f422d28bbfd249b233299b1e98706816d23029424646a5f7e8d8ad0e37db76b2

Analysis

max time kernel
1633s
max time network
1416s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05-03-2022 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Signalis/Signalis.exe
Size

69.8MB
MD5

33bd053094b7591ca9ae11aa8dd7b8a4
SHA1

4b72562246dd98ff3d592bd0a837ce56a06f3dce
SHA256

1aa24aaa3e192b52553a16d16cffdb34ca1c30c7ace18f8e4195afaeec738997
SHA512

860fa50cc5c62b3c93b7dbabe1d216dbe28bf874887c957181beae61f22716a81f3ec0924fa456ba84a51abb5f083d6cd803fa4bfb1244c87e6e97a889174d68

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

Processes:

GameSetup.exeGameSetup.exeGameSetup.exeGameSetup.exeGameSetup.exe

pid process

4324 GameSetup.exe
1780 GameSetup.exe
3464 GameSetup.exe
2620 GameSetup.exe
2332 GameSetup.exe

pid	process
4324	GameSetup.exe
1780	GameSetup.exe
3464	GameSetup.exe
2620	GameSetup.exe
2332	GameSetup.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GameSetup.exeGameSetup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	GameSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	GameSetup.exe

Loads dropped DLL 13 IoCs

Processes:

Signalis.exeGameSetup.exeGameSetup.exeGameSetup.exeGameSetup.exeGameSetup.exe

pid	process
4524	Signalis.exe
4524	Signalis.exe
4324	GameSetup.exe
1780	GameSetup.exe
3464	GameSetup.exe
1780	GameSetup.exe
2620	GameSetup.exe
1780	GameSetup.exe
1780	GameSetup.exe
2620	GameSetup.exe
2620	GameSetup.exe
2332	GameSetup.exe
2332	GameSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

GameSetup.exeGameSetup.exeGameSetup.exe

pid process

3464 GameSetup.exe
3464 GameSetup.exe
2620 GameSetup.exe
2620 GameSetup.exe
2332 GameSetup.exe
2332 GameSetup.exe
2332 GameSetup.exe
2332 GameSetup.exe

pid	process
3464	GameSetup.exe
3464	GameSetup.exe
2620	GameSetup.exe
2620	GameSetup.exe
2332	GameSetup.exe
2332	GameSetup.exe
2332	GameSetup.exe
2332	GameSetup.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

Signalis.exeGameSetup.exe

description	pid	process	target process
PID 4524 wrote to memory of 4324	4524	Signalis.exe	GameSetup.exe
PID 4524 wrote to memory of 4324	4524	Signalis.exe	GameSetup.exe
PID 4524 wrote to memory of 4324	4524	Signalis.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 1780	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 3464	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 3464	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 3464	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 2620	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 2620	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 2620	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 2332	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 2332	4324	GameSetup.exe	GameSetup.exe
PID 4324 wrote to memory of 2332	4324	GameSetup.exe	GameSetup.exe

C:\Users\Admin\AppData\Local\Temp\Signalis\Signalis.exe
"C:\Users\Admin\AppData\Local\Temp\Signalis\Signalis.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4524

C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4324

C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
"C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe" --type=gpu-process --field-trial-handle=1592,12516936935095484719,16173292607987732934,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1612 /prefetch:2
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780

C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
"C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe" --type=utility --field-trial-handle=1592,12516936935095484719,16173292607987732934,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2168 /prefetch:8
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3464

C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
"C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe" --type=renderer --field-trial-handle=1592,12516936935095484719,16173292607987732934,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#0c0d10 --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2380 /prefetch:1
3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2620

C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
"C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe" --type=gpu-process --field-trial-handle=1592,12516936935095484719,16173292607987732934,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAEAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\D3DCompiler_47.dll
MD5
6bc4ada9a7cab72f49c564e6c86b4c3e

