5f66ac351b392182000935480b265e39e9d39d17a696f9b20aea5c284d26404a

Resubmissions

01/04/2023, 02:12

230401-cm737agf6y 7

01/04/2023, 02:08

230401-ckqfcsfc83 7

01/04/2023, 02:03

230401-cgtnlsfc63 7

Analysis

max time kernel
88s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
01/04/2023, 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DarkOrbit-Client-Setup-2.7.0.exe
Size

87.4MB
MD5

031c2960ea14a8e8c25bd5231680ac41
SHA1

f50af93a0c0368027a9df15da70816503f5c3a12
SHA256

5f66ac351b392182000935480b265e39e9d39d17a696f9b20aea5c284d26404a
SHA512

7815c46fb707b42422c117a1aa38f1d1ee6a24ff1b9e2917285b9bb019f8ac6d8189aca0cb9328fb48c6c5dbff5615181c86eaaaee30ae39d2b58e71d6eb160a
SSDEEP

1572864:ASW7RwoFRV44eZEE9BuA+L+R6vDBhx7Vu6h785R8BxMg3Auug93Wi3hcT0iav:AxwoP24IEImBhBhcwFr9mGc1m

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3440	DarkOrbit Client.exe
1800	DarkOrbit Client.exe
2528	DarkOrbit Client.exe
3984	DarkOrbit Client.exe

Loads dropped DLL 16 IoCs

pid	Process
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
3440	DarkOrbit Client.exe
1800	DarkOrbit Client.exe
1800	DarkOrbit Client.exe
1800	DarkOrbit Client.exe
1800	DarkOrbit Client.exe
2528	DarkOrbit Client.exe
3984	DarkOrbit Client.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
760	DarkOrbit-Client-Setup-2.7.0.exe
3440	DarkOrbit Client.exe
3440	DarkOrbit Client.exe
3440	DarkOrbit Client.exe
3440	DarkOrbit Client.exe
2528	DarkOrbit Client.exe
2528	DarkOrbit Client.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	760	DarkOrbit-Client-Setup-2.7.0.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 1800	3440	DarkOrbit Client.exe	91
PID 3440 wrote to memory of 2528	3440	DarkOrbit Client.exe	94
PID 3440 wrote to memory of 2528	3440	DarkOrbit Client.exe	94

C:\Users\Admin\AppData\Local\Temp\DarkOrbit-Client-Setup-2.7.0.exe
"C:\Users\Admin\AppData\Local\Temp\DarkOrbit-Client-Setup-2.7.0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
"C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
  "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=gpu-process --field-trial-handle=1580,7827180330746878718,12695604718658007503,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1592 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1800
- C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
  "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,7827180330746878718,12695604718658007503,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=es --service-sandbox-type=network --mojo-platform-channel-handle=1928 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
"C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3984
- C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
  "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,18018424547103602835,17343993168956566628,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=es --service-sandbox-type=network --mojo-platform-channel-handle=1888 /prefetch:8
  2⤵
  PID:3220
- C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
  "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=gpu-process --field-trial-handle=1644,18018424547103602835,17343993168956566628,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1652 /prefetch:2
  2⤵
  PID:4120

C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
"C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe"
1⤵
PID:4432
- C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
  "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=gpu-process --field-trial-handle=1568,845023729428990443,4545287293495200772,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1576 /prefetch:2
  2⤵
  PID:3928
- C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe
  "C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1568,845023729428990443,4545287293495200772,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=es --service-sandbox-type=network --mojo-platform-channel-handle=1868 /prefetch:8
  2⤵
  PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\darkorbit-client\D3DCompiler_47.dll

Filesize
4.3MB

MD5
7641e39b7da4077084d2afe7c31032e0

SHA1
2256644f69435ff2fee76deb04d918083960d1eb

SHA256
44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

SHA512
8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

Filesize
120.4MB

MD5
d060223f57a0ba92f70b71a67664b45d

SHA1
f10f9738b861fcbd0a7f5934286f5f14613ab3a0

SHA256
48cf7cdb491ad379c214ebdd4fd419208312026fceece808480b4695397c2b17

SHA512
70ee346505d6b913f2324871703afd1e8d6c6ae7eaca0218d0ed64267ef100d4f0fcab082e6a83f7a151623597e719fbf3cc0ad696ea8a66db5f6989d3ca5648

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

Filesize
120.4MB

MD5
d060223f57a0ba92f70b71a67664b45d

SHA1
f10f9738b861fcbd0a7f5934286f5f14613ab3a0

SHA256
48cf7cdb491ad379c214ebdd4fd419208312026fceece808480b4695397c2b17

SHA512
70ee346505d6b913f2324871703afd1e8d6c6ae7eaca0218d0ed64267ef100d4f0fcab082e6a83f7a151623597e719fbf3cc0ad696ea8a66db5f6989d3ca5648

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

Filesize
120.4MB

MD5
d060223f57a0ba92f70b71a67664b45d

SHA1
f10f9738b861fcbd0a7f5934286f5f14613ab3a0

SHA256
48cf7cdb491ad379c214ebdd4fd419208312026fceece808480b4695397c2b17

SHA512
70ee346505d6b913f2324871703afd1e8d6c6ae7eaca0218d0ed64267ef100d4f0fcab082e6a83f7a151623597e719fbf3cc0ad696ea8a66db5f6989d3ca5648

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

Filesize
120.4MB

MD5
d060223f57a0ba92f70b71a67664b45d

SHA1
f10f9738b861fcbd0a7f5934286f5f14613ab3a0

SHA256
48cf7cdb491ad379c214ebdd4fd419208312026fceece808480b4695397c2b17

SHA512
70ee346505d6b913f2324871703afd1e8d6c6ae7eaca0218d0ed64267ef100d4f0fcab082e6a83f7a151623597e719fbf3cc0ad696ea8a66db5f6989d3ca5648

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

Filesize
120.4MB

MD5
d060223f57a0ba92f70b71a67664b45d

SHA1
f10f9738b861fcbd0a7f5934286f5f14613ab3a0

SHA256
48cf7cdb491ad379c214ebdd4fd419208312026fceece808480b4695397c2b17

SHA512
70ee346505d6b913f2324871703afd1e8d6c6ae7eaca0218d0ed64267ef100d4f0fcab082e6a83f7a151623597e719fbf3cc0ad696ea8a66db5f6989d3ca5648

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

Filesize
28.4MB

MD5
eff9f09ab985a537983c45fa2f391038

SHA1
e22f99b1261be16d80a52302e545750eda1a104a

SHA256
91ab61c51100354a26e92821adf6dcd114cc8ca3c4e1991572aa6cb6de81e574

SHA512
0c2b219b5dce31830b6d069a88b37428811096ecbc77f587379289535ab198aec13421d87ec9a131da17468f89db33b07869be86a3dcdabcb0e896b7011f71f1

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

Filesize
25.9MB

MD5
2c72016ced89f805a3aca41b091bca55

SHA1
fb0525bc4268fc4eaf8a2d23222551327309ac77

SHA256
6203f73f27e038dca3309384b9a8ca879b715054c2a1f2602131851cfa6ca303

SHA512
4adb1c5e09b1bbe104f4e31b668a169060c1f4a7afbd46744a310552108b3ac316ff400373c8bf1d2799f8ba3cd19576a79816749c8f1d19c7c83cd68795893b

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

Filesize
19.4MB

MD5
6c0a6ff177269f384f6bde0f2d0f6205

SHA1
3c0af19ee229b47c0f0b0b083ef5c127e3b02e51

SHA256
a766a0adc1bdfe8f4170e4e959d0d4b24b936537e9ae172fc6c3fc3a8447184c

SHA512
0cce774b126dfe6b082e157722fb799ed3d0dd1b3102a3d7afae2eff2cfe37fdfcf4f5955fe22134b28006f4b7a1f7d92e5b55695d1ca519175deb6de2136d8b

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

Filesize
19.1MB

MD5
93218bb88f95bb6e147bd655e8a93d2d

SHA1
075cc178329e0345ac9802ce90a9f514ef19ab97

SHA256
fd7f8b26d44274011e8194fd6c231e198422cc90990e856b2027694b53fe7fa8

SHA512
b806adedccdd48839a43ce043d2f2daa27d73448b92f420bb5572efa1330e8ea01d36fa000527c794a8db8a457b77c5c8973e4e5c5db18df46f07bb360bc2a69

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

Filesize
18.4MB

MD5
85fda4d82ca4832a992763727adff112

SHA1
f465cc28c3c42b69cc38e7be98265597ee1c4ffc

SHA256
f3688b19308b58133cbb658caeb98677120cb5695239ccf4414646c4f3e03ff8

SHA512
284cd6d2f4dff9418008337156dbf4292641f046a61d50dab7da7c362a195107d15018e5ea9c257fd6dacc913860e5757a469b052ce80b14b954dc1803168a7b

