uniqueness

Uniqueness Score: -1.00%

Function 005F0819 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,005F0A07,005F25C8,?,005F07C3,00000001,00000364,?,005EBC07,?,?,?,005EB682,00000050), ref: 005F081E
_free.LIBCMT ref: 005F0853
_free.LIBCMT ref: 005F087A
SetLastError.KERNEL32(00000000,?), ref: 005F0887
SetLastError.KERNEL32(00000000,?), ref: 005F0890

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 9434d6171e52db1615e1e93fbeb560877245a7accb93600e80d74cf2db888bd1
Instruction ID: 6f7202beb565bce7e00e27b90dfeb90a2eb5216a3fd72adad97be14bafeb9493
Opcode Fuzzy Hash: 9434d6171e52db1615e1e93fbeb560877245a7accb93600e80d74cf2db888bd1
Instruction Fuzzy Hash: 0001447224060A67C60227606D9D93F2E5FBBE17F1B392538F709E21D3EE7C8C01A1A1

Uniqueness

Uniqueness Score: -1.00%

Function 005F3C3F Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005F3C57

Part of subcall function 005F08EA: RtlFreeHeap.NTDLL(00000000,00000000,?,005F3CD6,?,00000000,?,00000000,?,005F3CFD,?,00000007,?,?,005F40FA,?), ref: 005F0900
Part of subcall function 005F08EA: GetLastError.KERNEL32(?,?,005F3CD6,?,00000000,?,00000000,?,005F3CFD,?,00000007,?,?,005F40FA,?,?), ref: 005F0912

_free.LIBCMT ref: 005F3C69
_free.LIBCMT ref: 005F3C7B
_free.LIBCMT ref: 005F3C8D
_free.LIBCMT ref: 005F3C9F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0360669d7e6f544803ac8821e5814e0efa03e21b4e696af30a3ac8c14d95cab2
Instruction ID: cda1bc44299fb647868938e979f845f8f52437507965a1b797e9dfa382c8d76e
Opcode Fuzzy Hash: 0360669d7e6f544803ac8821e5814e0efa03e21b4e696af30a3ac8c14d95cab2
Instruction Fuzzy Hash: EAF06832500608EBD710EB54E98DC3B7BDABE407507582815F24DE7581C73CFD405A54

Uniqueness

Uniqueness Score: -1.00%

Function 005D856E Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005D8576
_wcslen.LIBCMT ref: 005D8587
_wcslen.LIBCMT ref: 005D8597
_wcslen.LIBCMT ref: 005D85A5
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,005D35EC,?,?,00000000,?,?,?), ref: 005D85C0

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: b1d185f531a83177b2a0e2347d53f2ba755257c0583ce6bd9424389915b3d9fc
Instruction ID: 287e17bb9ba166a8108d7010772592f30b15cd5c30123dcc63f47ec45fbea5da
Opcode Fuzzy Hash: b1d185f531a83177b2a0e2347d53f2ba755257c0583ce6bd9424389915b3d9fc
Instruction Fuzzy Hash: AAF06D32008055BBDF266F55EC09D9E3F26FF84B61B11C402F6295A061CF329A51DA80

Uniqueness

Uniqueness Score: -1.00%

Function 005E1EBE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

Part of subcall function 005E1D49: GetDC.USER32(00000000), ref: 005E1D4D
Part of subcall function 005E1D49: GetDeviceCaps.GDI32(00000000,0000000C), ref: 005E1D58
Part of subcall function 005E1D49: ReleaseDC.USER32(00000000,00000000), ref: 005E1D63

GetObjectW.GDI32(?,00000018,?), ref: 005E1F02

Part of subcall function 005E2189: GetDC.USER32(00000000), ref: 005E2192
Part of subcall function 005E2189: GetObjectW.GDI32(?,00000018,?), ref: 005E21C1
Part of subcall function 005E2189: ReleaseDC.USER32(00000000,?), ref: 005E2259

Strings

(, xrefs: 005E2057
Pl)uq]^, xrefs: 005E1F02

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ObjectRelease$CapsDevice
String ID: ($Pl)uq]^
API String ID: 1061551593-3090824825
Opcode ID: aaa755619b4e89889e771eaf31f723b693cf1b1995b0ad1f55092a40c1f5fdb0
Instruction ID: 638b3b7cdd6ca3dc46960812cdc548e224b8b7304381a6ffe027241cf46c3dc8
Opcode Fuzzy Hash: aaa755619b4e89889e771eaf31f723b693cf1b1995b0ad1f55092a40c1f5fdb0
Instruction Fuzzy Hash: 009114B56183549FC714DF26C844A2BBBE9FFC9B00F00491EF58AD7260DB35A905CB62

Uniqueness

Uniqueness Score: -1.00%

Function 005D7B4E Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 203COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 005D7D16
_swprintf.LIBCMT ref: 005D7DC5

Strings

%ls, xrefs: 005D7B9B, 005D7BB1
%s: %s, xrefs: 005D7D25

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 704f4e0903ff93096db2fa98ddd29e5767c539e785a56992e191e98c9f0090a8
Instruction ID: 1bfca32d54f2b3a3ab2dd0bee2e853db5feb6b12cf2a6b9ad6221936023b24dc
Opcode Fuzzy Hash: 704f4e0903ff93096db2fa98ddd29e5767c539e785a56992e191e98c9f0090a8
Instruction Fuzzy Hash: AB51197128C70DFEF6322BACCD06F367E59BB5CB01F104C47B786A42E1F5A299506A52

Uniqueness

Uniqueness Score: -1.00%

Function 005EF572 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\RP.sfx.exe,00000104), ref: 005EF5B2
_free.LIBCMT ref: 005EF67D
_free.LIBCMT ref: 005EF687

Strings

C:\Users\user\Desktop\RP.sfx.exe, xrefs: 005EF5A9, 005EF5B0, 005EF5DF, 005EF617

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\RP.sfx.exe
API String ID: 2506810119-2537368110
Opcode ID: c2324625ea29178a355bec158a486556104847e1b931d925569a394e9bef91ff
Instruction ID: 398159f08b177229901615b91e0d8ce3a375e9172d71d26eacdf77523fca45dc
Opcode Fuzzy Hash: c2324625ea29178a355bec158a486556104847e1b931d925569a394e9bef91ff
Instruction Fuzzy Hash: 3131A2B1A00288AFDB25DF9ADC85DAEBFF8FB85710F140076F58497221DA744E40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 005EA5F9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 005EA61E
_abort.LIBCMT ref: 005EA729

Strings

MOC, xrefs: 005EA630
RCC, xrefs: 005EA638

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: cf3cf33ed9e970e0e25c53aba9029851f0af183af85af6d04bef4999c082d77f
Instruction ID: 79c1dc6d23e9df6c005b3470234b0fdd600a154e43a9ef003ae36733c2fdad8a
Opcode Fuzzy Hash: cf3cf33ed9e970e0e25c53aba9029851f0af183af85af6d04bef4999c082d77f
Instruction Fuzzy Hash: D9414A71900289AFCF19DFA5CC85AAE7FB5FF88300F188059F944A7261E335A950DB52

