Resubmissions

01/04/2023, 02:12

230401-cm737agf6y 7

01/04/2023, 02:08

230401-ckqfcsfc83 7

01/04/2023, 02:03

230401-cgtnlsfc63 7

Analysis

  • max time kernel
    61s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/04/2023, 02:03

General

  • Target

    DarkOrbit-Client-Setup-2.7.0.exe

  • Size

    87.4MB

  • MD5

    031c2960ea14a8e8c25bd5231680ac41

  • SHA1

    f50af93a0c0368027a9df15da70816503f5c3a12

  • SHA256

    5f66ac351b392182000935480b265e39e9d39d17a696f9b20aea5c284d26404a

  • SHA512

    7815c46fb707b42422c117a1aa38f1d1ee6a24ff1b9e2917285b9bb019f8ac6d8189aca0cb9328fb48c6c5dbff5615181c86eaaaee30ae39d2b58e71d6eb160a

  • SSDEEP

    1572864:ASW7RwoFRV44eZEE9BuA+L+R6vDBhx7Vu6h785R8BxMg3Auug93Wi3hcT0iav:AxwoP24IEImBhBhcwFr9mGc1m

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 23 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DarkOrbit-Client-Setup-2.7.0.exe
    "C:\Users\Admin\AppData\Local\Temp\DarkOrbit-Client-Setup-2.7.0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1424
  • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
    "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
      "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=gpu-process --field-trial-handle=892,7712776699660782280,430065385679637854,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=920 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1168
    • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
      "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=gpu-process --field-trial-handle=892,7712776699660782280,430065385679637854,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1136 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1744
    • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
      "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=892,7712776699660782280,430065385679637854,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1128 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1504
  • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
    "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe"
    1⤵
      PID:324
      • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
        "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=gpu-process --field-trial-handle=932,4001562014435517998,5333651587425563993,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=940 /prefetch:2
        2⤵
          PID:868
        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
          "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=932,4001562014435517998,5333651587425563993,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1360 /prefetch:8
          2⤵
            PID:1572
          • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
            "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=gpu-process --field-trial-handle=932,4001562014435517998,5333651587425563993,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1156 /prefetch:2
            2⤵
              PID:936
          • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
            "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe"
            1⤵
              PID:1008
              • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
                "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=gpu-process --field-trial-handle=1012,13599220444578703865,1276844994782147193,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1016 /prefetch:2
                2⤵
                  PID:940
                • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
                  "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1012,13599220444578703865,1276844994782147193,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1360 /prefetch:8
                  2⤵
                    PID:760
                  • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
                    "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=gpu-process --field-trial-handle=1012,13599220444578703865,1276844994782147193,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1132 /prefetch:2
                    2⤵
                      PID:1512

                  Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\D3DCompiler_47.dll

                          Filesize

                          4.3MB

                          MD5

                          7641e39b7da4077084d2afe7c31032e0

                          SHA1

                          2256644f69435ff2fee76deb04d918083960d1eb

                          SHA256

                          44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

                          SHA512

                          8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          120.4MB

                          MD5

                          d060223f57a0ba92f70b71a67664b45d

                          SHA1

                          f10f9738b861fcbd0a7f5934286f5f14613ab3a0

                          SHA256

                          48cf7cdb491ad379c214ebdd4fd419208312026fceece808480b4695397c2b17

                          SHA512

                          70ee346505d6b913f2324871703afd1e8d6c6ae7eaca0218d0ed64267ef100d4f0fcab082e6a83f7a151623597e719fbf3cc0ad696ea8a66db5f6989d3ca5648

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          120.4MB

                          MD5

                          d060223f57a0ba92f70b71a67664b45d

                          SHA1

                          f10f9738b861fcbd0a7f5934286f5f14613ab3a0

                          SHA256

                          48cf7cdb491ad379c214ebdd4fd419208312026fceece808480b4695397c2b17

                          SHA512

                          70ee346505d6b913f2324871703afd1e8d6c6ae7eaca0218d0ed64267ef100d4f0fcab082e6a83f7a151623597e719fbf3cc0ad696ea8a66db5f6989d3ca5648

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          59.3MB

                          MD5

                          70cb963395de52d0c2425e108642c6da

                          SHA1

                          dd770232c6b9dc96d3760048bc02ffbd66c17a61

                          SHA256

                          430818457ba1ec1d5b4ee55fedbf25b566aa39ee4a6c5d2dbeaee19115fb1f75

                          SHA512

                          d4814986878841914744bb0d11b88a43488a277efc1f64889f424ef6f121fbb4743b9654941cef1d885d226c1010118f8e700e5f0386f7ae15be64222c95dba1

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          65.1MB

                          MD5

                          83e344b7ab34b4fc3faf340bb31b9cb9

                          SHA1

                          20e78cc3b1af4f6454fedb48fb3c3d6a703a22d7

                          SHA256

                          2833f9f282cbfbe9b24c6376dc4c748845b6880bf4c4fbb0ac6c5d847b528c6f

                          SHA512

                          1fd301c3e17582d30fc36e83e372278f6a31ca9f9fe5903c0401d80bf64a0a4abf53b22946e45fca1ecf55ab4f7c2ca2762599a5dc7e8580c6370dc99fcb7164

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          56.8MB

                          MD5

                          0befed9f4a115b6426812af5c9381d14

                          SHA1

                          346913a6cf44290afd5e837a1fba5b0e2246deb4

                          SHA256

                          772466e5fc786046780a750501bc7746ec5191e31bc253a7007e8b9e3c62d845

                          SHA512

                          d91b549209761e332276c3d3405908072a743db2c5777ad1314c22a13a160cc63fa6751144c12ffb469ad516a0f6264c1e0c9b2ba282340c52374d997cb6f4d6

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          61.8MB

                          MD5

                          0c1b75430635758e6e00ebc0c54b1d7c

                          SHA1

                          2db6d955e8bb7b738e88669f43d78fd530067450

                          SHA256

                          d0ad6d3b05bebac6cb6c55a0dcabed6683e06cb3d6fbc55b3fbcc2922e598598

                          SHA512

                          f76651f3ddb4a2a06d8d299e242b3a609a3b63062d0c169455e8527502883cac332af17ccae925e56287c823dc8a616039d109f05c97013e9a22117e49e9a56b

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          66.6MB

                          MD5

                          782c1956edcf1abd4b9c395da54e4bda

                          SHA1

                          b407807f7480ab2bea7ee42e8375f1839565f56a

                          SHA256

                          f63dcac75e2bb8a954b4c559bb0cda77617cf9d977ef40cc4eca7c5cb499e8fe

                          SHA512

                          175f5f4f12254eb553a6a69af2396ac68b75a8f78a12cdb755bb95feaf51733768066f267c4563b9aeec74db306cacad2953b866152c0bf8ead02317221fc689

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          38.2MB

                          MD5

                          a87ba9e5c9c7971a4b3e9475cab9ce78

                          SHA1

                          84b3246cc5e1c3351a2897b85ae77f23d78454a6

                          SHA256

                          9e9b8da80c5163f824e44ad698eaf554b1908d3fb92e5d13020312c2ef994938

                          SHA512

                          014fb5c778313545da057f0afab9a7f15f1c2fddf665daf6cf025fbd45e0d7e9083fb41c04b5e39c19e3001b0f44560bde02395409f483a3b8e169f020d9284d

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          46.6MB

                          MD5

                          2b010f0677184a3d3226c1e16b195b60

                          SHA1

                          fe42f5d587c700ce2177dff6636827f7f024e31f

                          SHA256

                          0041904c183813ea218c08fe49d23c5d46c550eded796e1b74df1bc1c93433c5

                          SHA512

                          c9e1eedec2f2634d0143c1cd02db8e5084bd408742ae317276215a7341f49de9bc111499db88235e3500d7016fe338314e0cd22c75e03d7fb42d833efbcb51b1

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          15.9MB

                          MD5

                          d8a7f6139178847ffc610e24d26b1beb

                          SHA1

                          fca997a9e0550e6bf49cb2d25f2f0a41f237c64d

                          SHA256

                          8d4b3ca11c002ee65a42750f04650985d11df8ca8db9f0238ba2564229bf4ac5

                          SHA512

                          29b19e09cbd105c68c54cf8f1b835d728dd3d8a3b312b667489b30f63e702dfc9f48fde453bc1491475b0d7b9195bf69cae5b748de78a119f7fcabd6ee4e4ccf

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          32.1MB

                          MD5

                          f50a1c046762ad9ac13a285ed44d31f2

                          SHA1

                          e1bebd411dd28a75f1e0e4cf42da39f7e58f07e8

                          SHA256

                          93aad0bc80c7452070d0bd489507ad4118adb42439f35a291ba1350f41455a8f

                          SHA512

                          ebadd70e5e5c58772ad86a31f1517d375253580970e3f198822d4accd7990ca00c063c5ef14f33ac52247902b3e45719d19049db6164d460fb84d2098b6ebe88

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          20.5MB

                          MD5

                          9a0664368ecc6f7b06c830793fc41dd1

                          SHA1

                          39d0c3dbca94f1b9230b3afefdd08c275d5e01d8

                          SHA256

                          4df98fa33c3acd5619220b134cf084b1d4822a0deaa71237aca6eea2f9292d7b

                          SHA512

                          e03c8fd3625aae89ccf1809a2325deee6c24473ba79191170d2115dac4adfe0384787eae8627e9884306a6e1726cb1369bf709e377ede3097c43e1b869dcd4d9

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\chrome_100_percent.pak

                          Filesize

                          121KB

                          MD5

                          06baf0ad34e0231bd76651203dba8326

                          SHA1

                          a5f99ecdcc06dec9d7f9ce0a8c66e46969117391

                          SHA256

                          5ae14147992a92548bcad76867dd88cdfcdb69d951c8720920cce6fb135e3189

                          SHA512

                          aff6616e56781ebb925a0ca146245ad3b2827250b32261c0c7c0d5b10b20a343a17fc3761c95d93104163e77b2eae3f1f9cbd3cb2b377f49b42bea39bdd09b91

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\chrome_200_percent.pak

                          Filesize

                          181KB

                          MD5

                          57c27201e7cd33471da7ec205fe9973c

                          SHA1

                          a8e7bce09c4cbdae2797611b2be8aeb5491036f9

                          SHA256

                          dd8146b2ee289e4d54a4a0f1fd3b2f61b979c6a2baaba96a406d96c3f4fdb33b

                          SHA512

                          57258aa169bec66abf0f45a3e026bb68751fb970b74bd0cb465607fa3b2a89967e832d92d8f675f0449bb6662fcb7786d05f0597124cc8e18bb99a47245779b4

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

                          Filesize

                          2.7MB

                          MD5

                          eabfc10d56cb44a86493cb2f8ca7aab2

                          SHA1

                          09d7e87f43527333cd021329d6c2f4e8bd8ddab5

                          SHA256

                          42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

                          SHA512

                          ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\icudtl.dat

                          Filesize

                          10.0MB

                          MD5

                          ad2988770b8cb3281a28783ad833a201

                          SHA1

                          94b7586ee187d9b58405485f4c551b55615f11b5

                          SHA256

                          df876c7af43ed93eec6aea4d2d55c805009c219653cdeb368f1d048f4922b108

                          SHA512

                          f27e542a9c6c60fa28c5b7cc2818079341ef93aef3bbcadecad2dc11aff5b1592b19c7ebfa543ea42a3cbfec26a668641b255545fb0912056e25e852c2dedd01

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\libegl.dll

                          Filesize

                          438KB

                          MD5

                          660a9ae1282e6205fc0a51e64470eb5b

                          SHA1

                          f91a9c9559f51a8f33a552f0145ed9e706909de8

                          SHA256

                          f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85

                          SHA512

                          20bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\libglesv2.dll

                          Filesize

                          7.3MB

                          MD5

                          bc45db0195aa369cc3c572e4e9eefc7e

                          SHA1

                          b880ca4933656be52f027028af5ef8a3b7e07e97

                          SHA256

                          a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10

                          SHA512

                          dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\locales\en-US.pak

                          Filesize

                          83KB

                          MD5

                          bd8f7b719110342b7cefb16ddd05ec55

                          SHA1

                          82a79aeaa1dd4b1464b67053ba1766a4498c13e7

                          SHA256

                          d1d3f892be16329c79f9a8ee8c5fa1c9fb46d17edfeb56a3d9407f9d7587a0de

                          SHA512

                          7cd1493e59e87c70927e66769eb200f79a57e1eb1223af4eb4064088571893d3e32cbc4b5ece568fd308992aad65684aa280dc9834f2b5d327bdee514b046e5e