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\DarkOrbit Client.exe

Filesize
18.5MB

MD5
b09ef1947e821730871c2f1b3acd0f60

SHA1
0abd06ee22f02d3045cafb9cf94b860f6512fcce

SHA256
dd4aa706144bbf8f626748848a04e4b51b77e4044024cd08716adb2e6a6254fa

SHA512
c37ef3f2c6e2caee099eeda666103d56cb1bb670f9f366d895651cadb4b2c575ac911f7f4dcd2578853d348606ecd80da055cf2ec22ec514dcb6b83db77e84b5

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\chrome_100_percent.pak

Filesize
121KB

MD5
06baf0ad34e0231bd76651203dba8326

SHA1
a5f99ecdcc06dec9d7f9ce0a8c66e46969117391

SHA256
5ae14147992a92548bcad76867dd88cdfcdb69d951c8720920cce6fb135e3189

SHA512
aff6616e56781ebb925a0ca146245ad3b2827250b32261c0c7c0d5b10b20a343a17fc3761c95d93104163e77b2eae3f1f9cbd3cb2b377f49b42bea39bdd09b91

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\chrome_200_percent.pak

Filesize
181KB

MD5
57c27201e7cd33471da7ec205fe9973c

SHA1
a8e7bce09c4cbdae2797611b2be8aeb5491036f9

SHA256
dd8146b2ee289e4d54a4a0f1fd3b2f61b979c6a2baaba96a406d96c3f4fdb33b

SHA512
57258aa169bec66abf0f45a3e026bb68751fb970b74bd0cb465607fa3b2a89967e832d92d8f675f0449bb6662fcb7786d05f0597124cc8e18bb99a47245779b4

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\d3dcompiler_47.dll

Filesize
4.3MB

MD5
7641e39b7da4077084d2afe7c31032e0

SHA1
2256644f69435ff2fee76deb04d918083960d1eb

SHA256
44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

SHA512
8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\d3dcompiler_47.dll

Filesize
4.3MB

MD5
7641e39b7da4077084d2afe7c31032e0

SHA1
2256644f69435ff2fee76deb04d918083960d1eb

SHA256
44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

SHA512
8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\d3dcompiler_47.dll

Filesize
4.3MB

MD5
7641e39b7da4077084d2afe7c31032e0

SHA1
2256644f69435ff2fee76deb04d918083960d1eb

SHA256
44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

SHA512
8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

Filesize
2.7MB

MD5
eabfc10d56cb44a86493cb2f8ca7aab2

SHA1
09d7e87f43527333cd021329d6c2f4e8bd8ddab5

SHA256
42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

SHA512
ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

Filesize
2.7MB

MD5
eabfc10d56cb44a86493cb2f8ca7aab2

SHA1
09d7e87f43527333cd021329d6c2f4e8bd8ddab5

SHA256
42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

SHA512
ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

Filesize
2.7MB

MD5
eabfc10d56cb44a86493cb2f8ca7aab2

SHA1
09d7e87f43527333cd021329d6c2f4e8bd8ddab5

SHA256
42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

SHA512
ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

Filesize
2.7MB

MD5
eabfc10d56cb44a86493cb2f8ca7aab2

SHA1
09d7e87f43527333cd021329d6c2f4e8bd8ddab5

SHA256
42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

SHA512
ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

Filesize
2.7MB

MD5
eabfc10d56cb44a86493cb2f8ca7aab2

SHA1
09d7e87f43527333cd021329d6c2f4e8bd8ddab5

SHA256
42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

SHA512
ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

Filesize
2.7MB

MD5
eabfc10d56cb44a86493cb2f8ca7aab2

SHA1
09d7e87f43527333cd021329d6c2f4e8bd8ddab5

SHA256
42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

SHA512
ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

Filesize
2.7MB

MD5
eabfc10d56cb44a86493cb2f8ca7aab2

SHA1
09d7e87f43527333cd021329d6c2f4e8bd8ddab5

SHA256
42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

SHA512
ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

Filesize
2.7MB

MD5
eabfc10d56cb44a86493cb2f8ca7aab2

SHA1
09d7e87f43527333cd021329d6c2f4e8bd8ddab5

SHA256
42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

SHA512
ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

Filesize
2.7MB

MD5
eabfc10d56cb44a86493cb2f8ca7aab2

SHA1
09d7e87f43527333cd021329d6c2f4e8bd8ddab5

SHA256
42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

SHA512
ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\ffmpeg.dll

Filesize
2.7MB

MD5
eabfc10d56cb44a86493cb2f8ca7aab2

SHA1
09d7e87f43527333cd021329d6c2f4e8bd8ddab5

SHA256
42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

SHA512
ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\icudtl.dat

Filesize
10.0MB

MD5
ad2988770b8cb3281a28783ad833a201

SHA1
94b7586ee187d9b58405485f4c551b55615f11b5

SHA256
df876c7af43ed93eec6aea4d2d55c805009c219653cdeb368f1d048f4922b108

SHA512
f27e542a9c6c60fa28c5b7cc2818079341ef93aef3bbcadecad2dc11aff5b1592b19c7ebfa543ea42a3cbfec26a668641b255545fb0912056e25e852c2dedd01

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\locales\es.pak

Filesize
99KB

MD5
06a2c6940def84d9327083aee446f446

SHA1
a542fd511568ae5f90e86259d427b7792ec52d03

SHA256
eb22282dbf211f64142ef4dfac2c1d811d65decd617c4a3d1c892967dc72ac07

SHA512
23d0547ca962419bd6013f094de67a6f20779440674fef3bd38ae613c72daef6072a217d7832e1c62dd68bdfdb1eeba241ac302f72cb710015d8924f8e6797c1

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\resources.pak

Filesize
4.8MB

MD5
d13873f6fb051266deb3599b14535806

SHA1
143782c0ce5a5773ae0aae7a22377c8a6d18a5b2

SHA256
7b953443e3cd54a0a4775528b52fbfe5ebecbc2c71731600ed0999d227969506

SHA512
1ab38fcb70d1958c74da2493459532b52a04b884009509a1ac8dd39f6e9e670658a52f4d19ef57f1bc71dccfdd6ceedbc18034bbcad0b500d75a97c74aac6939

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\resources\app.asar

Filesize
14.3MB

MD5
53db1831c4984f05acea1a96a202686c

SHA1
cfacc0693fea9606621852b73f7183ce9e84e51b

SHA256
3508fcf65a8792be6d75aa878e9f94ca992247c598d877c09abe881924996a19

SHA512
87f71b06cc8845fbcea500d9020c03b8350a7c94687571d445090390454e6d2c83b65a61280a0e55517ef4e7428527a34f78c8bb22dbfe4fa5691a9d14baacb7

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\resources\flash\pepflashplayer.dll

Filesize
29.9MB

MD5
0dbe22464836e8ce3b25e36f32bcdf6a

SHA1
3c10da002a444532139166a7281f769487bdbc9c

SHA256
defbe88f277a941a7c1274333055d3bbf958ce4d49888db73d3e086fc4708cce

SHA512
71cb78e1d3772b3a93a4519718fdaa9f682a63135e2187095e7250bca3fce145bd43b66490b9aaac34897119d689677b2f1c55373df74044b37156669b0b87aa

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libEGL.dll

Filesize
460KB

MD5
acd46d81bb4f34912c255a8d01953635

SHA1
25969cc9e588e174b854566778f283f067c3c0c6

SHA256
bd1bc00a5c29726fb39645041fc6c8295256d90c7f739ebeaa8b6c382a4db189

SHA512
83692654ada422391b428953b2cec67048a171bbef4c59158f34607a762feac8a233b52ceaa528306cf103d9830ee38897afa996389e086d3778f290555a059b

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libEGL.dll

Filesize
460KB

MD5
acd46d81bb4f34912c255a8d01953635

SHA1
25969cc9e588e174b854566778f283f067c3c0c6

SHA256
bd1bc00a5c29726fb39645041fc6c8295256d90c7f739ebeaa8b6c382a4db189

SHA512
83692654ada422391b428953b2cec67048a171bbef4c59158f34607a762feac8a233b52ceaa528306cf103d9830ee38897afa996389e086d3778f290555a059b

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libEGL.dll

Filesize
460KB

MD5
acd46d81bb4f34912c255a8d01953635

SHA1
25969cc9e588e174b854566778f283f067c3c0c6

SHA256
bd1bc00a5c29726fb39645041fc6c8295256d90c7f739ebeaa8b6c382a4db189

SHA512
83692654ada422391b428953b2cec67048a171bbef4c59158f34607a762feac8a233b52ceaa528306cf103d9830ee38897afa996389e086d3778f290555a059b

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libGLESv2.dll

Filesize
3.1MB

MD5
8090f82a02c6850cc7bd2b481a7533e0

SHA1
54a0b66d76c1b60e45e83ba4627299d0b2aae84a

SHA256
e9473ba82f6d8742ab74e67484886291aa69037db72e0ae256b19581de0b772e

SHA512
b2e3c57926860a7954ca6e426f5f2fa080cf6ccb5c4edd77f59744f240f597aa9613f46294e8b344db76b46fe78777b5016828b8ab2fc274ca107f3af7abd878

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libGLESv2.dll

Filesize
3.1MB

MD5
8090f82a02c6850cc7bd2b481a7533e0

SHA1
54a0b66d76c1b60e45e83ba4627299d0b2aae84a

SHA256
e9473ba82f6d8742ab74e67484886291aa69037db72e0ae256b19581de0b772e

SHA512
b2e3c57926860a7954ca6e426f5f2fa080cf6ccb5c4edd77f59744f240f597aa9613f46294e8b344db76b46fe78777b5016828b8ab2fc274ca107f3af7abd878

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libGLESv2.dll

Filesize
3.1MB

MD5
8090f82a02c6850cc7bd2b481a7533e0

SHA1
54a0b66d76c1b60e45e83ba4627299d0b2aae84a

SHA256
e9473ba82f6d8742ab74e67484886291aa69037db72e0ae256b19581de0b772e

SHA512
b2e3c57926860a7954ca6e426f5f2fa080cf6ccb5c4edd77f59744f240f597aa9613f46294e8b344db76b46fe78777b5016828b8ab2fc274ca107f3af7abd878

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libegl.dll

Filesize
460KB

MD5
acd46d81bb4f34912c255a8d01953635

SHA1
25969cc9e588e174b854566778f283f067c3c0c6

SHA256
bd1bc00a5c29726fb39645041fc6c8295256d90c7f739ebeaa8b6c382a4db189

SHA512
83692654ada422391b428953b2cec67048a171bbef4c59158f34607a762feac8a233b52ceaa528306cf103d9830ee38897afa996389e086d3778f290555a059b

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\swiftshader\libglesv2.dll

Filesize
3.1MB

MD5
8090f82a02c6850cc7bd2b481a7533e0

SHA1
54a0b66d76c1b60e45e83ba4627299d0b2aae84a

SHA256
e9473ba82f6d8742ab74e67484886291aa69037db72e0ae256b19581de0b772e

SHA512
b2e3c57926860a7954ca6e426f5f2fa080cf6ccb5c4edd77f59744f240f597aa9613f46294e8b344db76b46fe78777b5016828b8ab2fc274ca107f3af7abd878

Download Submit
C:\Users\Admin\AppData\Local\Programs\darkorbit-client\v8_context_snapshot.bin

Filesize
168KB

MD5
c2208c06c8ff81bca3c092cc42b8df1b

SHA1
f7b9faa9ba0e72d062f68642a02cc8f3fed49910

SHA256
4a67de195878d290f49b503b83e415917b8bbcbd9936b07a5d33b48e9bc6e0a3

SHA512
6c3c370dd086a976c44d4059a315bd3bcbb50961aa34734e65a40d861cffca9090d47cec74575afe23952e394e4845bda2d8798eebe01fb54a7a6288bce238f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc9ABF.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\darkorbit-client\settings.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\darkorbit-client\settings.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\darkorbit-client\settings.json.338779163

Filesize
839B

MD5
7a943585327bc2be8809fba9ea386406

SHA1
4670c49673cda033f4c857786594159015a3df2b

SHA256
d2b2d9ef4c0f8ebde8eb6bb81cdab6a911db98fd9c10994d789979c8e5a44427

SHA512
fc85354036901d34d71c3ecd4ee96504e4e040f7cbab2b3146953096e2595c15993ff96d23a5f101b9188c88080d877d5025b657f38790bc0be1c0d82042e83d

Download Submit
memory/1800-393-0x0000015E4D290000-0x0000015E4D3BA000-memory.dmp

Filesize
1.2MB

Download
memory/1800-382-0x00007FFBBB380000-0x00007FFBBB381000-memory.dmp

Filesize
4KB

Download