Uniqueness

Uniqueness Score: -1.00%

Function 005D45D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 005D464D
_strncpy.LIBCMT ref: 005D4691

Part of subcall function 005D836E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,005D50C0,?,00000000,00000000,?,?,?,005D50C0,?,?,00000050), ref: 005D838B

Strings

@%s, xrefs: 005D4637
$%s, xrefs: 005D4642

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: f9b610e7c424b82eeea504aba720bfb60036c84fd53cbaf3597537abf471475a
Instruction ID: cdf4f4f698ba3313c1d7772ac422141440fe6fe757be006cd4b7c8967986600b
Opcode Fuzzy Hash: f9b610e7c424b82eeea504aba720bfb60036c84fd53cbaf3597537abf471475a
Instruction Fuzzy Hash: ED215E7290034D9BDB34DEA8CC49BBF7BA8BB45700F08091BF91696291E775E905CB11

Uniqueness

Uniqueness Score: -1.00%

Function 005E256C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 005E28F0: GetCurrentProcess.KERNEL32(00020008,?), ref: 005E28FF
Part of subcall function 005E28F0: GetLastError.KERNEL32 ref: 005E292A

CreateDirectoryW.KERNEL32(?,?), ref: 005E260E
LocalFree.KERNEL32(?), ref: 005E261C

Strings

]^, xrefs: 005E25DC
,^^, xrefs: 005E25CD

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID: ,^^$]^
API String ID: 1077098981-2355260748
Opcode ID: 526e0a126b0d834a9c0d033c173014458ec20aa7ac3e1dd47249c7ce94b81f71
Instruction ID: d4c604ba31011eeca804ff53885c971c5feb9e893e0e8cefc61ec6c612f06a01
Opcode Fuzzy Hash: 526e0a126b0d834a9c0d033c173014458ec20aa7ac3e1dd47249c7ce94b81f71
Instruction Fuzzy Hash: 3C21D8B190024D9BDB14DF66D9849EF7BFCFF58344F40812AB915D2110EB34DA19CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005D6075 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 005D6000: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 005D601F
Part of subcall function 005D6000: GetProcAddress.KERNEL32(0060F038,CryptUnprotectMemory), ref: 005D602F

GetCurrentProcessId.KERNEL32(?,?,?,005D6070), ref: 005D6103

Strings

p`], xrefs: 005D6096, 005D60A7, 005D60E8
CryptUnprotectMemory failed, xrefs: 005D60FB
CryptProtectMemory failed, xrefs: 005D60BA

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed$p`]
API String ID: 2190909847-1672015272
Opcode ID: 76052b0ae5a1462005037aa8f57aad4e2e342f1cbb22aae5eafb0a2aa6142677
Instruction ID: 5ad2589cc082fad25e8871f49cfa6c3efad2172c1c8031c48882a1ac745da5e0
Opcode Fuzzy Hash: 76052b0ae5a1462005037aa8f57aad4e2e342f1cbb22aae5eafb0a2aa6142677
Instruction Fuzzy Hash: CE112971A416246BDB35AF68DC05A7E3F69FF54B60B048017FC05AB383D729AD02CAD6

Uniqueness

Uniqueness Score: -1.00%

Function 005E55A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 005E55FA
REPLACEFILEDLG, xrefs: 005E55E5, 005E5619

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 23fd684bfa7ac12671a4c2261c70d2d5a449bea8989deb1070f731dccfd4d4be
Instruction ID: ff33133d60ce4f1c83f3c20f1a85bd9640df84cce6f68f4695275bd0217d54e6
Opcode Fuzzy Hash: 23fd684bfa7ac12671a4c2261c70d2d5a449bea8989deb1070f731dccfd4d4be
Instruction Fuzzy Hash: C701B571905984EFE7258F26EC44A677FABFB44344B042826F946D2231E3319992DFE0

Uniqueness

Uniqueness Score: -1.00%

Function 005D11F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 005D5064: _swprintf.LIBCMT ref: 005D50A4
Part of subcall function 005D5064: SetDlgItemTextW.USER32(?,00605154,?), ref: 005D511E
Part of subcall function 005D5064: GetWindowRect.USER32(?,?), ref: 005D5154
Part of subcall function 005D5064: GetClientRect.USER32(?,?), ref: 005D5160

GetDlgItem.USER32(00000000,00003021), ref: 005D123A
SetWindowTextW.USER32(00000000,005FA584), ref: 005D1250

Strings

l[^, xrefs: 005D122A
0, xrefs: 005D11F9

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ItemRectTextWindow$Client_swprintf
String ID: 0$l[^
API String ID: 758586884-3691167194
Opcode ID: 77e8c8fea52702914b510ee092e1403b27620c639b97a4bb2d25ffe6d4a33c2a
Instruction ID: 2b20431a9c5b9adaddae83f9c20c73aa6ce2e2352d0fc193b4c412e45cb3b88c
Opcode Fuzzy Hash: 77e8c8fea52702914b510ee092e1403b27620c639b97a4bb2d25ffe6d4a33c2a
Instruction Fuzzy Hash: ABF0AF34104A4CBADF251F6A8C0D7F93F6ABF04388F049417FE44952E1DB7AC950EA94

Uniqueness

Uniqueness Score: -1.00%

Function 005F0DF1 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 005F0E7C
__alldvrm.LIBCMT ref: 005F107D
__alldvrm.LIBCMT ref: 005F109F

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: c90238713df72aca6a697f90e8f2901aaebb0159894b3a9a2b2fdea8b764dc93
Instruction ID: 46cf765cf96a86408a775328c997da1d8ea0fe30902cdb671773968e2b79cd61
Opcode Fuzzy Hash: c90238713df72aca6a697f90e8f2901aaebb0159894b3a9a2b2fdea8b764dc93
Instruction Fuzzy Hash: 9DA14631A0078ADFEB21CE18C8957BEBFA9FF51310F184569E7959B282C63C8981C754

Uniqueness

Uniqueness Score: -1.00%

Function 005D2DDF Relevance: 6.1, APIs: 4, Instructions: 135filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 005D2E8B
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800), ref: 005D2EC9
SetFileTime.KERNEL32(?,?,?,00000000), ref: 005D2F4C
CloseHandle.KERNEL32(?), ref: 005D2F53

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: a8be41c70ca35396bc4b71684225c5ee12511c56911484e1c9b95787dff3609f
Instruction ID: 96e3169fcd34ebf5c7d5d2bb9cebeb49b0584f49b55ed043c84a844e7d2d1dcb
Opcode Fuzzy Hash: a8be41c70ca35396bc4b71684225c5ee12511c56911484e1c9b95787dff3609f
Instruction Fuzzy Hash: C041A2712483829EE331DF28D859FABBBE8BBA4704F04091FF4D5D7291D664EA48C752

Uniqueness

Uniqueness Score: -1.00%

Function 005D2BA9 Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005D2BDB
_wcslen.LIBCMT ref: 005D2BFE
_wcslen.LIBCMT ref: 005D2C94
_wcslen.LIBCMT ref: 005D2CF9

Part of subcall function 005D3102: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 005D312D

Part of subcall function 005D2A38: RemoveDirectoryW.KERNEL32(?), ref: 005D2A55
Part of subcall function 005D2A38: RemoveDirectoryW.KERNEL32(?,?,?,00000800), ref: 005D2A81

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _wcslen$DirectoryRemove$CloseFind
String ID:
API String ID: 973666142-0
Opcode ID: 1bd8dce2d28f2b0fde2ab650885eb753ed2d6991a2b26040ea6ecf542d9fec4a
Instruction ID: 304a8bc2b3b412554a3d85fcf59d48a3391abafb2c024f17d49ab481f54edc45
Opcode Fuzzy Hash: 1bd8dce2d28f2b0fde2ab650885eb753ed2d6991a2b26040ea6ecf542d9fec4a
Instruction Fuzzy Hash: 7B41F972514391A6CB34FB6888499EF7BA9BFD0300F40481FEDC593252DA749D89C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 005F3DC8 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,F4E85006,005EBD59,00000000,00000000,005ECD8E,?,005ECD8E,?,00000001,005EBD59,F4E85006,00000001,005ECD8E,005ECD8E), ref: 005F3E15
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 005F3E9E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 005F3EB0
__freea.LIBCMT ref: 005F3EB9

Part of subcall function 005F0A15: RtlAllocateHeap.NTDLL(00000000,?,?,?,005EB819,?,0000015D,?,?,?,?,005ECCF5,000000FF,00000000,?,?), ref: 005F0A47

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 9fc471c2f71ad47d69ca5d1fdfc6127a9aea7391f07875ae5266385277a4a36f
Instruction ID: 6acbce0c790e5570af79102ad601828d01309e02b22f56e950e87a903b0b5bbe
Opcode Fuzzy Hash: 9fc471c2f71ad47d69ca5d1fdfc6127a9aea7391f07875ae5266385277a4a36f
Instruction Fuzzy Hash: 10317C72A0021AABEB259F65DC49DBF7FA9FF40310B044169FE14D6290EB39DE54CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005E1D13 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 005E1D16
GetDeviceCaps.GDI32(00000000,00000058), ref: 005E1D25
GetDeviceCaps.GDI32(00000000,0000005A), ref: 005E1D33
ReleaseDC.USER32(00000000,00000000), ref: 005E1D41

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: cc2615f728cce1cc2dac628376f7259357ad2c0a4ca03e79e4b0b82a75f740f4
Instruction ID: 51ce137d2ba70960e1b5df4b317b45641910cf8f41f05a76621b0ab11ecef8a1
Opcode Fuzzy Hash: cc2615f728cce1cc2dac628376f7259357ad2c0a4ca03e79e4b0b82a75f740f4
Instruction Fuzzy Hash: C0E0E231942F61ABE3652B61AD0DB8B3F66AB46B93F003142F71AAA1A1DB7444458BD0

Uniqueness

Uniqueness Score: -1.00%

Function 005E0C2B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000005,?,?,?,?,005E0E86,00000000,?), ref: 005E0D29
SetWindowTextW.USER32(00000000,00000000), ref: 005E0D33

Strings

v[^, xrefs: 005E0D1E

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Window$ShowText
String ID: v[^
API String ID: 1551406749-2057385372
Opcode ID: b79211b086453fbf958707d60dae376d12006c26fab546b28b13b0a458f5d2a2
Instruction ID: 2f87acaa10da7c46145a4dc2896ba172329f81c0897a2d107fa630318b590879
Opcode Fuzzy Hash: b79211b086453fbf958707d60dae376d12006c26fab546b28b13b0a458f5d2a2
Instruction Fuzzy Hash: D031AC71304716AFC708DF99DC5492ABBE9BF49700B00051DF6899B2A0DBB1FC41DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 005E2CCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005E2D31
_wcslen.LIBCMT ref: 005E2D4C

Strings

}, xrefs: 005E2D24

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 9e1e9081515a036973b12df71a79f56f4f08f5789c9b8b750b99e2d0a0e41cae
Instruction ID: 3b444d50cf3093eb79523204a78e05baa30621fbcff10a0ff4a36e8f23f2f026
Opcode Fuzzy Hash: 9e1e9081515a036973b12df71a79f56f4f08f5789c9b8b750b99e2d0a0e41cae
Instruction Fuzzy Hash: 5121E5725043865AD738EF66CE49A6BBBECFF84750F40042AF6C4C3145EB60994987A2

Uniqueness

Uniqueness Score: -1.00%

Function 005F17B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005F17DE
_free.LIBCMT ref: 005F1804

Strings

V`, xrefs: 005F181D

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _free
String ID: V`
API String ID: 269201875-1164054294
Opcode ID: b34ce043af1d4467313435b6f066a038649b9eca21782199830f6f4b2c70006c
Instruction ID: 0433c06e97ea2715f1763d0e41875689611f3c93438dcbe5619d9af7703a6ea7
Opcode Fuzzy Hash: b34ce043af1d4467313435b6f066a038649b9eca21782199830f6f4b2c70006c
Instruction Fuzzy Hash: F41126B1A006058ADB20AF78AC05B363AD6BB50770F185A36F770CB1D0E37CCD4252C6

Uniqueness

Uniqueness Score: -1.00%

Function 005D3BBA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 005D3BE1

Part of subcall function 005D30BD: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005D30D0

Strings

%c:\, xrefs: 005D3BD7

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: c2eea6c56319772d4a4ceeb1e68c2d3bd07392fffad8691ce6f9a2b9d3277a38
Instruction ID: b3014fa355c763f6ec9ba244479e3a985ee2ad3d5157fcf76fffc8855f982ab1
Opcode Fuzzy Hash: c2eea6c56319772d4a4ceeb1e68c2d3bd07392fffad8691ce6f9a2b9d3277a38
Instruction Fuzzy Hash: 5801F96391431279DB34676D9C4AD6BAFACFFD5B60B40480BF484E2191FA20E940C2B3

Uniqueness

Uniqueness Score: -1.00%

Function 005D1100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 005D1134

Strings

[^^, xrefs: 005D1160
Q^^, xrefs: 005D116E

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: Malloc
String ID: Q^^$[^^
API String ID: 2696272793-1312542785
Opcode ID: e8ea2870c3436c6259940e77f5e2050c0410b43264d4fd6c1c920e87f9e4d782
Instruction ID: f1b94f9a7d4d504e1f10aadce94675f498804808598b32cb94e0a2a073909436
Opcode Fuzzy Hash: e8ea2870c3436c6259940e77f5e2050c0410b43264d4fd6c1c920e87f9e4d782
Instruction Fuzzy Hash: 11110A71A10218DFDB249FA9DC446EEBBB8FF09700F10411ED916A7211D7749945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 005E541A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005E548F

Strings

"^^, xrefs: 005E54A8
Software\WinRAR SFX, xrefs: 005E547A

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: "^^$Software\WinRAR SFX
API String ID: 176396367-4226853139
Opcode ID: 30bcf3ce4d5b0a832eb5fdd58193132f8e451c75d7d991927d0085e35e2bbe27
Instruction ID: f597be6a50686fe8afba73b8575f8a87057a5399d8b658917bdc9b7295db2bce
Opcode Fuzzy Hash: 30bcf3ce4d5b0a832eb5fdd58193132f8e451c75d7d991927d0085e35e2bbe27
Instruction Fuzzy Hash: E411A331500589AAEB34AB51EC49FEF7FBDEFC9704F00402AF55596091DB755548CB60

Uniqueness

Uniqueness Score: -1.00%

Function 005D9246 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 005D9298

Strings

z%s%02d, xrefs: 005D9287, 005D9291
z%s%d, xrefs: 005D9277

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: _swprintf
String ID: z%s%02d$z%s%d
API String ID: 589789837-468824935
Opcode ID: 1a1d96a3701305726d0febbaab7c56f25542d18efa9921685471fc5444692ca8
Instruction ID: 24dadb0f270f8a9e8c110c6d7eaf0d5070aaadf123371d63ca6fa3fbd2d30259
Opcode Fuzzy Hash: 1a1d96a3701305726d0febbaab7c56f25542d18efa9921685471fc5444692ca8
Instruction Fuzzy Hash: E90162B9600109BBCF14EE988805CFF7BAABBC9314B008027EA066B241D635AD0587A3

Uniqueness

Uniqueness Score: -1.00%

Function 005F2F8E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005F0795: GetLastError.KERNEL32(?,?,005EBC07,?,?,?,005EB682,00000050,?), ref: 005F0799
Part of subcall function 005F0795: _free.LIBCMT ref: 005F07CC
Part of subcall function 005F0795: SetLastError.KERNEL32(00000000,?), ref: 005F080D
Part of subcall function 005F0795: _abort.LIBCMT ref: 005F0813

_abort.LIBCMT ref: 005F2FC0
_free.LIBCMT ref: 005F2FF4

Strings

P[`, xrefs: 005F2FEB

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: ErrorLast_abort_free
String ID: P[`
API String ID: 289325740-2264928869
Opcode ID: 1bc61ad79702f94462e181e5028831d4ae3ea0aad091b828b73086c6c498aa30
Instruction ID: e384bbef4879563f2bab3d21893cd08c19d06757a11db7aa7f350354bf3afc92
Opcode Fuzzy Hash: 1bc61ad79702f94462e181e5028831d4ae3ea0aad091b828b73086c6c498aa30
Instruction Fuzzy Hash: 9101C871D51A2BDBC725AF68880A63EBF70BF48710F15020AEA15672C1CB386D41DFC4

Uniqueness

Uniqueness Score: -1.00%

Function 005D501A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,005D4771,?), ref: 005D501F
FindResourceW.KERNEL32(00000000,RTL,00000005,?,005D4771,?), ref: 005D502D

Strings

RTL, xrefs: 005D5027

Memory Dump Source

Source File: 00000000.00000002.1653950302.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1653784712.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653974033.00000000005FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.0000000000605000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653990318.000000000063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1654039676.000000000063B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RP.jbxd

Yara matches

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 4ab7eefcd2419bf9ea611fa5f59a18873089e91be2b51cfe644900f51207c334
Instruction ID: bdff79859b8e8eab60fa2c97cbccaf707f02cadbad6fb519dbc8ccc56c005abf
Opcode Fuzzy Hash: 4ab7eefcd2419bf9ea611fa5f59a18873089e91be2b51cfe644900f51207c334
Instruction Fuzzy Hash: 45C012B1640B5056E73117347C0DB632E4C7B21755F09094AB609D91C0DAFEC446C693

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RP.exePID: 6660, Parent PID: 6496COMMON

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B8A7260 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

SendARP.IPHLPAPI ref: 00007FFD9B8A7338

Memory Dump Source

Source File: 00000001.00000002.1704178118.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b890000_RP.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: c22d7a86569c9c4971f58b19fa022361400a536b5e5d0f01d88c15d1c6755c6f
Instruction ID: 4c5b18fd1c34c48c0447bf3c46ddd1fc14d0edc9fae5214ba8f3373aff43341a
Opcode Fuzzy Hash: c22d7a86569c9c4971f58b19fa022361400a536b5e5d0f01d88c15d1c6755c6f
Instruction Fuzzy Hash: 5941E43090DB898FD719DBA898556E9BFF0FF56321F0442AFD089C71A2CB246845CB92

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: unarchiver.exePID: 6704, Parent PID: 6496COMMON

Executed Functions

Function 014A0C99 Relevance: 6.3, Strings: 5, Instructions: 86COMMON

Download Yara Rule

Strings

`]k, xrefs: 014A0D62
P_k, xrefs: 014A0CC8
[M>, xrefs: 014A0D43, 014A0D48
e]&k^, xrefs: 014A0D6E, 014A0D73
`]k, xrefs: 014A0D37

Memory Dump Source

Source File: 00000002.00000002.1854408372.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14a0000_unarchiver.jbxd

Similarity

API ID:
String ID: P_k$[M>$`]k$`]k$e]&k^
API String ID: 0-3672109817
Opcode ID: 137dff4ed5e0ebc983f8e12052fe0eecec86e132b4aafebb850ab671c04f3da1
Instruction ID: 7049ab98782b7ba8ce1bbb7653026de033d12b38d67347e66baebe0256a04098
Opcode Fuzzy Hash: 137dff4ed5e0ebc983f8e12052fe0eecec86e132b4aafebb850ab671c04f3da1
Instruction Fuzzy Hash: 392101307006049BDB15EB39C9517AFBBE7AB95208B54482CE086CB355DF7AE9028B92

Uniqueness

Uniqueness Score: -1.00%

Function 014A0CA8 Relevance: 6.3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

Strings

`]k, xrefs: 014A0D62
P_k, xrefs: 014A0CC8
[M>, xrefs: 014A0D43, 014A0D48
e]&k^, xrefs: 014A0D6E, 014A0D73
`]k, xrefs: 014A0D37

Memory Dump Source

Source File: 00000002.00000002.1854408372.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14a0000_unarchiver.jbxd

Similarity

API ID:
String ID: P_k$[M>$`]k$`]k$e]&k^
API String ID: 0-3672109817
Opcode ID: 8b5fd4f95073f654d5904066c8a56309649203e83606222d51231fd72bca75b3
Instruction ID: 993ff203d5446681eb89adbe6c0fc0a8585925d021cab524a95d7afe3928d5ae
Opcode Fuzzy Hash: 8b5fd4f95073f654d5904066c8a56309649203e83606222d51231fd72bca75b3
Instruction Fuzzy Hash: A021F6307007144BDB14EB3999517AFBAD79BC5218B84882CD086CB745DF7AE9068B92

Uniqueness

Uniqueness Score: -1.00%

Function 014A0799 Relevance: 2.8, Strings: 2, Instructions: 284COMMON

Download Yara Rule

Strings

:@xk, xrefs: 014A08B5
:@xk, xrefs: 014A0822

Memory Dump Source

Source File: 00000002.00000002.1854408372.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14a0000_unarchiver.jbxd

Similarity

API ID:
String ID: :@xk$:@xk
API String ID: 0-804563509
Opcode ID: 5e70ae80d5c9296d054ab5e25f4415a167f4ee6393043dd860e350178d2a1645
Instruction ID: 766bf0a4aee70004426a995ed1dd37113ad74fdd0979b5b79c0e230c7e4f4248
Opcode Fuzzy Hash: 5e70ae80d5c9296d054ab5e25f4415a167f4ee6393043dd860e350178d2a1645
Instruction Fuzzy Hash: C1A18E30B102048FDB18AB74D5657AE77B3EF98308F15842AE9469B398DF79CC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 014A02C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1854408372.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14a0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c576dd4694b9f518cc1aa0a67b29efb7d2853af8f17e609098b1dfa75c5d76a
Instruction ID: 8f094311a7f3279bf29049094323ca15a31c5b7e439c9097e51fd4dd2e40bf3a
Opcode Fuzzy Hash: 4c576dd4694b9f518cc1aa0a67b29efb7d2853af8f17e609098b1dfa75c5d76a
Instruction Fuzzy Hash: 5CB172356A0114EFCB18EF74DAA5A5E7BB2FF98344B508426E9069B368CB35DC01CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010AAE05 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d2bb14bc445f6ea63f6dd84dab5bb3564ca3964c70e9196b3e7f12d4092e1e
Instruction ID: 6b3ca15524ff88b1abac4b71b3dbd12b6a68be4ac5de455ba650ea4cf11c1557
Opcode Fuzzy Hash: f3d2bb14bc445f6ea63f6dd84dab5bb3564ca3964c70e9196b3e7f12d4092e1e
Instruction Fuzzy Hash: E5317C6644D3C05FD3139B748C65A917FB89F83610B0E85CBD4C49F1B3D2292909D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 010AB246 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa70ab1e1b5d896e516784b7b59b296f86f93da7609b03e279ad9971c6d0f5ce
Instruction ID: 601870f76dd407d8812a8a282de51fd7ae5f36e6daf2f8842e5e2c1f7a26ff15
Opcode Fuzzy Hash: fa70ab1e1b5d896e516784b7b59b296f86f93da7609b03e279ad9971c6d0f5ce
Instruction Fuzzy Hash: 29319272504344AFEB228B65DC44FA6BFFCEF45214F0485AAE985CB562D224A909CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 010AAD04 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da405b7a0249a24bbcc54707a43d66067542ccc7ca6d8939e6b9865facf4fe8
Instruction ID: 50a9ef7fb9d94ac5585bdeebd11a2da0b7d2f6af6002a212e1bc9fade769157e
Opcode Fuzzy Hash: 1da405b7a0249a24bbcc54707a43d66067542ccc7ca6d8939e6b9865facf4fe8
Instruction Fuzzy Hash: EF31B371504344AFEB228B65DC44FABBFFCEF05224F0488AAF985DB552D224A549CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 010AAB76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7444d60fb2ded47163ef00f154fa40091f28277ef58725493e1f3e3f7fed0be
Instruction ID: 34068342a52548d1551a01fa14ee6abe69360e4bb081ad58c2927a117b1ce48e
Opcode Fuzzy Hash: a7444d60fb2ded47163ef00f154fa40091f28277ef58725493e1f3e3f7fed0be
Instruction Fuzzy Hash: F431907150D3C05FC3138B658C65A65BFB8AF47610F1A84CBD8C4CF5A3D2286919CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 010AA5DC Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c2ab0ad80d32afd65bae9bf4169f1845b3a80b11f2cc2dd191ddf89caebc2f
Instruction ID: 6d2066338984fcc52fdaaae717e36db2c1f83c1b25da2d46749d430c3704c5eb
Opcode Fuzzy Hash: 78c2ab0ad80d32afd65bae9bf4169f1845b3a80b11f2cc2dd191ddf89caebc2f
Instruction Fuzzy Hash: 1D31AF71504340AFE722CF65CC44F66BFE8EF49220F08849EE9858B692D375E409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 010AA120 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34e651108327c510b3aa9080af2e3d4e861fcf059f5ad169547ffe4cec0d423
Instruction ID: 86988d9109605302ead9751ee06d41b2f75e15568c963334d46dda109e5efe37
Opcode Fuzzy Hash: e34e651108327c510b3aa9080af2e3d4e861fcf059f5ad169547ffe4cec0d423
Instruction Fuzzy Hash: 6A21E27150D3C06FD3128B258C51BA6BFB4EF87610F0985CBD8C4CF693D225A909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 010AA50F Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8688455ec671b457d97890c841bdbcfeac68bffa4333c5c8462c47b55458d660
Instruction ID: 1b769abc4360831bdb83cb020fb477909cb951eca610adcd1c711b027bd45901
Opcode Fuzzy Hash: 8688455ec671b457d97890c841bdbcfeac68bffa4333c5c8462c47b55458d660
Instruction Fuzzy Hash: 9821837150E3806FD7138B25CC51B62BFB8EF87614F0A81DBE884DB593D6246919CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 010AAD2A Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621dc48c6ff1dca6a5c1862ebb0d4fbe7f65aa6676260934cda8d6cd110d9029
Instruction ID: 606391a0011adcb8695166345e1d6974b9c09b4aa7083dee8bca365c2574fc7f
Opcode Fuzzy Hash: 621dc48c6ff1dca6a5c1862ebb0d4fbe7f65aa6676260934cda8d6cd110d9029
Instruction Fuzzy Hash: CC219272600204AFEB219F55DC44FABBBECEF04224F04856AE986DB651D735E548CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010AA370 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d2625053448768599b6807842003852cdf00bb9830c42d41415c48fe5391d75
Instruction ID: eae349ddadbad91c29326820808d275c2efc44c322f9662737e3d75e92388c93
Opcode Fuzzy Hash: 0d2625053448768599b6807842003852cdf00bb9830c42d41415c48fe5391d75
Instruction Fuzzy Hash: B3218B76604740AFE721CF55DC84FA6BBFCEF45610F08849AE985CB292D364E948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010AB276 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfce7b51b137a67662b01280725e55eb76f379a4495b9b09bc001715c599b390
Instruction ID: 3b65e97fcb2e80e3d652c3d80a4c3d199922b373564db72ed15c0f93b8d53e2e
Opcode Fuzzy Hash: bfce7b51b137a67662b01280725e55eb76f379a4495b9b09bc001715c599b390
Instruction Fuzzy Hash: 7F21A172500204AFEB21DF65DC44FABBBECEF04214F04896AE985DB652D375E5488BB1

Uniqueness

Uniqueness Score: -1.00%

Function 010AA850 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9135427dc81c9c6adb187402b1a026f802c3a82579ddd48f06fbcdf5383ecb11
Instruction ID: 24c40f885aba93249202b4244825b7623819bdd170190180893da330609a14e9
Opcode Fuzzy Hash: 9135427dc81c9c6adb187402b1a026f802c3a82579ddd48f06fbcdf5383ecb11
Instruction Fuzzy Hash: BC21B671508380AFE7228B54DC44FA6BFB8EF46714F0985DAE984CF553D274A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 010AA933 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9f229a9961dbb22b49ff5a720c21203d95271e3b826ab486bf9f7c62a2b573
Instruction ID: 0ac68496fd021d37f09b38181d8ec2cecf529f7db908abedaece0a08fbbb6e69
Opcode Fuzzy Hash: ae9f229a9961dbb22b49ff5a720c21203d95271e3b826ab486bf9f7c62a2b573
Instruction Fuzzy Hash: 5121AE71509380AFDB228F65DC44F96BFB8EF06214F0885DAE9849F252D275A548CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 010AA5FE Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf41c75f36c1de128e8b3560cb6783f7a35f6bf99070f6000f8c728dbc8eca0d
Instruction ID: f5b343dd9b7fabb9d4b4ce107b6b7efd5fdac65623f8d4f01d37445703853793
Opcode Fuzzy Hash: bf41c75f36c1de128e8b3560cb6783f7a35f6bf99070f6000f8c728dbc8eca0d
Instruction Fuzzy Hash: 0F219271600200EFEB21CF65DD45F66FBE8EF48224F04846AE9858B692D375E508CF72

Uniqueness

Uniqueness Score: -1.00%

Function 010AA78F Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085895cfb324f801289c65a941fde938f21c4b081324bdc4da77588358cbaead
Instruction ID: 6af0a4b5f9b5782501d815582a7e0db06241acaf19374a829ccb73750aa6eab4
Opcode Fuzzy Hash: 085895cfb324f801289c65a941fde938f21c4b081324bdc4da77588358cbaead
Instruction Fuzzy Hash: D021D5B54083806FE7128B51DC40BA6BFB8DF46314F0980DAE9848B293D268A909CB76

Uniqueness

Uniqueness Score: -1.00%

Function 010AAA0B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11641c3792e7f03b27667889345afce9bbc6581d21d8dfcc28b5ff4a6f88e6f
Instruction ID: 7467f14c49fdaf42dfbdcca691e6ed584d8eefd1a37364d9ec0764fc1ffd57df
Opcode Fuzzy Hash: e11641c3792e7f03b27667889345afce9bbc6581d21d8dfcc28b5ff4a6f88e6f
Instruction Fuzzy Hash: 2B21B3716083C09FEB52CB69DC55B92BFE8AF06324F0D84EAE984CB193D324D905CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010AA6D4 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37f351c536abf045d666b284a7e7a45e675f7cb238511490e44946ac910b485
Instruction ID: d96f344153fccaf3c40d5e92f341505d65e198f2124c0390a5f1881566c422a0
Opcode Fuzzy Hash: f37f351c536abf045d666b284a7e7a45e675f7cb238511490e44946ac910b485
Instruction Fuzzy Hash: 9521B3755097C09FD7138B25DC95652BFB8EF07320F0984DADC858F1A3D2645908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010AA392 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765412839b6763b3e30cc84f9902ab18b52e11af580c72fa3cbddf19eb88040c
Instruction ID: 5ec45ff222f2e31f6bcf36496310a76f6f2acbc50ed89eeb387a5b58d4804d65
Opcode Fuzzy Hash: 765412839b6763b3e30cc84f9902ab18b52e11af580c72fa3cbddf19eb88040c
Instruction Fuzzy Hash: 0421A176200204AFEB60CE55CC84FA6F7ECEF04610F04C59AE985CB691D764E848CB72

Uniqueness

Uniqueness Score: -1.00%

Function 014A0BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1854408372.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14a0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bc7787c23bdfa5af80aff3d07dbf5fef50412f98d7aeb191056d46e69faa94
Instruction ID: ac8f4307b5ac2a0b7d2149351f170eb93918137a623bd2d9bb550efadae05b31
Opcode Fuzzy Hash: 07bc7787c23bdfa5af80aff3d07dbf5fef50412f98d7aeb191056d46e69faa94
Instruction Fuzzy Hash: 6C119E32A20118AFCF04ABB4D85599EBBF6FF98218B054475E605E7374EB35E8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 010AA962 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0ed48c034a65269af2db5a1251e1680cb7fc3df31516f6a12db6cd7bd341e3c
Instruction ID: 52c17a5d36995aa9fad245d19f3295a56656a6bbea0e4f89427dc759072d5713
Opcode Fuzzy Hash: b0ed48c034a65269af2db5a1251e1680cb7fc3df31516f6a12db6cd7bd341e3c
Instruction Fuzzy Hash: E911E771500200EFEB21CF55DD84FAAFBE8EF04324F04855AE9858B691D375A548CFB2

Uniqueness

Uniqueness Score: -1.00%

Function 010AA882 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 196d003fa06a9eb94947de1b7dc3a85e2c673b87b7982d694ad6aad9af53fe9b
Instruction ID: b28f80d1990c1cee9e3435d490306eaeabf0be100a786b39c93952583db6d323
Opcode Fuzzy Hash: 196d003fa06a9eb94947de1b7dc3a85e2c673b87b7982d694ad6aad9af53fe9b
Instruction Fuzzy Hash: B211E371500200AFEB61CF54DC84BAAFBE8EF44324F04C49AE9859B685D375A548CFB2

Uniqueness

Uniqueness Score: -1.00%

Function 010AA2AE Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e49fc9ff8b7d5c566db61369cf05ae609f2152fc2152b411e10a0da1690616
Instruction ID: f08c123d11f363dca8917de2e60c4aec86cdf825cd24d47b4890c456d7229906
Opcode Fuzzy Hash: 30e49fc9ff8b7d5c566db61369cf05ae609f2152fc2152b411e10a0da1690616
Instruction Fuzzy Hash: F61191755093C09FDB228B25DC94A52BFB4DF07220F0980DBE9848F1A3D275A808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 010AAF8B Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e747938feb3c27e4b3998d67411f57d08bb4b4fd88ad9ee3cc24bf9afe99e258
Instruction ID: a03936cea9519213ef894b46ad2f10cc98ba3b215ce82bf6d75c8279d1945be2
Opcode Fuzzy Hash: e747938feb3c27e4b3998d67411f57d08bb4b4fd88ad9ee3cc24bf9afe99e258
Instruction Fuzzy Hash: 3411A0715493C09FDB128B29DC85A52BFF4EF06220F0984DAED858B263D278A808DB61

Uniqueness

Uniqueness Score: -1.00%

Function 010AB1B4 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42171f0c65a88d61229209a32f815efd82dd11222b32589cfdcd39e94e94a415
Instruction ID: 639774c32b6cf525c17c0a80dd69c6c72b2c16c6a3af2a293dc77c9c903341d3
Opcode Fuzzy Hash: 42171f0c65a88d61229209a32f815efd82dd11222b32589cfdcd39e94e94a415
Instruction Fuzzy Hash: A6117C715093809FDB528F15DC84B56BFF4DF46220F0884EBED889F253D279A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010AA7C2 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500ea69b53939a0262ad078c6b06d5bb1137ecdea04a9117f0d983777d43c29a
Instruction ID: 2c266cbe7e7eb5c8464908cfd5b508cdacc72a123baf82554322addde13c3819
Opcode Fuzzy Hash: 500ea69b53939a0262ad078c6b06d5bb1137ecdea04a9117f0d983777d43c29a
Instruction Fuzzy Hash: C801D675500204AFE760CB45DC84BAAFBE8DF04624F04C096ED858B782D379E948CFB6

Uniqueness

Uniqueness Score: -1.00%

Function 010AAA46 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aafa86820072dce57d126d75a9c19e92632ec531b89a2cc9055304a29f9b7f59
Instruction ID: faa33cfc63948659a1185f5cc6f93a0503546264bd670154371ab745f40c0db0
Opcode Fuzzy Hash: aafa86820072dce57d126d75a9c19e92632ec531b89a2cc9055304a29f9b7f59
Instruction Fuzzy Hash: 18116571700240DFEB50CF59D984756FBE8EF14220F48C4AADD85CB686D375D904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01380808 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1854245600.0000000001380000.00000040.00000020.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7464a98b41d874949c385a7fee1b3ca3a8e6a71af844dd0ecfaaacb9fe6e3c93
Instruction ID: 08fd86f391bd8b5eb67bc904a2c36eb2741c1914b40192307c95b39d03641b7f
Opcode Fuzzy Hash: 7464a98b41d874949c385a7fee1b3ca3a8e6a71af844dd0ecfaaacb9fe6e3c93
Instruction Fuzzy Hash: 7D0179B24093906FD701DB15AC45C96BFF8EF86524B08C59EEC88CB601D27569098BA2

Uniqueness

Uniqueness Score: -1.00%

Function 010AABE6 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703320541db38c4948b94203d5e56184826e227520bb3a94f04960835429f6c1
Instruction ID: 332a4723e316f88f02f3f050260dc34234ff4fd444f480a650beeecb1992dbeb
Opcode Fuzzy Hash: 703320541db38c4948b94203d5e56184826e227520bb3a94f04960835429f6c1
Instruction Fuzzy Hash: 0501B171600200AFD350DF16CC85B66FBF8FB88A20F14811AEC489BB45E731B915CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 010AA172 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87cd1f72fb67f96ca1caae2d5089e2f53558e57bfc903bfd2feebe9c1473a3d1
Instruction ID: 02b6171910595137efdd5e52d8c5aaf3fe7ed5d46fb6d18f7c2698a460c86749
Opcode Fuzzy Hash: 87cd1f72fb67f96ca1caae2d5089e2f53558e57bfc903bfd2feebe9c1473a3d1
Instruction Fuzzy Hash: 9001B171600200AFD350DF16CC85B66FBF8EB88A20F14815AEC489BB45E735B915CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 010AB470 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b9c5cfa3f54babbd5463bbb0b5906e62c233740ed43d031bd3060243682d2e
Instruction ID: 9f4af83af000223f8f4788da771ebd735726d635f9f3d7d3de9810c7fd93682c
Opcode Fuzzy Hash: 36b9c5cfa3f54babbd5463bbb0b5906e62c233740ed43d031bd3060243682d2e
Instruction Fuzzy Hash: 1201A2B25493806FD7118B119C41FA2BFB8DB43A20F09C5DAE9449F593D169B909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 013805E2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1854245600.0000000001380000.00000040.00000020.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68fdd723eb578dc89d7a37ad5dab0dc22507977fcfeb5c89166cd2178137661c
Instruction ID: 88f8576e61801cfc083c3cfa448318eeca955baa8c5cfcf9827db3b11f11e748
Opcode Fuzzy Hash: 68fdd723eb578dc89d7a37ad5dab0dc22507977fcfeb5c89166cd2178137661c
Instruction Fuzzy Hash: A501A9B65093905FD7518F15AC40862FFF8EF86630749C49FEC89CB652D239A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 010AA716 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58f1bd953a3b6e41eece76edd48ceba30bef6a57f57e858681d808b813ceb28
Instruction ID: 07e4c6bac8c1500fdcdd679b279afdd2da1a36e8a4cea059c397925c02a29d83
Opcode Fuzzy Hash: d58f1bd953a3b6e41eece76edd48ceba30bef6a57f57e858681d808b813ceb28
Instruction Fuzzy Hash: 36018475600240CFDB508F59DD8576AFBE4EF04220F48C4AADD8ACB696D279E944CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 010AA566 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f343d2d7760b311a25e43b2464e2cd4daab67442405c4f30e7f72445ab0506
Instruction ID: bc02ba3af30e0c35e1d2197af9535d855e360bf96c61b0e3e327f268a4018c18
Opcode Fuzzy Hash: 39f343d2d7760b311a25e43b2464e2cd4daab67442405c4f30e7f72445ab0506
Instruction Fuzzy Hash: 8501AD71600200ABD250DF16CC86B66FBF8FB88A20F14815AEC489BB41E731F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 010AAFB2 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a96169280b44b0f6d342160820eb2faeffad89f63a469011b8df2cd8ccb40a0
Instruction ID: 441b4bb48ae97e4ccffde7d120ddaac1f2e02f4c227da337bb26799c8ddf5dd8
Opcode Fuzzy Hash: 4a96169280b44b0f6d342160820eb2faeffad89f63a469011b8df2cd8ccb40a0
Instruction Fuzzy Hash: 1601F475600244CFDB548F59E984766FBE4EF04324F48C0AADD898B792D379E848DEA2

Uniqueness

Uniqueness Score: -1.00%

Function 010AB1D6 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59d27be62701b0337566a6fdb9538436ad28d585588666864e2fe842c8316094
Instruction ID: eaf2f2325da92e836121bdee91e0ce4cc82d0d6709236d392d62e33c2359e069
Opcode Fuzzy Hash: 59d27be62701b0337566a6fdb9538436ad28d585588666864e2fe842c8316094
Instruction Fuzzy Hash: DC01D1719002408FDB50CF59E984769FBE4EF04220F48C4ABDD888F756D279E908CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 010AA2DA Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399b945d2d76755b29e8526072d67af9ec276b7aac90a61df4d54229538f9e98
Instruction ID: 304a2154cc43d388c01a3d9d84b68c13f3bfc21cc82d437fe3d69e61f4c4031d
Opcode Fuzzy Hash: 399b945d2d76755b29e8526072d67af9ec276b7aac90a61df4d54229538f9e98
Instruction Fuzzy Hash: B4F0A435504244CFDB608F06D984765FBE0DF04624F48C09ADD894F796D3B9E408CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 0138082E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1854245600.0000000001380000.00000040.00000020.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2eae01e6f4b905ac4fc18ae1a033040b042accff66da7a5554686c67a11eaa
Instruction ID: dbe4b0c5b9a02f11016bc2de8ed24da0a929b46c7ae389a68686542c86a7ec5a
Opcode Fuzzy Hash: 8a2eae01e6f4b905ac4fc18ae1a033040b042accff66da7a5554686c67a11eaa
Instruction Fuzzy Hash: 20F082B2945204AF9240DF05ED85C96F7ECEFC8521F04C52EEC0C8B701E276A9194AE2

Uniqueness

Uniqueness Score: -1.00%

Function 014A0C50 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1854408372.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14a0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 450e285c84a63ddec183b220a1750e6a433011d7e36324579cfb785dd1786a30
Instruction ID: af6f0f25a5d8da12cb94705ec9afb0c28ed8264dc57665615b38f3182197b575
Opcode Fuzzy Hash: 450e285c84a63ddec183b220a1750e6a433011d7e36324579cfb785dd1786a30
Instruction Fuzzy Hash: 40E0DF31F242245FCB04DBB888A219E7FF1DF96218B5044B9D008CB341EF39C8028380

Uniqueness

Uniqueness Score: -1.00%

Function 01380606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1854245600.0000000001380000.00000040.00000020.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b7b21c7cf37df88888c0c9f235222e920da5bd78e391aa201649314f4ad4fc
Instruction ID: 1b49c14bc7052f5b86143de4e75b543d54763abd036284790eecb50564dcc8f4
Opcode Fuzzy Hash: 76b7b21c7cf37df88888c0c9f235222e920da5bd78e391aa201649314f4ad4fc
Instruction Fuzzy Hash: 73E092B66006404B9650CF0AFC81452F7E8EB84630708C07FDC0D8BB01D235B508CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 010AB49E Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15826f1d291d5291700919df2fa150c433268acd7d2eada768198ef0fb3afe71
Instruction ID: 104b8dac93553d7da860fc83f52f6fa734b4255acfde6c93d7069d0b82d2d59d
Opcode Fuzzy Hash: 15826f1d291d5291700919df2fa150c433268acd7d2eada768198ef0fb3afe71
Instruction Fuzzy Hash: 32E048B564030467D6609E069D86B62F798DB44A30F54C066ED095F781E1B6B50489A5

Uniqueness

Uniqueness Score: -1.00%

Function 010AAEB2 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853604793.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10aa000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f26349067319bead15e5cc3720169856d3ebdd01086f209e4646d4ed794c7ed0
Instruction ID: babb683e32833db67fe17bee18b60d2bee8b0bb6c8a4cbef71da1ec22eb572b2
Opcode Fuzzy Hash: f26349067319bead15e5cc3720169856d3ebdd01086f209e4646d4ed794c7ed0
Instruction Fuzzy Hash: E0E0D8B264030467D6609E069C82F62F798DB40A30F14C067ED085F782E1B6B51489B5

Uniqueness

Uniqueness Score: -1.00%

Function 014A0C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1854408372.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14a0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3aff506524ca6ffdd545f2e0e634f7a263161861ea15de6d7661e4d52e3b90
Instruction ID: 9e38b638c42f5c114da7df5047166169c16957b9bc36fc2ee377dff39b8486a9
Opcode Fuzzy Hash: dd3aff506524ca6ffdd545f2e0e634f7a263161861ea15de6d7661e4d52e3b90
Instruction Fuzzy Hash: 56D01732F102286B8B58EBB998525AEBBEA9B85168B5484BD9009D7340EF39D8018780

Uniqueness

Uniqueness Score: -1.00%

Function 014A0DD1 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1854408372.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14a0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5d68d26f1c4d81f2ee4741ab94f1d8a402d4ee4d846dfe65646be046dd8eee
Instruction ID: 22bda2f6ba1d98b830dff55245ffa0a53f9ac3b3f6eecbbd580463be226a3575
Opcode Fuzzy Hash: 3b5d68d26f1c4d81f2ee4741ab94f1d8a402d4ee4d846dfe65646be046dd8eee
Instruction Fuzzy Hash: 57E0C2302943409FCB06CB38D455AAA3FB1AFE2218F4A89DAD404CF6B3C335D844DB81

Uniqueness

Uniqueness Score: -1.00%

Function 010A23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853546626.00000000010A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10a2000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ea217fa4c6890702eb8235a4e25ca4e9e3b62abf073176ff0abb5178df3dff
Instruction ID: ee66afb7858dbf1a65607daad9e530b02794cdc7dc51c64890004b725b9ca0b4
Opcode Fuzzy Hash: c0ea217fa4c6890702eb8235a4e25ca4e9e3b62abf073176ff0abb5178df3dff
Instruction Fuzzy Hash: 53D05E792057C14FE3169A1CC1A4F953BE4AB51718F8A44F9A8808B763CB68D5D1D600

Uniqueness

Uniqueness Score: -1.00%

Function 010A23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853546626.00000000010A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10a2000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f754ed07f9960b898d39a0656f6c001c5968c4d0b9946712b89946eb0f38b7cd
Instruction ID: f2aa8348f1ca0f7053ef4c76a39f876fb6893317ddbc9f46795db2e1084f38d9
Opcode Fuzzy Hash: f754ed07f9960b898d39a0656f6c001c5968c4d0b9946712b89946eb0f38b7cd
Instruction Fuzzy Hash: 90D05E352002814FDB25DA0CC2D4F593BD4AF41714F4684F8AC508B762C7A8D8C0CA00

Uniqueness

Uniqueness Score: -1.00%

Function 014A0DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1854408372.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14a0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32c4af0e73f0ce9f2d1310dcad49d49890b1075372f8e21d8198e1a8e40f445
Instruction ID: 8b34ae89858dc0c04b9553cc73b869ddabb54c56c0179b7fd95283cbfa16e2ea
Opcode Fuzzy Hash: b32c4af0e73f0ce9f2d1310dcad49d49890b1075372f8e21d8198e1a8e40f445
Instruction Fuzzy Hash: A5C012302902088FD704AB78D519A26779657F0618FCAC065A5090B775CA74E840D680

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RP.sfx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: 44Caliber Stealer

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\44\Information.txt

C:\ProgramData\44\Process.txt

C:\ProgramData\44\Screen.png

C:\Users\Public\fqs92o4p.default-release\cert9.db

C:\Users\Public\fqs92o4p.default-release\key4.db

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RP.EXE.log

C:\Users\user\AppData\Local\Temp\tmp16B1.tmp.tmpdb

C:\Users\user\AppData\Local\Temp\tmp16C1.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp1701.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp1721.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp1751.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp1752.tmp.tmpdb

C:\Users\user\AppData\Local\Temp\tmp1772.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp17B2.tmp.dat

Windows Analysis Report
RP.sfx.exe

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre