839671ce4f71f26bae33aa91246a409cda9367fc27d0cf9f57cb7f4df7a3d177

Resubmissions

12/04/2023, 12:40

230412-pv99qscc64 7

12/04/2023, 12:34

230412-prx51acc39 7

Analysis

max time kernel
176s
max time network
178s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
12/04/2023, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DuoHacker.exe
Size

65.5MB
MD5

705019eaf223137bb5078a24b16d328f
SHA1

a908b1321641d7f5c5773ba4cb46990978605ee3
SHA256

839671ce4f71f26bae33aa91246a409cda9367fc27d0cf9f57cb7f4df7a3d177
SHA512

bddac83468088c0fdc199733be89e67fd3a1f0d3ef2addd84936ba886856e02c4919892cd4f32de1321672c4b611a74b64fb396607d9d4f43d8a66c3520a4b24
SSDEEP

1572864:AXky+ptb+Nkl6BaArQ2ocxSG3oSi061S71zyV6yrh8+c1zVBrYaNe:A0yUt5qpnYG3Zi061SZzyc9+cyMe

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation	DuoHacker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation	DuoHacker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation	DuoHacker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation	DuoHacker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation	DuoHacker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation	DuoHacker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation	DuoHacker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation	DuoHacker.exe

Executes dropped EXE 11 IoCs

pid	Process
3520	DuoHacker.exe
656	DuoHacker.exe
2864	DuoHacker.exe
4064	DuoHacker.exe
3996	DuoHacker.exe
688	DuoHacker.exe
524	DuoHacker.exe
4924	DuoHacker.exe
2612	DuoHacker.exe
4852	DuoHacker.exe
880	DuoHacker.exe

Loads dropped DLL 23 IoCs

pid	Process
4092	DuoHacker.exe
4092	DuoHacker.exe
4092	DuoHacker.exe
4092	DuoHacker.exe
4092	DuoHacker.exe
4092	DuoHacker.exe
3520	DuoHacker.exe
656	DuoHacker.exe
656	DuoHacker.exe
656	DuoHacker.exe
656	DuoHacker.exe
656	DuoHacker.exe
656	DuoHacker.exe
2864	DuoHacker.exe
4064	DuoHacker.exe
3996	DuoHacker.exe
688	DuoHacker.exe
524	DuoHacker.exe
4924	DuoHacker.exe
2612	DuoHacker.exe
4852	DuoHacker.exe
4852	DuoHacker.exe
880	DuoHacker.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 13 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	DuoHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 5c00000001000000040000000008000019000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877604000000010000001000000091de0625abdafd32170cbb25172a846720000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	DuoHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	DuoHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	DuoHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	DuoHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	DuoHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	DuoHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	DuoHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	DuoHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee419000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	DuoHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	DuoHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	DuoHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	DuoHacker.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4092	DuoHacker.exe
4092	DuoHacker.exe
4852	DuoHacker.exe
4852	DuoHacker.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4092	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe
Token: SeCreatePagefilePrivilege	3520	DuoHacker.exe
Token: SeShutdownPrivilege	3520	DuoHacker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 656	3520	DuoHacker.exe	69
PID 3520 wrote to memory of 2864	3520	DuoHacker.exe	70
PID 3520 wrote to memory of 2864	3520	DuoHacker.exe	70
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71
PID 3520 wrote to memory of 4064	3520	DuoHacker.exe	71

C:\Users\Admin\AppData\Local\Temp\DuoHacker.exe
"C:\Users\Admin\AppData\Local\Temp\DuoHacker.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe
"C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe
  "C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\DuoHacker" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1500 --field-trial-handle=1752,i,5945063826139451202,9914334815010313312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:656
- C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe
  "C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\DuoHacker" --mojo-platform-channel-handle=2132 --field-trial-handle=1752,i,5945063826139451202,9914334815010313312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2864
- C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe
  "C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\DuoHacker" --app-path="C:\Users\Admin\AppData\Local\Programs\DuoHacker\resources\app.asar" --enable-sandbox --first-renderer-process --remote-debugging-port=50440 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2660 --field-trial-handle=1752,i,5945063826139451202,9914334815010313312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4064
- C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe
  "C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\DuoHacker" --app-path="C:\Users\Admin\AppData\Local\Programs\DuoHacker\resources\app.asar" --enable-sandbox --remote-debugging-port=50440 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3488 --field-trial-handle=1752,i,5945063826139451202,9914334815010313312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3996
- C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe
  "C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\DuoHacker" --app-path="C:\Users\Admin\AppData\Local\Programs\DuoHacker\resources\app.asar" --enable-sandbox --remote-debugging-port=50440 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3736 --field-trial-handle=1752,i,5945063826139451202,9914334815010313312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:688
- C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe
  "C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\DuoHacker" --app-path="C:\Users\Admin\AppData\Local\Programs\DuoHacker\resources\app.asar" --enable-sandbox --remote-debugging-port=50440 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3888 --field-trial-handle=1752,i,5945063826139451202,9914334815010313312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:524
- C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe
  "C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\DuoHacker" --app-path="C:\Users\Admin\AppData\Local\Programs\DuoHacker\resources\app.asar" --enable-sandbox --remote-debugging-port=50440 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4016 --field-trial-handle=1752,i,5945063826139451202,9914334815010313312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4924
- C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe
  "C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\DuoHacker" --app-path="C:\Users\Admin\AppData\Local\Programs\DuoHacker\resources\app.asar" --enable-sandbox --remote-debugging-port=50440 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2824 --field-trial-handle=1752,i,5945063826139451202,9914334815010313312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2612
- C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe
  "C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\DuoHacker" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1752,i,5945063826139451202,9914334815010313312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe
  "C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\DuoHacker" --app-path="C:\Users\Admin\AppData\Local\Programs\DuoHacker\resources\app.asar" --enable-sandbox --remote-debugging-port=50440 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4032 --field-trial-handle=1752,i,5945063826139451202,9914334815010313312,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\DuoHacker\D3DCompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\chrome_100_percent.pak

Filesize
126KB

MD5
44a69827d4aa75426f3c577af2f8618e

SHA1
7bdd115425b05414b64dcdb7d980b92ecd3f15b3

SHA256
bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b

SHA512
5c7bdf1f1deb72c79b860bf48f16c19cb19b4d861c0b6beb585512ad58b1bc4b64e24edfcd97233e5b91dcd0f63ed1c7b278d22ec062fd0dfe28fe49cae52049

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\chrome_200_percent.pak

Filesize
175KB

MD5
9c379fc04a7bf1a853b14834f58c9f4b

SHA1
c105120fd00001c9ebdf2b3b981ecccb02f8eefb

SHA256
b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48

SHA512
f28844dba7780e5f5c9d77ac3d29069dfcd6698447d5723886e510eadd51d6285e06adbda06bf4a69f841afc161c764cb2e5b9ad2c92f0a87176709b4acd2c13

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\icudtl.dat

Filesize
10.0MB

MD5
25d87a2bb3581bc3597dfb9008516710

SHA1
e3f59f1de852cde2204256c7a8b1580483ab907a

SHA256
b75bd14a3d9a174ee44eca8c62b89c65d9836fcf62c28d103bfa300c02cef255

SHA512
59977fa5ec1dbda7cb6525c48655d6e8f3d7b00408e973efed1f2235d1d7fd88eae443fdd5e07d52f31ce83943aba050c31261baf2798c1b10aeae67981685ff

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\libegl.dll

Filesize
464KB

MD5
bae33873ea0db05ea5555f53ebb19a9c

SHA1
070af32bcfebe55e66db75e1f7b3ce3cfe67c3e4

SHA256
fc2cc4deec921ffba6e1165d569d0df4209722524aaa21e78e5e1de2ca922ac0

SHA512
a7037350365ca3cd41115d332a9ea4daaa22206cb6b6670092af7e1da2f341d499f1961a31c01b2955bb28c0a178abe8dc942dec144db765dbb9129560e42d0f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\libglesv2.dll

Filesize
7.0MB

MD5
cbd65f2853517cba2dbe6628223d9863

SHA1
2b5efd10aa1ef64fee1cd7ac0b21762b6f1b4e87

SHA256
8b6a54b72ec42f94072cad21911950014553e11fedc1573c11b3c233eadb0dbf

SHA512
75d8cccfe8921f9931b8f0e6a2a82f4162fc3d9be66f1556cf4857a48595f9820ae4b46e150d642ee27f327a31eb04445edc07e49e9333221a1ce77575224b21

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\locales\en-US.pak

Filesize
302KB

MD5
3fef69b20e6f9599e9c2369398e571c0

SHA1
92be2b65b62938e6426ab333c82d70d337666784

SHA256
a99bd31907bbdc12bdfbff7b9da6ddd850c273f3a6ece64ee8d1d9b6ef0c501c

SHA512
3057edfb719c07972fd230514ac5e02f88b04c72356fa4a5e5291677dcbab03297942d5ecdc62c8e58d0088aed4d6ea53806c01f0ea622942feb06584241ad2d

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\resources.pak

Filesize
5.2MB

MD5
9d878b1d256eb3f25d6ac803adf0b4d4

SHA1
17d69922b63e329392dc0b2db1c17abbe58ef113

SHA256
4e10d654ef27624370b879ab551d7423dcc12a0523e18c183d40d97650d7ebf7

SHA512
529e46567b955c9d369df9ac4095c0dbc00be73249caa23aace044808eea900ef670de1b0384a2eace2d63c6711a5bf1905629b9664bccbf85d97179e953f61d

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\resources\app.asar

Filesize
6.4MB

MD5
42a58fa438bdaecd06c8d167107e044a

SHA1
bf0b7aad9ee2f218ff3ea1276424e7012cf6b8fd

SHA256
e0f5673d0437c12dc34d689e9496d16a1368dbd88bf16cf4dc668be1eece91b0

SHA512
e977f2f4adf9811826a6c7b015db538f672532b3dfd755e7c40f80f63e71da4696c07ce8c01e31d0e2c267be8dd3ddc48eda434a8a7983eb434062a3a761da16

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\v8_context_snapshot.bin

Filesize
710KB

MD5
09b26aecfebe483e73c5c0566542b7a0

SHA1
7ae13f668381f2ecb70197c226cb5cacb87ea935

SHA256
16973309aff802c143ed31bf8b5f9e66766da082e03e8cc47004f99bb25b6ead

SHA512
32485d9ee70ddab62f6e5545a29f9e465966caac95f211941a4c471ecfd1cc046181a4d0030940f290c1bde3af722be8b60c9da8acd56858a43ccfee1e3c9418

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\vk_swiftshader.dll

Filesize
4.8MB

MD5
7d637d9f1015835d99639fd6950f548e

SHA1
9591104b23f46b0723deed596bcd16e2f31b3ac9

SHA256
44d2d6927607355dddd923bed2025edcf368fe9daabedcee2b6894e0c34f6825

SHA512
c218221c8900d7a45d97736764a0864f060c26b76562ddb65bc2dd0452291cbd89c24191dc80ee71451f26826c0b5f1d0002e016740b127ce31f1ebfef31d3dc

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Programs\DuoHacker\vulkan-1.dll

Filesize
858KB

MD5
e3b0249d0209585230ed299bb7a154a1

SHA1
1fc4d66ed099314be664eb80fad3834328697638

SHA256
a4df19cda9cba76e6ef085b7bc693c4237178b29be77a40172d534b6f17bd691

SHA512
cbe6fdd299112d0141bc73a334fdc5273f70c906176ab37791c1fee1d177c38cb7b9b5b01f04039b5a96afa75cb5d645fbcee4724a291d0921a9f12fded2c449

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\DuoHacker.exe

Filesize
146.5MB

MD5
936228d3ed89688fa1196ec11ac8432d

SHA1
8d3ebae8e41cf1a688c90230bca87b0a023e4cff

SHA256
521caf203a5da1060ad0afd04cb017df04a28d32f94a33b3d8ea1aa767334d73

SHA512
7bf74036fe615cb2235102c3b5fe5a4fdac686a4b7ad3aabcfcb7a086a9e08fa00627f3ddb85489deea6b4e742b524bf189461b762fcc9cca90adeecd4bb132f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\LICENSES.chromium.html

Filesize
6.3MB

MD5
6e638956244aaded2c92b77f9d421a81

SHA1
f5269556b6fe04cfca5a1da21af718641708a666

SHA256
652457f1b5ec60a81c8aff095366bcc068402c21eb380ba8286366bc4e9a029e

SHA512
f0e173761a6acd13b6c1b5eb896c361487a770a54f1842ffaa80c8ff780b37a1e801169786776c4afa7d9c75cd968dbaddabff082de55cf75cc4f9d871d08bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\chrome_100_percent.pak

Filesize
126KB

MD5
44a69827d4aa75426f3c577af2f8618e

SHA1
7bdd115425b05414b64dcdb7d980b92ecd3f15b3

SHA256
bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b

SHA512
5c7bdf1f1deb72c79b860bf48f16c19cb19b4d861c0b6beb585512ad58b1bc4b64e24edfcd97233e5b91dcd0f63ed1c7b278d22ec062fd0dfe28fe49cae52049

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\chrome_200_percent.pak

Filesize
175KB

MD5
9c379fc04a7bf1a853b14834f58c9f4b

SHA1
c105120fd00001c9ebdf2b3b981ecccb02f8eefb

SHA256
b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48

SHA512
f28844dba7780e5f5c9d77ac3d29069dfcd6698447d5723886e510eadd51d6285e06adbda06bf4a69f841afc161c764cb2e5b9ad2c92f0a87176709b4acd2c13

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\icudtl.dat

Filesize
10.0MB

MD5
25d87a2bb3581bc3597dfb9008516710

SHA1
e3f59f1de852cde2204256c7a8b1580483ab907a

SHA256
b75bd14a3d9a174ee44eca8c62b89c65d9836fcf62c28d103bfa300c02cef255

SHA512
59977fa5ec1dbda7cb6525c48655d6e8f3d7b00408e973efed1f2235d1d7fd88eae443fdd5e07d52f31ce83943aba050c31261baf2798c1b10aeae67981685ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\libEGL.dll

Filesize
464KB

MD5
bae33873ea0db05ea5555f53ebb19a9c

SHA1
070af32bcfebe55e66db75e1f7b3ce3cfe67c3e4

SHA256
fc2cc4deec921ffba6e1165d569d0df4209722524aaa21e78e5e1de2ca922ac0

SHA512
a7037350365ca3cd41115d332a9ea4daaa22206cb6b6670092af7e1da2f341d499f1961a31c01b2955bb28c0a178abe8dc942dec144db765dbb9129560e42d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\libGLESv2.dll

Filesize
7.0MB

MD5
cbd65f2853517cba2dbe6628223d9863

SHA1
2b5efd10aa1ef64fee1cd7ac0b21762b6f1b4e87

SHA256
8b6a54b72ec42f94072cad21911950014553e11fedc1573c11b3c233eadb0dbf

SHA512
75d8cccfe8921f9931b8f0e6a2a82f4162fc3d9be66f1556cf4857a48595f9820ae4b46e150d642ee27f327a31eb04445edc07e49e9333221a1ce77575224b21

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\af.pak

Filesize
327KB

MD5
f78831d4aec1d0e1735ad630f9e8f4ce

SHA1
4afc52c9d2e0fba6aff22596bf876621a7d88a27

SHA256
219d94355d0c460516f9baa83f4b8dcd3353ce13e7648f019810047ee8eecb41

SHA512
ffbf51a4ff656edd65575ae4d1f489281e3ef08e1e5bb05daac9786958d1af832520e6ed77ed197e0160e368fb56bf303f8779bcdcbe77d995364a433024d65f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\am.pak

Filesize
531KB

MD5
8e8fbaad0de95893785875e20cfbe5f3

SHA1
f179e4db197a974e1e428f0bcb9cb1bc09df04f4

SHA256
f62791089b07bb9796292e5e3fd81eb1e68f3adba0fcc88fea4df744dbad6775

SHA512
93cfc2f82d3f83dd992ba758d067055cc26bae5c2e9b1ecd6974f4143c22da405bc6845d2d2a811ff043ff1cd55929ed04a6f929ae01ac211c781d4786a90246

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\ar.pak

Filesize
573KB

MD5
cbeaafb259a3a0ad76739186e9b2bf75

SHA1
11b348534a84c9648eb86c9790bfb7703cde242f

SHA256
c28e612cae27402f2a75c9699268f1781b286748b0590d396e0a538e3aa67e49

SHA512
2c91f17343d947cd4eb4d8d339e5932a3331445b4e826915d54196c29ce548b7e98a9b5f9857146a9a956ce20d3e624fb04b7c44d3c1a2593e8b6e2cb12662b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\bg.pak

Filesize
608KB

MD5
96372403a9ded96f3a699262029a4580

SHA1
07069b20fe303f6eef1fb6c8c0a19266a0c705c9

SHA256
6c10b64d31e0dc2c4befc6703ac17343ca473b4350cfb3c6e01833f505b69590

SHA512
0df60fe13818f0c3c6838e77686c5de9fa03b97cbf0943f7a2a4ae2f3a0890d3d64b3a7652d8c81c23de876ac92e4c6b71d584fb106c3520c96ef76ba30250fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\bn.pak

Filesize
780KB

MD5
cb203032925be270222dc2c20fe771e2

SHA1
2f2f20bbbd07ee01cc996247bd9c2f40037dff80

SHA256
297d52b252df0912490ddf26fa58706895e70c2a0f3f09d0dc756706720095ef

SHA512
052be75c51051949c84216566b462733b61026ba74e212b000cbed7d93cb852e74ae83d64d2eaadc3093af4265b6783184cf8e0368a75e077d4b75daba40f9b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\ca.pak

Filesize
371KB

MD5
6d6f760b1fd64e4b83536a1ac4713e4f

SHA1
929a965b0ad9b8062c64ae940064260b13d05c2a

SHA256
9058aa0f327ff79b62e730d72a06351380b21dc9217f565a94acffa73abfe2ce

SHA512
ffb2fa6d6e809e4ff527d682a9eec422f2a123826529793b85ea0fdfb3f358d1e321f49ff707fe3777494e4043019ccf0e0f545670d4d29216a8aba56c7951f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\cs.pak

Filesize
377KB

MD5
3e2c49143f4718ddd9c1c74f8599fac2

SHA1
7cce45de66a3895c3493b998fef7bedf045b29e2

SHA256
08e40f5efc616cdc0588fb4b1a706d997c69d17ddaf97eb91a4aabafaa11cee6

SHA512
a849ca0d09e0d4c025d9de6c8008c13e13581961c321f53a552deeaa210db891914386fd51673615aec8b5d8d68a921a968db5d0fe447963892ceb0948861e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\da.pak

Filesize
342KB

MD5
6c24baadc460e788486e336ae505a224

SHA1
dd1aad964c24f46c69a81ea29a12a69bb0290767

SHA256
e20628baac73a284b2cd6514fb396d4e0a22f4f6fd193d5d7d45190a0944e4fd

SHA512
287bf70065ff99f20cfd150562b022762e2e61858cf0203d7272b5cd8ecee9c0567b8910913effc291162243833d445d13fc45f02b4b0f26d30611ad9c8d0376

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\de.pak

Filesize
367KB

MD5
4c83231e20122f26e0a81a91ba6146ab

SHA1
4597efc299df26a0e6db5db622921eb7b66c6b16

SHA256
2d4130e036290ff3cd938c664fe0bde8755fed9658ff84ba09c926829fec3c2f

SHA512
ca872465b222a145c90a314f44671a7efcd3e18ff072b1855a509a56e34854c4aa80ba1ab5ab5f9a3650e32a98d859bd80e52762ce2da57a40bde83092a80303

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\el.pak

Filesize
664KB

MD5
8f5a15560710db2af852512b7298b93e

SHA1
30a13ebef10108effbad8c24b680228660658415

SHA256
bc07e403272a4d65305fe24a827404d7b931d01cda547f8c07a840d19e591430

SHA512
e3cedc0eaa82b10a68a40aca8ec1379a6bb924766e1c5abd97e39c621dcbc195d6c1ff80921c2320f0f1c87d160bc2a6258108399876339e5104f98d90a861de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\en-GB.pak

Filesize
299KB

MD5
05ac84aa6987eb1f55021b6fba56d364

SHA1
58cb66bba3af0c6cc742488ccc342d33fc118660

SHA256
e1e357c853eed83fb6c4133f8f4df377a8eda4fe6f0e55395f21c5ab6e38faa8

SHA512
c615e1eb01412c5e2c0402242d442a6cf08965318d1c0d261ca5bc6df9acba5efa2c87ade20e1e4740d2239ea56d1ce4d3fc7a4c3eabe81b876ecb364b3e91b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\en-US.pak

Filesize
302KB

MD5
3fef69b20e6f9599e9c2369398e571c0

SHA1
92be2b65b62938e6426ab333c82d70d337666784

SHA256
a99bd31907bbdc12bdfbff7b9da6ddd850c273f3a6ece64ee8d1d9b6ef0c501c

SHA512
3057edfb719c07972fd230514ac5e02f88b04c72356fa4a5e5291677dcbab03297942d5ecdc62c8e58d0088aed4d6ea53806c01f0ea622942feb06584241ad2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\es-419.pak

Filesize
366KB

MD5
527210238ad4c2f1b079cfd8857b08e0

SHA1
b779d21fb05cf8e6e9446fac4634d71e48a18113

SHA256
fdf3a44e1fe4fe753c196921f700014c81280464f99e15b8a6137804ec14ca19

SHA512
fef1cc7fab7816fc1e3ac5507f875ad592dde63509b7d738c96a010ff1a2e32ec1c9d1188023c5b92eea63fde72aa6bf990e9b89cd05788baa46e5e3b5198d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\es.pak

Filesize
367KB

MD5
96bdc30c826aca4fc7e5e6adfd889b75

SHA1
aa71721b78ab54a99b97b580c4f6d1610b198df7

SHA256
cc423403f5bab00309993241125577d5e64a1a4130a44979b4c8d3e07428953b

SHA512
30e3df376fe06d60388afc13a421ab335a75bf05651f2ce83c8eb80653f29180bb89154149136e3c5009de62bb62ba451a4aaff65f1de9cddb6fe3dec8e90706

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\et.pak

Filesize
330KB

MD5
054865950b3b9e8312a7f9490268eaca

SHA1
28b0176112eddb7af58386b4f8aed4a49b9a2661

SHA256
3599e7138a24a31839da877cc9718b9c0c9522437ea93a6222a119080f108d14

SHA512
bfc72f19ad1a52c0da82409accb33a27b2844ed29010207268c7d695ad7562a8867a87b70ac50142909b50b81a5c84d6f6a43968353ae7a72bc042aea8cbb59f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\fa.pak

Filesize
535KB

MD5
b3adacc0f472d65371b8c8ead3595d4c

SHA1
2d4773fd77b2690598158769a788389ee80dae1c

SHA256
ff72cec00f81f0caa8947c78df2402bd7b643b27281bf0890b8eeee4c4f7de25

SHA512
fa01da4d811c8de89832262a8b1d227ecc5ff42b37e53a817feab2bd0bf91c9dd41097677ef20ecc269ee1ad792b23ecdd52ae3d3f65c8ca1336a22d82cd63f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\fi.pak

Filesize
338KB

MD5
aac0554a39bb1ae91e2ed4246e04c30e

SHA1
031785024765eda1534fd9504eccbe1b471ae618

SHA256
df8cefa4831fc2fdf817dd6d49a6373edee4f51f23cf990c690e72ce348f69bb

SHA512
a6afc9464047c75157dcb8ece086c1c5bf4dccb48d33da24e35c43110f300cfea503c4cca093f3d4bcc7a0fdcb306138da5be288ef646881b625751e40d93689

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\fil.pak

Filesize
379KB

MD5
f989a7215cac1e3fb4759e5fba9aef67

SHA1
5ecf35f160e1f8242b3bca163673e24cf6d77403

SHA256
448bc8eae353c188ffaa4c2466956598ad807f0f0aae7f12e1bc59584e1aac2d

SHA512
b872beb5b1c2702f4eae616f633318b4575f573c06a3f1f0f1e1ab83585a52caf2f3c788c0c3a0d499c381fb7f06a3ea355b8686ded2ed1e392662f2746db01f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\fr.pak

Filesize
395KB

MD5
1a7333b3598f8dd05ec29a561053374c

SHA1
01fbc828e0b0ed5d06d4bd9f4195303759ad2feb

SHA256
c3980e2755c0fb13c09210d560fab480a907be5512c896f83033526c83bd0ba8

SHA512
f45c077787bc1795db34d6c0901a86022eef04cb92a556b246a0eb9dabe0dd618ee6ef65549c851da887e56c9d4f889619a5c319d6c816dc29fd15ca92a3e46b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\gu.pak

Filesize
755KB

MD5
7b476c423ce29e61b0b21d7b6a2a56b2

SHA1
5558dcec5b2580345b0797f1f2ea41952417335a

SHA256
047da4dfadcfc6bec8f4dc7d250b1757caf31a23bcfa2ea3e1f3b1cdbe9a3995

SHA512
a494ab32e45cf74e2b7e0424b4e3740470c5c6cfac8f6cc980a681eb8c21cab76255391b6884134593dc7b1029ffd861f74b47130533232881c137c41ef92cac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\he.pak

Filesize
468KB

MD5
738493fe36742789beb1eeb506a34772

SHA1
de88f04e8f97f8219eeca24901ecc02d12f2d9ef

SHA256
d57a910976a19e424390a5deb2216d9d3023e8d84d4c96d4bc1fa5bc22e494ba

SHA512
4d5dfdd6fa88ddb552a40e3d9982f2796ac36a80438abd69167155dcd3dc61fd7dcec94e77233ce384ee6725486fbd1f554e3f6e342f37d76845ea1dd308e2d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\hi.pak

Filesize
787KB

MD5
2d626a4e3b9026f16f5d73e7c5a209ae

SHA1
8f9b3c05606d282a7dd15879603611ae48d9461e

SHA256
19b0b5d9d77aaff3ff83b6cf33b7f141181c143bc9ce3a3acb4aa0b42e7e48e0

SHA512
ea0097c931d8f86895ac70d1f911a8b31b7959fd43aa13a437655d5483ce49a71307a0f8f1ab63a9e17c357c9d50c96fdaa6ef8a3530e0e99bd2642c9824f1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\hr.pak

Filesize
365KB

MD5
04fdc1dac2cae614b0f566310dc83bd0

SHA1
74e460e19a5e9c8b6181fa37cb9085f93bbc6233

SHA256
bada5828fc0d80c842d1409b54e8da516ae737ca30d86658b3fad5c8ace4722e

SHA512
a07bebd16f00b0b46059a7b80454664757687a59903bc36cb837cfb55e69bf7f683157372f74ff8355ad50c3b747c9674ee942aac95a9804c39acb3841721d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\hu.pak

Filesize
395KB

MD5
410d8966721ff8817eb3a57f95a4b885

SHA1
f0fbe70c772bd635b0c4a927420e15b96dae05a5

SHA256
688312f38488c7256370b1517b84963a3ff886b31692cc504fe169db241a43f0

SHA512
d0aa167ee919589ff3b80640e8db4c6d11f9159e4a246082f0a564482789011c260f124b9a7102649d998c6a89cbff58cffab5a40e33769b990e64d6cc703378

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\id.pak

Filesize
324KB

MD5
dfa205151d8fd00101f2748705d6f307

SHA1
87f00af9668460e733bb1f5f8c37bf3ce3784a6d

SHA256
cf29b1d2c889842d2899cd615e5baf059df3bee2d899e5d196ac38e298a47524

SHA512
767df5dfb0023a799acb56360bb4d56ffa99b9d718deb1bd2f1dc1c942fb324e7c9faec99232df5ace31308b519e169bea631306739cb63c925939079bc1339f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\it.pak

Filesize
360KB

MD5
d6a9ffabe491fc403a74b7560c85a3e0

SHA1
52efb6af41e7831d5c7d7daf53c14858b66ce1c4

SHA256
7f3710678d8582be97638fcdcb98c9ecd372fd9982a1ac21a40c8af93dfea76b

SHA512
f8dd0f154fa50691cc731ebb894245bcf30f5991602efef58fd26e2b2f686d47bb6d5a6c799c3393b48dc34741440766ea0e514f020fc0cf40362c1b0b9a8342

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\ja.pak

Filesize
440KB

MD5
7fc361c2d7becb728ca7ab6e64d09c7f

SHA1
0053d0ebca0c4c0187bb956cff335af88a9185e5

SHA256
f5849cefc882872ac31e790816e3695260378e4989c4609c66bcdd54a89cae19

SHA512
987934807ac6da563915457fdaeec57aabb04aac102575018b3a8fecd4f3951a13e691b2e9690bd0ad1b7cb7f061164e0fe6bbd5a6c389a2b438f6c8c126047e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\kn.pak

Filesize
872KB

MD5
8a3427385226ab72e8421d84225f7adf

SHA1
701a85bc6bca0ed33dbe1aa3a617ce26576c7421

SHA256
c315e791770cea204c7e49ef5b68fa46fe42864a33e77fa5a1d42f87ba85124f

SHA512
310719fb102c1f892d354f1478bba06e856bd45da08416be970a0a76e44c7d81aaa9ddd878234b2348b625e0d18cfe7c966379115f35d51f4ee78a986c1243b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\ko.pak

Filesize
369KB

MD5
3340fd0a5e8f97f122e1d6e9a2052ca6

SHA1
9c8504b78633b6d6e445723b351a08392916c7d0

SHA256
3ee7d79af9ec226bebfdd9d79907f1bc97d528d2009dbd0db23d74ad655e0256

SHA512
07eb8dab24ea8545cdaf38e35bc23a71a33bf87a1c0ac78ac564c103c6ae53357de2d4fd635b22995cefdc9d8e8241c66d78dd44d68a9f2f251be77c0afa7704

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\lt.pak

Filesize
395KB

MD5
c037c0d80be2c913c20e3fe96d9cdaff

SHA1
8dfd2a42fb2e0041d6ac9b90c78b3cad0283c757

SHA256
e7c133a8dc438870f97112587f5f223f5fcae4f1510874b95b72cc281fa150fd

SHA512
0a90dd7d39759e1e63205a827ed6611dc6e54b37c668795123de7f35c446ee41174675a0d813974dba7353c0a1cc4320049d4fd1368cdfccb9cf9afa47fcb4f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\lv.pak

Filesize
394KB

MD5
3053d480a88a2796fcd59573b9104bb9

SHA1
664a1f3d1f29b35e3cf7f855ec1592bbef2a43d7

SHA256
aec37ab5c79a66ef713bdbd2547e8e22dbad7ac226dd1470466c7f58a1500a25

SHA512
5fb5283e6d5af3738b2d9a53e85e2245c6e8e03548d9aae19b0b6ffc64630cd689f60d3cd19d943e43c8b1e4692ed60c4f5db21cc21d57cc629780d24dd0689f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\ml.pak

Filesize
915KB

MD5
fc33673850c17a865cae7695fd3eb5b5

SHA1
72f3241ea35554c881e1849ba53b8f64b04502c1

SHA256
6295eb0b0d05d26b3fdaa19ad390ba30f267b7af7a60a214db558dcdbdb436c4

SHA512
6845293c0cd4ee1aa94972da1d58fd7085da5dd664d4031005200ae38fc4ab20f2c5cf44fe07ff80e003ef072f7f1cb23a452d6ce47124aa1efb3d26ae86b279

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\mr.pak

Filesize
743KB

MD5
d1f1c482775f60a868ca094108e3ac3c

SHA1
ba4396e5b585735e8505263ed42884876bdb564f

SHA256
f63460da44e2f71c237b2555eda621c8c211c13ae68927c27ad121f03daa0599

SHA512
2686c406b29750ee39b83247e4a4e6a0ce3325c1284ea11fc986696b43c672eeb0c5259c4834e4419c131941b9d1d35e53b05606168c766d27a614f49e223dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\ms.pak

Filesize
339KB

MD5
52c793391de0e946616d31f7d5b90761

SHA1
50e014d9715df658221edea402609d7b09c9fb10

SHA256
ad044cb5cc56f8cba19ea3319081c194661f072d6b1193509e3690769bbfc2d3

SHA512
d5db7fb23779bf1b258f949ce6af5115adf3bd93760041ef70f1e2f599ef3be6a7a1ec871b18858a1eaca906b98b0a04348a427d5ecd26bc99d8e6d986843478

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\nb.pak

Filesize
332KB

MD5
be28cf3c50da9f1c3b7a85ba898072af

SHA1
d23db9be2cb40dcb9b6480a15cc21527c593e343

SHA256
4b5e5026d815c7c4ccc1ae6d58f0b5f1c83a2ece91f7ec028c05961171ad30bd

SHA512
5446f8c7ddbd8b2678d1abb921e6635f6d0c51229df20f9b9c5bda7fa84ea7965914efaa6e7fcfd030b574cbdb40cee0114394173ee152edcf4cbe4bdec6a032

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\nl.pak

Filesize
344KB

MD5
e442b2f2406c6e47a4e4d0e7743de448

SHA1
d2445a2c804ba181cafa343944aa8af1ec3da773

SHA256
dd7f66e04f78861d8f7d3986f707f06740bb35b839076ab8d3799944370b4544

SHA512
11b065eb66495a52d2bbd343b655e91b7e98cf51ab50e816c90a272022460cb2b297623c41a6f078c8362fe7e09032920c6f38663309ce920887c5d4058a47fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\pl.pak

Filesize
381KB

MD5
a742d06d1423b4ac4c9c38ac327887b6

SHA1
55d4b1e92a5911b4df37c8cebd0ee24d3a9d3ac1

SHA256
0f555aaa36f2908b842a4698dffd739b5381b12dde686303341d47fc475f9867

SHA512
18f40b161c6741e483f3206bcbf6d0d18969be985cea774055003b31cafc45b7e1580965fd3d2b32de17020eb866df3dcd2290c652ca4d0719b73af6073f3e05

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\pt-BR.pak

Filesize
360KB

MD5
e4b1fb0229dc7a913012cb5313123c3c

SHA1
6c137b91712593040c6e02bedb82d90d85cc2b84

SHA256
7b171f2a6d46295147a8d10e475048bac4346c6a5162b32a0336334baccad520

SHA512
7224d310713d94f56aafbdb80a4a7ddab5e19dd18a7880f93770b86204e323072aa8e879d2f7e1fea25a6506836e8ca9ed73068e76f4ff9b74c0ecfb807c37cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\pt-PT.pak

Filesize
363KB

MD5
d412b4a6bc7097cecaa56742263ba3e0

SHA1
8978b9820d8f193c933697d01b1882ecd348a60c

SHA256
5ca8d063080a3ee10baad94fe25f5dce33d17a269d02572f5e8c5654c7c0a28c

SHA512
ade2b6405957a8f1fdf03aeef50b568cca61e89c0880582d596586e36c1ed05a1f1c9baf1cdfd691ea6134d9165d83995b6b0a718d50ed9aab735bdd21344d76

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\ro.pak

Filesize
372KB

MD5
efd3112d1eac487bb3dd2839385eed39

SHA1
d7a45ffdc10d24425c8b1590ef1239de34737a2b

SHA256
c50f824e63806e5782b693f7d474c48684b9e5174e93463a9bc2876c94990879

SHA512
f604f37f59c17e7a231ecc55121620138ba3c458f532889cd4b70a6046f0aa3ca0d53e0f342977d5ae0c1edf23706806ed429f72442ff90603b896125243e406

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\ru.pak

Filesize
606KB

MD5
284fb3c4c19e22a9945d4f39709c0664

SHA1
247319c0d6beab4b5543ff650e4a4fa35e85354c

SHA256
6bf94fa22251f8931efc3978a8eddd0e4b3c945a8d30347178aa1402e70b375a

SHA512
0fc12bcae5d4cbfefc40dc761b27bf066a1329927d03c78983eb7fda037a54cafc3541d9273c8878c570c1a990f87bb0a489cc3c47bce530e0b1f11b0ce2ecff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\sk.pak

Filesize
383KB

MD5
989d000fbe286c0fd4bfb35305b52f48

SHA1
5a30a2cc1abe9977b1ffc4c4712452e6d55bc7df

SHA256
dbd82a2a08f8e9ba9581b2672bc49e0fa5c89f073b58f152225f9e2815228ddf

SHA512
ed57c66237d5226d4d5cb63e98248c0df9d381ef86b6d4ef339523f430c54aab14f84121e05e9fedaf273323ec04b8a539c0aeb791245858890126de2ce38283

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\sl.pak

Filesize
369KB

MD5
18414de97f92ebbeaf44f3679ed0fb2d

SHA1
edad45b03ca8a73f068ed586d52af9a583088735

SHA256
b5226b278f174cbf533ce248bfa01b69929f1d6633b92e9e010e0035ac69caf4

SHA512
4ae6e0a86da119d495a084f107f6a7769f14e3bfae2458860bd2bc5c43b1f3b8331e7104ae280b08d28154e23aff02e1ae3d44ce41b2c70b64c5db864ed63df4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\sr.pak

Filesize
572KB

MD5
9e3951f7fea4dac374f5a33d8ede32eb

SHA1
ff36601cc3420ef637a809e1c3287479100d1337

SHA256
4a9d3e9c9cd593830a7b1c8649926c819bfbe0f40c158d4582ad45d4236d05a8

SHA512
510a396691091fbfe2e1ac068c54ad7e224b0a613976cf4705be74aca38bf4e7c8e329966eaa092f3d5d781ffa7192082e3f6e488a68286222a7b8c9922bf112

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\sv.pak

Filesize
334KB

MD5
c5437bb175fed93e85c5e7caf76ff352

SHA1
0d74f7df049ea73a47fe93b75c98e356b9bdd4b7

SHA256
3f0acf6f6319636c3e72cdc392b7b80ab0cfd8ae1a5a8e319624e4b46bcd3c42

SHA512
00af14e7d89a12f4f39fb45a3f9c136e20c06752f98fdedbad426ac9a5b820260a329059659cd82fd089ab1d94c1f51ab4202fb6b142b27538d0139e67877239

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\sw.pak

Filesize
351KB

MD5
e37fc1c3dce484bd0ce496f548f14a43

SHA1
02b088a11363b0a4c0527053669af32737f1403b

SHA256
dea6947693fceb6457801d912ea7c716add3c0cfb4c34782a9cfa4c4e06b9402

SHA512
c5c39d54f4eb6b0659903ce9b5c8804a750a254bf88cc7c6e729e7813ecbbcc88df882af9294b5b795ef5b8afe8f1a60fcb46b3929a9b2cdf41c84188e5852b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\ta.pak

Filesize
899KB

MD5
909acba1351ea1753fee2aa006b75de9

SHA1
5203920c2ebdd37527c3df2fdf2748f6f9675428

SHA256
77548aa804c4fd61942d2953990680e4d3780a42d3583a65fff899751915f2a0

SHA512
92dea042052d780ec0abda9a88360a8f8c4a63e5b3b8ef9b23ea759d8aed18408d0b65f9968075dd88d09a474c5f124585ef609ecfe81d9ec647f8720203cfac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\te.pak

Filesize
836KB

MD5
61479f367868263d3797a1a4d1ee556e

SHA1
7886cbd1eab7a04a3a8b594a48ba74362b7f3785

SHA256
c03f968f167476f7a073b6e6723b51332206416354190e3156d12ac6998e8889

SHA512
21a689be75b0a015a0f0e4b6ff8050211273c61377a89964136f43599acb1ab82baaff7a0a44ba95d3eff886163bfbc6bd8cdf10fa10591c32c83203123b416d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\th.pak

Filesize
704KB

MD5
85f59bf2f1167e34ab2b666608805420

SHA1
f0d8e8fc644c15c52c5f9d3419f88e6072799736

SHA256
4fe2b7b6886e3ce068be0b7a0a71d45756eb797eda1e7d4fad52ab8a370e8336

SHA512
86d6061895c996ad1caa3f3871c014b656e7ba7bb91f05c72a591cb5877c3db61965bc1a5094dcf7c4127d11f8106622355464704fd0695372627d8400a16ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\tr.pak

Filesize
357KB

MD5
ff425815f6377ecdba0b044b0ee73c41

SHA1
2c4bddec47d19f1bd8c0fb68e80807b9dc012c9e

SHA256
eed468f71e218be2f49e79cc7dcb97e140a5d9176a13586196f03dbeab0d8c77

SHA512
49561f6c02b6a4f38d136d4601eaf3da70140ff3de5fe44a92bdb772a6520545d8cb1c7480aaf0ff098dbdb284ae702da53257cdbd493420e9fc1a1f4ca5d4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\uk.pak

Filesize
605KB

MD5
9d029670cbcc964eca2a70e9a877419b

SHA1
f826f0bdd83e43503cff82bad5dc403404f0aff2

SHA256
ffc9894126035e91c96e9912e4d6c5b0964caa130aa47f280ce0db10cc6e45c5

SHA512
56b5727ddc8a96af953e2285b53501164bceba4da1df140e37c133e49b11ad8886a06ccb738757a9f6d653f029e04caf5467ed91b8858033a0427bf269e2daa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\ur.pak

Filesize
532KB

MD5
6310a289e55b1022f12b4f3cc29fe831

SHA1
150d81ec8db4d9aec6c0e83e5577dcb7f1956b38

SHA256
06a0c18d978b54dd163c7f77b7ee0f2ecf3607c5dc14032326f21b4a1f304d81

SHA512
acb538fce25486e6a01401aa0e9204a6f519cd1dfbca48663d6142e1fb6280bab271dfd2b4c5ddc858de6920805e539b791c48eddcad124d0aae298d479dcf48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\vi.pak

Filesize
424KB

MD5
d81a7c3e9ba88077a352b216cb03ff33

SHA1
4caf53fa39a474a5ca1400d0671d5b0aadbd08c2

SHA256
04efa5f9bb7e8fcc7062c10b92b79db29a147f2a27ddd09863d73c078463c581

SHA512
c49d57ba45176db66b0ac43ce9c9539434b8e66a5583e081b713264c257f159900f16ab111f4a51e92dbbd3d1fe9af74dacc3feec2d5fba51d4dec4c429e60e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\zh-CN.pak

Filesize
308KB

MD5
a24b6fdc5c86e265f79f4e26d2d16b24

SHA1
3edf0016afe18622feae03ce7f126e78339355ad

SHA256
ab6b435de352aca2c2353a26da7ca6bdb1fe3b8c9ab9b590311e53d33e5a8cff

SHA512
473570d0390829e46a05e0aae6acfa70d98381ea24f4863570789004a60a4a1f4fcc9c3235b2fc9a0e42fd6f2a2dc1c779e2a52bbbae7f9a3337d878443710c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\locales\zh-TW.pak

Filesize
305KB

MD5
14f3f547a54713f91251b38459a096b5

SHA1
02ac592a2eb4a7c6631dad5aae83726ef9c33ec0

SHA256
280ba35171dfb6a54efb13fc4ddedc13a0283a9a6eebff4c15275767beb4ba77

SHA512
0ad8c6a6eb0dcbcbbf6f9e114c93bc2cf6004dfa9ad7b68dba31c2a9856c0a56acb66507f65b1823434b1ad362c1ac812b72c254e5329a2858e888a761f45ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\resources.pak

Filesize
5.2MB

MD5
9d878b1d256eb3f25d6ac803adf0b4d4

SHA1
17d69922b63e329392dc0b2db1c17abbe58ef113

SHA256
4e10d654ef27624370b879ab551d7423dcc12a0523e18c183d40d97650d7ebf7

SHA512
529e46567b955c9d369df9ac4095c0dbc00be73249caa23aace044808eea900ef670de1b0384a2eace2d63c6711a5bf1905629b9664bccbf85d97179e953f61d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\resources\app-update.yml

Filesize
96B

MD5
10dd3ad3a0886e731a3e2610f3b5532a

SHA1
c6cb7ef62e44198ea05e6e3588ea6d1342a62f88

SHA256
439cccd931743fd8d2b6785a5dfacd32741670e12914ffc443e91339d2ab1f81

SHA512
d619697facc1e9d0c30fe9304f51184414125dba6ee4abda37bbd430916820822bf90e35e8b5ac9738bbb48f314d7d21ed0216b646e7ca9d6e178f5d3561dbec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\resources\app.asar

Filesize
6.4MB

MD5
42a58fa438bdaecd06c8d167107e044a

SHA1
bf0b7aad9ee2f218ff3ea1276424e7012cf6b8fd

SHA256
e0f5673d0437c12dc34d689e9496d16a1368dbd88bf16cf4dc668be1eece91b0

SHA512
e977f2f4adf9811826a6c7b015db538f672532b3dfd755e7c40f80f63e71da4696c07ce8c01e31d0e2c267be8dd3ddc48eda434a8a7983eb434062a3a761da16

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\snapshot_blob.bin

Filesize
409KB

MD5
7fca1510183ba736f72d7f2ca0febb55

SHA1
8f05a77029bc372b31162892415cd969299c164e

SHA256
8eee6adbbb335ddb3716d2e509aa8459d2f39cea020e67c22dfb85b8598fa375

SHA512
32f1d6868a491110d4420aa15eb1fd56018207821a2e16ff3bde15ec4078b149fbe75e909d7c1b587a672b65d4e994d7fdf90b175d788857b9e086fe61d75c67

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\v8_context_snapshot.bin

Filesize
710KB

MD5
09b26aecfebe483e73c5c0566542b7a0

SHA1
7ae13f668381f2ecb70197c226cb5cacb87ea935

SHA256
16973309aff802c143ed31bf8b5f9e66766da082e03e8cc47004f99bb25b6ead

SHA512
32485d9ee70ddab62f6e5545a29f9e465966caac95f211941a4c471ecfd1cc046181a4d0030940f290c1bde3af722be8b60c9da8acd56858a43ccfee1e3c9418

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\vk_swiftshader.dll

Filesize
4.8MB

MD5
7d637d9f1015835d99639fd6950f548e

SHA1
9591104b23f46b0723deed596bcd16e2f31b3ac9

SHA256
44d2d6927607355dddd923bed2025edcf368fe9daabedcee2b6894e0c34f6825

SHA512
c218221c8900d7a45d97736764a0864f060c26b76562ddb65bc2dd0452291cbd89c24191dc80ee71451f26826c0b5f1d0002e016740b127ce31f1ebfef31d3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\7z-out\vulkan-1.dll

Filesize
858KB

MD5
e3b0249d0209585230ed299bb7a154a1

SHA1
1fc4d66ed099314be664eb80fad3834328697638

SHA256
a4df19cda9cba76e6ef085b7bc693c4237178b29be77a40172d534b6f17bd691

SHA512
cbe6fdd299112d0141bc73a334fdc5273f70c906176ab37791c1fee1d177c38cb7b9b5b01f04039b5a96afa75cb5d645fbcee4724a291d0921a9f12fded2c449

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst84C6.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Cache\Cache_Data\f_000009

Filesize
162KB

MD5
fdfdaf63d56b4a9cd6641d79f7159fdc

SHA1
18b413d8b6b9f3bec32026b7e9d9f4e5e366922f

SHA256
f4dba3e15f08cf0686e6d89370ed42e8a5dafc38973501f0aa6baa9b93c720f3

SHA512
06fd67f1a2d5f168c75b5b833d3222d6c0eccfadd4021173a7ec7f949971554d1c7df322b1dc512ef14941e76a9ff6445ba3bd16d940be5bc177be989ec39c2d

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
e15dbd65d74957f4c3ebc352b1694af4

SHA1
1faef63ec346db9d5e8081ae3a48196fdaba10f0

SHA256
0cbb1c2b1c28a4722a4dd7688d0467af9f186336be9d8f39a3b7566af9b60bfb

SHA512
25a11b8decc2ffe69757bf3ba7d69506130489a1b7743a8ebc6a0aeb4bc86f62fcc67634078f727e272b5c7b2bae154c7a97acd63e65fda3a295a9d1b629ad8a

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
82e57c58ef6a48a12b4e6da8ee4584fc

SHA1
916638dac654d0ec4f567c2ddcc05ff5afff648e

SHA256
72ef3d6861b3adb0682ecdd2de8ebac9d8bbff11ba49307fa21d685bd490c2bc

SHA512
75d013ec479b7f7f0c80ec9f521770575195edefbb09fa748f65511ed184a7cd747e0c99ea888ea8aadd90655b5b310d50ec1325ae88acb54317ead2712438fd

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
8bb8d3a531abb207b09403407e78936f

SHA1
49b94c0cae19a84adc2a35a9de7d2924b5ebd705

SHA256
46ee0778b77f267d53244dc4fedc819070e26e81d13ebcf0a78e7809f1d9cec1

SHA512
6e0c9921c441cb22764237ae41e2424cb3fae7771fb9d20df1d9548ea0b3afe9d0ced8d3f8c44a2260a59774a9f829790afdcce913b5f96bf60480cc1f833de4

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Network\29844b10-ad73-454f-aeea-f30aefce6b8a.tmp

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Network\Network Persistent State

Filesize
2KB

MD5
3ac9bb207134bbd0390d790f7d4f5327

SHA1
185231d6cb014c043769d1cff79076309cee87c5

SHA256
7837faaf582b23e3774de3f41f00a8e84d347546dc1a6ff4bb579a2755901051

SHA512
eeab20bb41a9987892df49a1bb75d23335e3ebc7e0e69edfbaa7af607dc7d9cdbfaafb2dcb8f34078b3b4e597fc8cfc774afb12cf710c2c038000b4551a1cb5c

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Network\TransportSecurity

Filesize
539B

MD5
8a4b8ee004182555268d37090ca0bb06

SHA1
87cd2638a31f37824c6953837f0763e5a043f30b

SHA256
1dac771d722c0334399988b5a983de7ce0ee413bbafd8016a59c5894cf74bb54

SHA512
9a0d7cd0133a083d4d2623b84c7ef33f8874cf9d552813456b7c4d38a864809d1a437f5cf39714e466ef8dc9e694c4eb06a7f2beccd3b511e07e713f7960da91

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Network\TransportSecurity

Filesize
867B

MD5
97332e01508e4f75220e7f87fb660ba0

SHA1
04aba0f9288b0924119bd3a031011db8c2161091

SHA256
958067431198cd2f695721dca475643c20d7d672bec82ecb7ffb591566fdbf17

SHA512
80e5e4d704fbc192a7fa10591ce1cfbc11eda58dece5cef5e8ba14c547224acf1b0836230934d12f91db452df41c9f72a31264815be077483aaa84987ec0269c

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Network\TransportSecurity

Filesize
1KB

MD5
3cd20fa7fb8b185ed0ae8dad4ae93163

SHA1
68aa3e9bd71a1221f90170f07fced2533207201a

SHA256
d94fc855365b9cea65582c7647fd31455b4a250839f732854856994275f7384f

SHA512
205787413cfdf561b52cb8d2eb6c65ebc06008aba0f7a3a764a58b61992897078095eff07645aeb95073247d052e12d004937ad0008f0a89ee8f3acec246b2a6

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Network\TransportSecurity

Filesize
1KB

MD5
08cd158dee7c5c5fbe05fc83f2de43e2

SHA1
154d76a4365c5e7561a2116d98d809ee3d12a4c4

SHA256
0e0759c4da517519919cc4ec5707b82cb12b33f233f21f79b2d1d9feedf06daf

SHA512
0a0c659d83296a22764f8aaf69f4ae791b6685640da5701307745f9dfa7036f950175c00a188d82b65ec1b52b10bdc468ef025d21d0490197ebb88d09dfa0bb7

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Network\TransportSecurity

Filesize
539B

MD5
e706769db6fc09a046d3cd99e467aa92

SHA1
787f58366a5d738e54aaadb1df951170b34913ab

SHA256
b38cffc65ab5201bd852eeb9b905ce052c0200e949f4b5e9a3ff3e51e94008e9

SHA512
5106ffec45df80a69b7f4cf9a0a3d3b4f0f06344847e3d0ee8bd4487dcaf5ef7c5a42dfe65fe41e6190761ba3cfbbf41a09ece5287a75f661151398ebc6e9c49

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Network\TransportSecurity~RFe5787ed.TMP

Filesize
203B

MD5
01c5692deeb7e790d4f8a7d8245f998c

SHA1
2411c32c8e3aceb7941f3ae9a4284f49e6bd2257

SHA256
b69b406373e4ec52be54ed096048ac831115fb4d913d2e263d8d5c356034ac91

SHA512
6d7b9a89af4fcffce8101b03ab3aa694da4fd50784952a277d4d15c6b9052c3edd35e14e2d0782dc3648dcb2188ae62300b4bf34fe155a89aec2a5099cf92ec4

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
74B

MD5
73a465dadf426a1816e6124332dbbe2a

SHA1
9016ee293d948b12d364e9eeccf7eec06a1aa032

SHA256
60ebfbe19e0b00485e81b7fa15d8988ac37bc2cdfd734311d3ee4b24f562a8bd

SHA512
e55d2a34a093562bf8cf9d051dcb7b1bdf459a86cdfde578ece91f76ec18f7fd1007db5c93dcd9864fb97dd7d5d7581ec6bbfb0d0e867e04290bf434935725f6

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt~RFe57bcf7.TMP

Filesize
138B

MD5
766e12a42b296b9ed4210ce93fce2be9

SHA1
3d6cf3757876e84989e07e1aa8a7acf76a7959b9

SHA256
2fd90bf1eafeb3f791bc4128884e7cfa8b9c22d71918a8dcd707b5e6b6be43c3

SHA512
8d967b380c2d629c2e3148ec931f5ff5d886605d6db42abb40c189e933a8464067108375cf862b1df0d7607e4023424f010a0723381d827f78bc056fb014eec6

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
92a5e680af61012716248f49ffbd8678

SHA1
dd1522341a4890466acd5faacfd65cb762bf559f

SHA256
9e85d39488de2f5b8c6ef253c7c0adae9d165edec2ab75c17c65a39fff8f1d53

SHA512
f7ef275927e6fe5f7bb85aeec0ac9139a1d961be4b00e911947e0d874652a8af56b2a69ede117337fa45b0aec923173290365f9bd22f2599d0685bfee103ba6d

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Service Worker\ScriptCache\index-dir\the-real-index~RFe589edb.TMP

Filesize
48B

MD5
4cdd0bb35bc6069e2705a99b10c1be48

SHA1
226b83982d3e5ba37823c2f947116b7b11056bbf

SHA256
213535a1ddac8aba2dd82598a5c89d7fa77bbf6ea82e7a83df83a286f692e328

SHA512
37c36a538738c1e520810bbb2145931f8431b5975c89ae83a20377f86c6899fa2d2d2726acdfc274efe7c45f2548ad339ae24bf3bac58a41a8555da7c5174551

Download Submit
C:\Users\Admin\AppData\Roaming\DuoHacker\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\d3dcompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\ffmpeg.dll

Filesize
2.6MB

MD5
2438f9abea41a6fe835c197f22eac825

SHA1
33d0e0091b3fa82d688d11af0f0f29b38d6ec16b

SHA256
7922878b04d21b883d28da17316f3b174f35335a2820d504f7ac91458d2e9cac

SHA512
d8bfb20be316ba19c06d13ea981839c034ddbfccfa23e55be431904f5fc88646f2c169a531085b29b8dd69c2257703dff3f28fa26cd7d2d6d692edf1aa221307

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\libEGL.dll

Filesize
464KB

MD5
bae33873ea0db05ea5555f53ebb19a9c

SHA1
070af32bcfebe55e66db75e1f7b3ce3cfe67c3e4

SHA256
fc2cc4deec921ffba6e1165d569d0df4209722524aaa21e78e5e1de2ca922ac0

SHA512
a7037350365ca3cd41115d332a9ea4daaa22206cb6b6670092af7e1da2f341d499f1961a31c01b2955bb28c0a178abe8dc942dec144db765dbb9129560e42d0f

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\libGLESv2.dll

Filesize
7.0MB

MD5
cbd65f2853517cba2dbe6628223d9863

SHA1
2b5efd10aa1ef64fee1cd7ac0b21762b6f1b4e87

SHA256
8b6a54b72ec42f94072cad21911950014553e11fedc1573c11b3c233eadb0dbf

SHA512
75d8cccfe8921f9931b8f0e6a2a82f4162fc3d9be66f1556cf4857a48595f9820ae4b46e150d642ee27f327a31eb04445edc07e49e9333221a1ce77575224b21

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\vk_swiftshader.dll

Filesize
4.8MB

MD5
7d637d9f1015835d99639fd6950f548e

SHA1
9591104b23f46b0723deed596bcd16e2f31b3ac9

SHA256
44d2d6927607355dddd923bed2025edcf368fe9daabedcee2b6894e0c34f6825

SHA512
c218221c8900d7a45d97736764a0864f060c26b76562ddb65bc2dd0452291cbd89c24191dc80ee71451f26826c0b5f1d0002e016740b127ce31f1ebfef31d3dc

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\vk_swiftshader.dll

Filesize
4.8MB

MD5
7d637d9f1015835d99639fd6950f548e

SHA1
9591104b23f46b0723deed596bcd16e2f31b3ac9

SHA256
44d2d6927607355dddd923bed2025edcf368fe9daabedcee2b6894e0c34f6825

SHA512
c218221c8900d7a45d97736764a0864f060c26b76562ddb65bc2dd0452291cbd89c24191dc80ee71451f26826c0b5f1d0002e016740b127ce31f1ebfef31d3dc

Download Submit
\Users\Admin\AppData\Local\Programs\DuoHacker\vulkan-1.dll

Filesize
858KB

MD5
e3b0249d0209585230ed299bb7a154a1

SHA1
1fc4d66ed099314be664eb80fad3834328697638

SHA256
a4df19cda9cba76e6ef085b7bc693c4237178b29be77a40172d534b6f17bd691

SHA512
cbe6fdd299112d0141bc73a334fdc5273f70c906176ab37791c1fee1d177c38cb7b9b5b01f04039b5a96afa75cb5d645fbcee4724a291d0921a9f12fded2c449

Download Submit
\Users\Admin\AppData\Local\Temp\nst84C6.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
\Users\Admin\AppData\Local\Temp\nst84C6.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nst84C6.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nst84C6.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nst84C6.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nst84C6.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/524-1049-0x000002C3B2790000-0x000002C3B28DA000-memory.dmp

Filesize
1.3MB

Download
memory/524-1039-0x000002C3B28E0000-0x000002C3B28E1000-memory.dmp

Filesize
4KB

Download
memory/656-857-0x00007FFE9C9E0000-0x00007FFE9C9E1000-memory.dmp

Filesize
4KB

Download
memory/688-1019-0x000001BC4C0E0000-0x000001BC4C22A000-memory.dmp

Filesize
1.3MB

Download
memory/688-1007-0x000001BC4C230000-0x000001BC4C231000-memory.dmp

Filesize
4KB

Download
memory/880-1273-0x0000021972200000-0x000002197234A000-memory.dmp

Filesize
1.3MB

Download
memory/880-1255-0x0000021972350000-0x0000021972351000-memory.dmp

Filesize
4KB

Download
memory/880-1254-0x0000021972330000-0x0000021972331000-memory.dmp

Filesize
4KB

Download
memory/2612-1148-0x000001A317C90000-0x000001A317C91000-memory.dmp

Filesize
4KB

Download
memory/2612-1202-0x000001A317B40000-0x000001A317C8A000-memory.dmp

Filesize
1.3MB

Download
memory/3996-939-0x000001F56A420000-0x000001F56A421000-memory.dmp

Filesize
4KB

Download
memory/3996-959-0x000001F56A2D0000-0x000001F56A41A000-memory.dmp

Filesize
1.3MB

Download
memory/4064-916-0x000001DE63740000-0x000001DE63741000-memory.dmp

Filesize
4KB

Download
memory/4064-915-0x00007FFE9C640000-0x00007FFE9C641000-memory.dmp

Filesize
4KB

Download
memory/4064-923-0x000001DE635F0000-0x000001DE6373A000-memory.dmp

Filesize
1.3MB

Download
memory/4924-1086-0x0000018F11430000-0x0000018F1157A000-memory.dmp

Filesize
1.3MB

Download
memory/4924-1056-0x0000018F11580000-0x0000018F11581000-memory.dmp

Filesize
4KB

Download