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\resources.pak

                          Filesize

                          4.8MB

                          MD5

                          d13873f6fb051266deb3599b14535806

                          SHA1

                          143782c0ce5a5773ae0aae7a22377c8a6d18a5b2

                          SHA256

                          7b953443e3cd54a0a4775528b52fbfe5ebecbc2c71731600ed0999d227969506

                          SHA512

                          1ab38fcb70d1958c74da2493459532b52a04b884009509a1ac8dd39f6e9e670658a52f4d19ef57f1bc71dccfdd6ceedbc18034bbcad0b500d75a97c74aac6939

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\resources\app.asar

                          Filesize

                          14.3MB

                          MD5

                          53db1831c4984f05acea1a96a202686c

                          SHA1

                          cfacc0693fea9606621852b73f7183ce9e84e51b

                          SHA256

                          3508fcf65a8792be6d75aa878e9f94ca992247c598d877c09abe881924996a19

                          SHA512

                          87f71b06cc8845fbcea500d9020c03b8350a7c94687571d445090390454e6d2c83b65a61280a0e55517ef4e7428527a34f78c8bb22dbfe4fa5691a9d14baacb7

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\resources\flash\pepflashplayer.dll

                          Filesize

                          29.9MB

                          MD5

                          0dbe22464836e8ce3b25e36f32bcdf6a

                          SHA1

                          3c10da002a444532139166a7281f769487bdbc9c

                          SHA256

                          defbe88f277a941a7c1274333055d3bbf958ce4d49888db73d3e086fc4708cce

                          SHA512

                          71cb78e1d3772b3a93a4519718fdaa9f682a63135e2187095e7250bca3fce145bd43b66490b9aaac34897119d689677b2f1c55373df74044b37156669b0b87aa

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libegl.dll

                          Filesize

                          460KB

                          MD5

                          acd46d81bb4f34912c255a8d01953635

                          SHA1

                          25969cc9e588e174b854566778f283f067c3c0c6

                          SHA256

                          bd1bc00a5c29726fb39645041fc6c8295256d90c7f739ebeaa8b6c382a4db189

                          SHA512

                          83692654ada422391b428953b2cec67048a171bbef4c59158f34607a762feac8a233b52ceaa528306cf103d9830ee38897afa996389e086d3778f290555a059b

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libglesv2.dll

                          Filesize

                          3.1MB

                          MD5

                          8090f82a02c6850cc7bd2b481a7533e0

                          SHA1

                          54a0b66d76c1b60e45e83ba4627299d0b2aae84a

                          SHA256

                          e9473ba82f6d8742ab74e67484886291aa69037db72e0ae256b19581de0b772e

                          SHA512

                          b2e3c57926860a7954ca6e426f5f2fa080cf6ccb5c4edd77f59744f240f597aa9613f46294e8b344db76b46fe78777b5016828b8ab2fc274ca107f3af7abd878

                        • C:\Users\Admin\AppData\Local\Programs\darkorbit-client\v8_context_snapshot.bin

                          Filesize

                          168KB

                          MD5

                          c2208c06c8ff81bca3c092cc42b8df1b

                          SHA1

                          f7b9faa9ba0e72d062f68642a02cc8f3fed49910

                          SHA256

                          4a67de195878d290f49b503b83e415917b8bbcbd9936b07a5d33b48e9bc6e0a3

                          SHA512

                          6c3c370dd086a976c44d4059a315bd3bcbb50961aa34734e65a40d861cffca9090d47cec74575afe23952e394e4845bda2d8798eebe01fb54a7a6288bce238f5

                        • C:\Users\Admin\AppData\Local\Temp\nst121C.tmp\SpiderBanner.dll

                          Filesize

                          9KB

                          MD5

                          17309e33b596ba3a5693b4d3e85cf8d7

                          SHA1

                          7d361836cf53df42021c7f2b148aec9458818c01

                          SHA256

                          996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

                          SHA512

                          1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

                        • C:\Users\Admin\AppData\Local\Temp\nst121C.tmp\StdUtils.dll

                          Filesize

                          100KB

                          MD5

                          c6a6e03f77c313b267498515488c5740

                          SHA1

                          3d49fc2784b9450962ed6b82b46e9c3c957d7c15

                          SHA256

                          b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

                          SHA512

                          9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

                        • C:\Users\Admin\AppData\Local\Temp\nst121C.tmp\System.dll

                          Filesize

                          12KB

                          MD5

                          0d7ad4f45dc6f5aa87f606d0331c6901

                          SHA1

                          48df0911f0484cbe2a8cdd5362140b63c41ee457

                          SHA256

                          3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

                          SHA512

                          c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

                        • C:\Users\Admin\AppData\Local\Temp\nst121C.tmp\WinShell.dll

                          Filesize

                          3KB

                          MD5

                          1cc7c37b7e0c8cd8bf04b6cc283e1e56

                          SHA1

                          0b9519763be6625bd5abce175dcc59c96d100d4c

                          SHA256

                          9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

                          SHA512

                          7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

                        • C:\Users\Admin\AppData\Local\Temp\nst121C.tmp\nsProcess.dll

                          Filesize

                          4KB

                          MD5

                          f0438a894f3a7e01a4aae8d1b5dd0289

                          SHA1

                          b058e3fcfb7b550041da16bf10d8837024c38bf6

                          SHA256

                          30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

                          SHA512

                          f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

                        • C:\Users\Admin\AppData\Local\Temp\nst121C.tmp\nsis7z.dll

                          Filesize

                          424KB

                          MD5

                          80e44ce4895304c6a3a831310fbf8cd0

                          SHA1

                          36bd49ae21c460be5753a904b4501f1abca53508

                          SHA256

                          b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

                          SHA512

                          c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

                        • C:\Users\Admin\AppData\Roaming\darkorbit-client\FontLookupTableCache\font_unique_name_table.pb

                          Filesize

                          125KB

                          MD5

                          d6f28100e21985a3041344d23bad35c0

                          SHA1

                          8e12d483d7e622a0330f5ad029fc7516dfba5963

                          SHA256

                          fadf959abc39c57ac58ce7c57ea44534eaaaf9d981b153d4d5da43b779ad15b1

                          SHA512

                          faf3b862035034f272ab6721031018d1caeaac1abfa082da869661db81b9a95d0da94e992e33c9c726ab42c79507e0518cc427335de90911cc7d911e4b1afab4

                        • C:\Users\Admin\AppData\Roaming\darkorbit-client\settings.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                        • C:\Users\Admin\AppData\Roaming\darkorbit-client\settings.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                        • C:\Users\Admin\AppData\Roaming\darkorbit-client\settings.json.574484413

                          Filesize

                          839B

                          MD5

                          7a943585327bc2be8809fba9ea386406

                          SHA1

                          4670c49673cda033f4c857786594159015a3df2b

                          SHA256

                          d2b2d9ef4c0f8ebde8eb6bb81cdab6a911db98fd9c10994d789979c8e5a44427

                          SHA512

                          fc85354036901d34d71c3ecd4ee96504e4e040f7cbab2b3146953096e2595c15993ff96d23a5f101b9188c88080d877d5025b657f38790bc0be1c0d82042e83d

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          120.4MB

                          MD5

                          d060223f57a0ba92f70b71a67664b45d

                          SHA1

                          f10f9738b861fcbd0a7f5934286f5f14613ab3a0

                          SHA256

                          48cf7cdb491ad379c214ebdd4fd419208312026fceece808480b4695397c2b17

                          SHA512

                          70ee346505d6b913f2324871703afd1e8d6c6ae7eaca0218d0ed64267ef100d4f0fcab082e6a83f7a151623597e719fbf3cc0ad696ea8a66db5f6989d3ca5648

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          120.4MB

                          MD5

                          d060223f57a0ba92f70b71a67664b45d

                          SHA1

                          f10f9738b861fcbd0a7f5934286f5f14613ab3a0

                          SHA256

                          48cf7cdb491ad379c214ebdd4fd419208312026fceece808480b4695397c2b17

                          SHA512

                          70ee346505d6b913f2324871703afd1e8d6c6ae7eaca0218d0ed64267ef100d4f0fcab082e6a83f7a151623597e719fbf3cc0ad696ea8a66db5f6989d3ca5648

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          120.4MB

                          MD5

                          d060223f57a0ba92f70b71a67664b45d

                          SHA1

                          f10f9738b861fcbd0a7f5934286f5f14613ab3a0

                          SHA256

                          48cf7cdb491ad379c214ebdd4fd419208312026fceece808480b4695397c2b17

                          SHA512

                          70ee346505d6b913f2324871703afd1e8d6c6ae7eaca0218d0ed64267ef100d4f0fcab082e6a83f7a151623597e719fbf3cc0ad696ea8a66db5f6989d3ca5648

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          120.4MB

                          MD5

                          d060223f57a0ba92f70b71a67664b45d

                          SHA1

                          f10f9738b861fcbd0a7f5934286f5f14613ab3a0

                          SHA256

                          48cf7cdb491ad379c214ebdd4fd419208312026fceece808480b4695397c2b17

                          SHA512

                          70ee346505d6b913f2324871703afd1e8d6c6ae7eaca0218d0ed64267ef100d4f0fcab082e6a83f7a151623597e719fbf3cc0ad696ea8a66db5f6989d3ca5648

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          95.6MB

                          MD5

                          7ca81f153b98fb152d4724f9bb3d7a72

                          SHA1

                          7067b4f3783955e9a36bdfb2946a281b5be4aebc

                          SHA256

                          5f324fa77ae4eac2652c8845413592b9bacd6a7fdf9ba6c6c3562f4c45167a38

                          SHA512

                          84699e74b18acf52e86086fe84252c5bb978593cb6fb20c9d1a2c16506532750a389acc39a99fba071750a33cf81e931d03b45129254ef0a97061f30003d7f06

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          98.9MB

                          MD5

                          c1dddd2d4136df938e6f561ee52b426b

                          SHA1

                          71a235b8fb2e924fe4a8ac2d91d1c9666690434e

                          SHA256

                          34a9de7baf7612c7de8c1b6446aa911e95c707bf0a5cf2d5d49b1ff48edf4961

                          SHA512

                          18225a9a19c213d51d093f0b512b92512eccff7722713f9d8e3cdc1eeea91f5f5606cea3acb16a6da18b2e2e23445e213e70a397cabd4d9c103380f2625b09e8

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          98.1MB

                          MD5

                          11f1cd4525e27cb124aab0e1f26b6f6d

                          SHA1

                          5bfe56a2709bf29362fb90a87500dbb1079b0bd6

                          SHA256

                          0cdbe5e3d478ac2d6bcdfca3afc54f694c7528685b35cb9d6656d60965eba316

                          SHA512

                          dbe2af2cb8c5720e5b0abbc96f0fae58f6a35b246a5f9382c9bd115688e33f998dc0459dfcae614d28fe031dd82389e3c09c4e75c8695c5d5faa229a1cb6c0c4

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          98.6MB

                          MD5

                          1a4549411d2c385bd4d9b3cfac5bcf9c

                          SHA1

                          8c0c3ec13dc45725951afa40014c181f07c4e208

                          SHA256

                          681b6bcee6c0195b8692b7c8bf342d59a3b20f0e4804dc99cd4ed0c43de4f478

                          SHA512

                          0fd72574000cbd8d3a7ac5da68da8225bc484defbd7ffa8a8aabb1e575cc2cbc405ae855189aa919640dffe6b76a003528abe204de992bc5f304d15bc8bfe0af

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

                          Filesize

                          108.2MB

                          MD5

                          7ca6bc572560d72640899dc0df1c78ca

                          SHA1

                          0b39d930526cdfd57e5cfbca1067ad21a857913f

                          SHA256

                          1ec1f8afbd6d29cd477b075425130e860d140956b4b358b391b3882f95125a9c

                          SHA512

                          d38df041e77bc503aef75308ab14014d9effbd134cbddfcbf27b8399f8999fe54575fedcfb6f4037e14196eeaef7a5432802d67314ba2ef8a2168698841a2125

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\d3dcompiler_47.dll

                          Filesize

                          4.3MB

                          MD5

                          7641e39b7da4077084d2afe7c31032e0

                          SHA1

                          2256644f69435ff2fee76deb04d918083960d1eb

                          SHA256

                          44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

                          SHA512

                          8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\d3dcompiler_47.dll

                          Filesize

                          4.3MB

                          MD5

                          7641e39b7da4077084d2afe7c31032e0

                          SHA1

                          2256644f69435ff2fee76deb04d918083960d1eb

                          SHA256

                          44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

                          SHA512

                          8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\d3dcompiler_47.dll

                          Filesize

                          4.3MB

                          MD5

                          7641e39b7da4077084d2afe7c31032e0

                          SHA1

                          2256644f69435ff2fee76deb04d918083960d1eb

                          SHA256

                          44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

                          SHA512

                          8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\d3dcompiler_47.dll

                          Filesize

                          4.3MB

                          MD5

                          7641e39b7da4077084d2afe7c31032e0

                          SHA1

                          2256644f69435ff2fee76deb04d918083960d1eb

                          SHA256

                          44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

                          SHA512

                          8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

                          Filesize

                          2.7MB

                          MD5

                          eabfc10d56cb44a86493cb2f8ca7aab2

                          SHA1

                          09d7e87f43527333cd021329d6c2f4e8bd8ddab5

                          SHA256

                          42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

                          SHA512

                          ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

                          Filesize

                          2.7MB

                          MD5

                          eabfc10d56cb44a86493cb2f8ca7aab2

                          SHA1

                          09d7e87f43527333cd021329d6c2f4e8bd8ddab5

                          SHA256

                          42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

                          SHA512

                          ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

                          Filesize

                          2.7MB

                          MD5

                          eabfc10d56cb44a86493cb2f8ca7aab2

                          SHA1

                          09d7e87f43527333cd021329d6c2f4e8bd8ddab5

                          SHA256

                          42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

                          SHA512

                          ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

                          Filesize

                          2.7MB

                          MD5

                          eabfc10d56cb44a86493cb2f8ca7aab2

                          SHA1

                          09d7e87f43527333cd021329d6c2f4e8bd8ddab5

                          SHA256

                          42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

                          SHA512

                          ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

                          Filesize

                          2.7MB

                          MD5

                          eabfc10d56cb44a86493cb2f8ca7aab2

                          SHA1

                          09d7e87f43527333cd021329d6c2f4e8bd8ddab5

                          SHA256

                          42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

                          SHA512

                          ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

                          Filesize

                          2.7MB

                          MD5

                          eabfc10d56cb44a86493cb2f8ca7aab2

                          SHA1

                          09d7e87f43527333cd021329d6c2f4e8bd8ddab5

                          SHA256

                          42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

                          SHA512

                          ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

                          Filesize

                          2.7MB

                          MD5

                          eabfc10d56cb44a86493cb2f8ca7aab2

                          SHA1

                          09d7e87f43527333cd021329d6c2f4e8bd8ddab5

                          SHA256

                          42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

                          SHA512

                          ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

                          Filesize

                          2.7MB

                          MD5

                          eabfc10d56cb44a86493cb2f8ca7aab2

                          SHA1

                          09d7e87f43527333cd021329d6c2f4e8bd8ddab5

                          SHA256

                          42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

                          SHA512

                          ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

                          Filesize

                          2.7MB

                          MD5

                          eabfc10d56cb44a86493cb2f8ca7aab2

                          SHA1

                          09d7e87f43527333cd021329d6c2f4e8bd8ddab5

                          SHA256

                          42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

                          SHA512

                          ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\libEGL.dll

                          Filesize

                          438KB

                          MD5

                          660a9ae1282e6205fc0a51e64470eb5b

                          SHA1

                          f91a9c9559f51a8f33a552f0145ed9e706909de8

                          SHA256

                          f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85

                          SHA512

                          20bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\libEGL.dll

                          Filesize

                          438KB

                          MD5

                          660a9ae1282e6205fc0a51e64470eb5b

                          SHA1

                          f91a9c9559f51a8f33a552f0145ed9e706909de8

                          SHA256

                          f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85

                          SHA512

                          20bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\libEGL.dll

                          Filesize

                          438KB

                          MD5

                          660a9ae1282e6205fc0a51e64470eb5b

                          SHA1

                          f91a9c9559f51a8f33a552f0145ed9e706909de8

                          SHA256

                          f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85

                          SHA512

                          20bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\libGLESv2.dll

                          Filesize

                          7.3MB

                          MD5

                          bc45db0195aa369cc3c572e4e9eefc7e

                          SHA1

                          b880ca4933656be52f027028af5ef8a3b7e07e97

                          SHA256

                          a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10

                          SHA512

                          dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\libGLESv2.dll

                          Filesize

                          7.3MB

                          MD5

                          bc45db0195aa369cc3c572e4e9eefc7e

                          SHA1

                          b880ca4933656be52f027028af5ef8a3b7e07e97

                          SHA256

                          a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10

                          SHA512

                          dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\libGLESv2.dll

                          Filesize

                          7.3MB

                          MD5

                          bc45db0195aa369cc3c572e4e9eefc7e

                          SHA1

                          b880ca4933656be52f027028af5ef8a3b7e07e97

                          SHA256

                          a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10

                          SHA512

                          dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libEGL.dll

                          Filesize

                          460KB

                          MD5

                          acd46d81bb4f34912c255a8d01953635

                          SHA1

                          25969cc9e588e174b854566778f283f067c3c0c6

                          SHA256

                          bd1bc00a5c29726fb39645041fc6c8295256d90c7f739ebeaa8b6c382a4db189

                          SHA512

                          83692654ada422391b428953b2cec67048a171bbef4c59158f34607a762feac8a233b52ceaa528306cf103d9830ee38897afa996389e086d3778f290555a059b

                        • \Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libGLESv2.dll

                          Filesize

                          3.1MB

                          MD5

                          8090f82a02c6850cc7bd2b481a7533e0

                          SHA1

                          54a0b66d76c1b60e45e83ba4627299d0b2aae84a

                          SHA256

                          e9473ba82f6d8742ab74e67484886291aa69037db72e0ae256b19581de0b772e

                          SHA512

                          b2e3c57926860a7954ca6e426f5f2fa080cf6ccb5c4edd77f59744f240f597aa9613f46294e8b344db76b46fe78777b5016828b8ab2fc274ca107f3af7abd878

                        • \Users\Admin\AppData\Local\Temp\nst121C.tmp\SpiderBanner.dll

                          Filesize

                          9KB

                          MD5

                          17309e33b596ba3a5693b4d3e85cf8d7

                          SHA1

                          7d361836cf53df42021c7f2b148aec9458818c01

                          SHA256

                          996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

                          SHA512

                          1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

                        • \Users\Admin\AppData\Local\Temp\nst121C.tmp\StdUtils.dll

                          Filesize

                          100KB

                          MD5

                          c6a6e03f77c313b267498515488c5740

                          SHA1

                          3d49fc2784b9450962ed6b82b46e9c3c957d7c15

                          SHA256

                          b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

                          SHA512

                          9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

                        • \Users\Admin\AppData\Local\Temp\nst121C.tmp\System.dll

                          Filesize

                          12KB

                          MD5

                          0d7ad4f45dc6f5aa87f606d0331c6901

                          SHA1

                          48df0911f0484cbe2a8cdd5362140b63c41ee457

                          SHA256

                          3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

                          SHA512

                          c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

                        • \Users\Admin\AppData\Local\Temp\nst121C.tmp\WinShell.dll

                          Filesize

                          3KB

                          MD5

                          1cc7c37b7e0c8cd8bf04b6cc283e1e56

                          SHA1

                          0b9519763be6625bd5abce175dcc59c96d100d4c

                          SHA256

                          9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

                          SHA512

                          7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

                        • \Users\Admin\AppData\Local\Temp\nst121C.tmp\WinShell.dll

                          Filesize

                          3KB

                          MD5

                          1cc7c37b7e0c8cd8bf04b6cc283e1e56

                          SHA1

                          0b9519763be6625bd5abce175dcc59c96d100d4c

                          SHA256

                          9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

                          SHA512

                          7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

                        • \Users\Admin\AppData\Local\Temp\nst121C.tmp\nsProcess.dll

                          Filesize

                          4KB

                          MD5

                          f0438a894f3a7e01a4aae8d1b5dd0289

                          SHA1

                          b058e3fcfb7b550041da16bf10d8837024c38bf6

                          SHA256

                          30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

                          SHA512

                          f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

                        • \Users\Admin\AppData\Local\Temp\nst121C.tmp\nsis7z.dll

                          Filesize

                          424KB

                          MD5

                          80e44ce4895304c6a3a831310fbf8cd0

                          SHA1

                          36bd49ae21c460be5753a904b4501f1abca53508

                          SHA256

                          b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

                          SHA512

                          c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

                        • memory/1168-347-0x0000000077310000-0x0000000077311000-memory.dmp

                          Filesize

                          4KB

                        • memory/1168-314-0x0000000000060000-0x0000000000061000-memory.dmp

                          Filesize

                          4KB

                        • memory/1424-271-0x0000000003430000-0x0000000003432000-memory.dmp

                          Filesize

                          8KB