SHA1
f0fba01542a0fbe585106f7efd884df65e8c89dc

SHA256
7d0d1290382ea0e44a3178446a0c202696237e27dbb5f8f0827691092b8f2228

SHA512
d7ec39514c104b40a42cd3ca956ba84f5a78f237a39f40d85ba54983145bce2dfbc7ec5e0cbc1bf8ab64d1d370371a7cba5e30202d2c1f37782db32486ed7f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
MD5
f5730ff133bb1267cfd49ec58b371b81

SHA1
3548cc6e793116baed9f1d9843afab7f89bea8c6

SHA256
3be162f34b8109d1b900636a9f05b22e53eca56cfdf1c0f9a6ac6c43ded722af

SHA512
c149f6a6494f66ea6cb7fa3121bcfdf20fc115f90b93d33318216579257d165975922dddb78caf411b06e72d4ebc4da910d15679f291192d0019979f951308c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
MD5
f5730ff133bb1267cfd49ec58b371b81

SHA1
3548cc6e793116baed9f1d9843afab7f89bea8c6

SHA256
3be162f34b8109d1b900636a9f05b22e53eca56cfdf1c0f9a6ac6c43ded722af

SHA512
c149f6a6494f66ea6cb7fa3121bcfdf20fc115f90b93d33318216579257d165975922dddb78caf411b06e72d4ebc4da910d15679f291192d0019979f951308c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
MD5
f5730ff133bb1267cfd49ec58b371b81

SHA1
3548cc6e793116baed9f1d9843afab7f89bea8c6

SHA256
3be162f34b8109d1b900636a9f05b22e53eca56cfdf1c0f9a6ac6c43ded722af

SHA512
c149f6a6494f66ea6cb7fa3121bcfdf20fc115f90b93d33318216579257d165975922dddb78caf411b06e72d4ebc4da910d15679f291192d0019979f951308c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
MD5
f5730ff133bb1267cfd49ec58b371b81

SHA1
3548cc6e793116baed9f1d9843afab7f89bea8c6

SHA256
3be162f34b8109d1b900636a9f05b22e53eca56cfdf1c0f9a6ac6c43ded722af

SHA512
c149f6a6494f66ea6cb7fa3121bcfdf20fc115f90b93d33318216579257d165975922dddb78caf411b06e72d4ebc4da910d15679f291192d0019979f951308c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
MD5
f5730ff133bb1267cfd49ec58b371b81

SHA1
3548cc6e793116baed9f1d9843afab7f89bea8c6

SHA256
3be162f34b8109d1b900636a9f05b22e53eca56cfdf1c0f9a6ac6c43ded722af

SHA512
c149f6a6494f66ea6cb7fa3121bcfdf20fc115f90b93d33318216579257d165975922dddb78caf411b06e72d4ebc4da910d15679f291192d0019979f951308c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\GameSetup.exe
MD5
f5730ff133bb1267cfd49ec58b371b81

SHA1
3548cc6e793116baed9f1d9843afab7f89bea8c6

SHA256
3be162f34b8109d1b900636a9f05b22e53eca56cfdf1c0f9a6ac6c43ded722af

SHA512
c149f6a6494f66ea6cb7fa3121bcfdf20fc115f90b93d33318216579257d165975922dddb78caf411b06e72d4ebc4da910d15679f291192d0019979f951308c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\chrome_100_percent.pak
MD5
7c4728b2d58afdd97c4549c96b9561cc

SHA1
1e0d251eedd67e7021fc764b9188184617465c54

SHA256
419cfcc6dc5f38b2e0c970ebd4fad1ef55054579d5c0db2521d7ae494996aac3

SHA512
82d0931e4d1cf38f88050980f518cdacdc981c382771b1732bfbe69f601074a0e7378e27a7470c7dea4e287cb1617a5c038052908ed85134abcd5b6591b4e7df

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\chrome_200_percent.pak
MD5
6af049ad6fd11ee90ad9db31c4e02082

SHA1
5d2f9a59a74dc584b5dd78aeb6de583e969e3eb7

SHA256
edecf8e1ac353bfdae534e42507e5a59973cb4cab76fbb1ff1a470363e725bc4

SHA512
c7fa6e1a57861e62b9b4d615a988c98d13cde8abc23eaed7c36c2ecb86409da4b65b1f579ca2f307e90eb4d08d14b07f7f41ccb8d8c165d6de67c09c16009715

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\d3dcompiler_47.dll
MD5
6bc4ada9a7cab72f49c564e6c86b4c3e

SHA1
f0fba01542a0fbe585106f7efd884df65e8c89dc

SHA256
7d0d1290382ea0e44a3178446a0c202696237e27dbb5f8f0827691092b8f2228

SHA512
d7ec39514c104b40a42cd3ca956ba84f5a78f237a39f40d85ba54983145bce2dfbc7ec5e0cbc1bf8ab64d1d370371a7cba5e30202d2c1f37782db32486ed7f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\ffmpeg.dll
MD5
35ec77b86471ee4430245670075ac475

SHA1
809f227f5a011b3e0e329a0ea808c07591d4beb0

SHA256
973aa70e9542f30d816302bdab9dc400e47e0c6f3356ef75cf423f03e1404b11

SHA512
665c93b460785218a49f1254f73c8ce9a144987b1392888ce4e2af96736068e843910aeff5260b96a839ceb743b9b2f1a20aff363243c72d046b9d1d8366f23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\ffmpeg.dll
MD5
35ec77b86471ee4430245670075ac475

SHA1
809f227f5a011b3e0e329a0ea808c07591d4beb0

SHA256
973aa70e9542f30d816302bdab9dc400e47e0c6f3356ef75cf423f03e1404b11

SHA512
665c93b460785218a49f1254f73c8ce9a144987b1392888ce4e2af96736068e843910aeff5260b96a839ceb743b9b2f1a20aff363243c72d046b9d1d8366f23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\ffmpeg.dll
MD5
35ec77b86471ee4430245670075ac475

SHA1
809f227f5a011b3e0e329a0ea808c07591d4beb0

SHA256
973aa70e9542f30d816302bdab9dc400e47e0c6f3356ef75cf423f03e1404b11

SHA512
665c93b460785218a49f1254f73c8ce9a144987b1392888ce4e2af96736068e843910aeff5260b96a839ceb743b9b2f1a20aff363243c72d046b9d1d8366f23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\ffmpeg.dll
MD5
35ec77b86471ee4430245670075ac475

SHA1
809f227f5a011b3e0e329a0ea808c07591d4beb0

SHA256
973aa70e9542f30d816302bdab9dc400e47e0c6f3356ef75cf423f03e1404b11

SHA512
665c93b460785218a49f1254f73c8ce9a144987b1392888ce4e2af96736068e843910aeff5260b96a839ceb743b9b2f1a20aff363243c72d046b9d1d8366f23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\ffmpeg.dll
MD5
35ec77b86471ee4430245670075ac475

SHA1
809f227f5a011b3e0e329a0ea808c07591d4beb0

SHA256
973aa70e9542f30d816302bdab9dc400e47e0c6f3356ef75cf423f03e1404b11

SHA512
665c93b460785218a49f1254f73c8ce9a144987b1392888ce4e2af96736068e843910aeff5260b96a839ceb743b9b2f1a20aff363243c72d046b9d1d8366f23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\ffmpeg.dll
MD5
35ec77b86471ee4430245670075ac475

SHA1
809f227f5a011b3e0e329a0ea808c07591d4beb0

SHA256
973aa70e9542f30d816302bdab9dc400e47e0c6f3356ef75cf423f03e1404b11

SHA512
665c93b460785218a49f1254f73c8ce9a144987b1392888ce4e2af96736068e843910aeff5260b96a839ceb743b9b2f1a20aff363243c72d046b9d1d8366f23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\icudtl.dat
MD5
3f019441588332ac8b79a3a3901a5449

SHA1
c8930e95b78deef5b7730102acd39f03965d479a

SHA256
594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57

SHA512
ee083ae5e93e70d5bbebe36ec482aa75c47d908df487a43db2b55ddd6b55c291606649175cf7907d6ab64fc81ead7275ec56e3193b631f8f78b10d2c775fd1a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\locales\en-US.pak
MD5
98c8cfc3cb98ab34e06d4323b8bcb043

SHA1
2c0bda072161530b710fa0a1dfc3c23926184afe

SHA256
35adc5aeeebfe440e295b88d2a4089360ada33c353843b1f5438f4118501878b

SHA512
25edeca13b4a29f63bdc4f135eda1b1b8c72f3a58315f57895950bdc15f56b2af1aca42affe397716f5965437ece836f683265a33ec919b8b26056634612ed3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\resources.pak
MD5
d9022282a7fbf3aa354559ab6a9c7926

SHA1
ff1f2b77d80848bc1a51e48c21a033eb57d8776c

SHA256
ddc85d749b19cbabae11a0b8f7114daf75900179a2147280dd0f9f8faee7d65c

SHA512
6b9ab157cf8e10d8a79ea2ad4e247210fe2a7fd75dab086eb55951d4e028af3060e1f42175be936c6b093abc2c3071c0fd1c45afee3c567a79e1b722fe5f5d97

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\resources\app.asar
MD5
a3a14e62b8bbb2efb08f4086ffcd667d

SHA1
347c483be84de55cd5484e28742ff6c2dcb1fbfe

SHA256
9f56e4c3025f43cad0c018b6c7a626cd6890a081d27b6075a13446228c172228

SHA512
627f5ca6cc79b198403ca7a95a6cc684b71570a3ed3fe7fb04b89876e8cbcffb252c1e2e953c96bdf894cee10f06947afc0973dd956ee269d0bc428f6a588c25

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\resources\assets\images\background.png
MD5
32338b60ff8368fd431b32109eae89d2

SHA1
7a3a844f2e6371c8f3a08a142e2e792a6e77105a

SHA256
1d370406c3b0c6bfe109feb76229fd4a0fe1d4171ae2a77655a0fd3264558d2f

SHA512
be71b3dcc24cea203d59e08d8a4082dcf253eb02a971e67034f8cc0930f6af72830b1e35430cc861c08341082156585adcedcbfc788a83ec35fbd78107e20f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\resources\assets\license.txt
MD5
7f8e6e93556bc778f97ef40829432b36

SHA1
791a4d22a923718548e1a99795c6504d4c54094c

SHA256
eb3755e99c586f75e466047f377b3d22717ffa2733da135b6e4ece2186e0e491

SHA512
7ae3a22c0eab36458d8b73d759c277a81776c6686c2564e50bb684de7aac12d41c93367becb486dc099a8a43c31bf74e61c6f226bee0469de49de478d73f11f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\swiftshader\libEGL.dll
MD5
a0317784b0f2a415ba104c649f07afdb

SHA1
89263be130d10ae56d7e5e6f22346d73c77e649b

SHA256
5c53d3368de804706ba87da47db599d40e31f835460fcdc6fb1797afe96fcd5a

SHA512
a477d1273feb5cb91868a60c6de5d6db3020f25c29134876fa1840ede4a98206d6963620c7a224d9afc13d273bbf0ef5d73a4571f42c2b810c21bbb29fe3b106

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\swiftshader\libGLESv2.dll
MD5
c0481ac7e49d58dfcdd8d6d410dc1127

SHA1
be53da962844f448defc088a2f1f21023268c89d

SHA256
e0c1c19b704d414aba732ab8dc20d289e7fe597b21715a68b4153dbba720879c

SHA512
7d3c747f639bb6e3b8140da6acb28b6206fd7ac7156b4f6948b818002587a29df07f399fc23160e314a46f6a912544fdab377caa1b926f4f2ac31995a8ade515

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\swiftshader\libegl.dll
MD5
a0317784b0f2a415ba104c649f07afdb

SHA1
89263be130d10ae56d7e5e6f22346d73c77e649b

SHA256
5c53d3368de804706ba87da47db599d40e31f835460fcdc6fb1797afe96fcd5a

SHA512
a477d1273feb5cb91868a60c6de5d6db3020f25c29134876fa1840ede4a98206d6963620c7a224d9afc13d273bbf0ef5d73a4571f42c2b810c21bbb29fe3b106

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\swiftshader\libglesv2.dll
MD5
c0481ac7e49d58dfcdd8d6d410dc1127

SHA1
be53da962844f448defc088a2f1f21023268c89d

SHA256
e0c1c19b704d414aba732ab8dc20d289e7fe597b21715a68b4153dbba720879c

SHA512
7d3c747f639bb6e3b8140da6acb28b6206fd7ac7156b4f6948b818002587a29df07f399fc23160e314a46f6a912544fdab377caa1b926f4f2ac31995a8ade515

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\v8_context_snapshot.bin
MD5
dd199449f39f224376c2e3b3f5862d83

SHA1
1568ed6bf9b92371a11176f4ddf01c7f5a2d7b0f

SHA256
c9740e7e3028b643acfbfd634318c76e56f7f6bb53ce09e4b3ac179a6132bffa

SHA512
d88364ee2b540debf5e3e16fd712977c4f8dd979c2ea4746fccbd02a9daaee0c99fb84a2081d4dea2e29c1cae1a006140cb9dd0204c17ec0cf18bf815aea5621

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\vulkan-1.dll
MD5
1eddc3646fde6489e1e710a03cb706d8

SHA1
9a20e24a24331cc8762092bd08852fa75c4d90e4

SHA256
5b4365fc88bcb79fef3b10e5550a94b7f60bb3466a7b30bca20074cdae7841cf

SHA512
b950c5a4c81e08b8b4a608f9552414619d0835a1680456c569ddb0f8af6f22e5927a2ffd2c6450b4063588df790faf6ce2961544f7c8b987caa9d8c1a22f85c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\25w1I2G4GRffZZ6RIz7wZXEzr5r\vulkan-1.dll
MD5
1eddc3646fde6489e1e710a03cb706d8

SHA1
9a20e24a24331cc8762092bd08852fa75c4d90e4

SHA256
5b4365fc88bcb79fef3b10e5550a94b7f60bb3466a7b30bca20074cdae7841cf

SHA512
b950c5a4c81e08b8b4a608f9552414619d0835a1680456c569ddb0f8af6f22e5927a2ffd2c6450b4063588df790faf6ce2961544f7c8b987caa9d8c1a22f85c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\717437d0-a8b3-4603-8555-972a20ceb6af.tmp.node
MD5
ad5488ba1d8eb5b474b5bc412231d787

SHA1
33ef46b36e266b200f9e978bcc6b09053a7fe6e8

SHA256
a7e418807eeb89fe247ff420fa848c07daad82ac2a0188064136f6003ffb404d

SHA512
ccc250bb33aa96247403f26ef2fd926b9501109f0fa6971390c6eda7438f6cca138f0f307f805cd2f4cc43b343031a22af3f0ce951b7a46680766c9fce192e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdb79f17-9718-4c79-a445-9e817fa5e90c.tmp.node
MD5
e1395451f14b2507ec56d8c7c2026745

SHA1
541c2fa6ac3042bcee10573f69d9163d5fa86903

SHA256
a1075c41bd120d21769140f554921d3860aab4879ea4107c6c725cfa0e94b85c

SHA512
8c7e4bddac7e0943d93dd320ff24d0f568af5ae08bbd42559d734b80782ad9b8a56baf2ac2e052be2dbc08c23e1bccc927fd45c7270c7607c5141652b0cd391e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc6AAF.tmp\StdUtils.dll
MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc6AAF.tmp\System.dll
MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit