b9de87c8bd0efcc03531260deb5f64bd580281249ef9496507e22e43aea115d0

Resubmissions

13/06/2023, 15:30

230613-sxrf7ahc7y 8

Analysis

max time kernel
111s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20230221-es
resource tags

arch:x64arch:x86image:win10v2004-20230221-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
13/06/2023, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CurseForge Windows - Installer.exe
Size

2.0MB
MD5

165679e68cb4426b58aeeb833e346614
SHA1

c48670aeed67584b7f64de3563edd8c3f7404e5a
SHA256

b9de87c8bd0efcc03531260deb5f64bd580281249ef9496507e22e43aea115d0
SHA512

1fc3c05ef36647e1c6a65419c86507064db96c1dfcb5384a23218d12a616e803875667aa68bc4be7000c86fdf094e92691cb9d7199db37fce331227927ea9d25
SSDEEP

49152:5h07xE87vxpsrFpIvgV7Rlh4TrAzPY/sZYQjLRUc:5h01PN+TIvWOyw/dMC

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	Curse.Agent.Host.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	CurseForge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	OWinstaller.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 12 IoCs

pid	Process
1976	OWinstaller.exe
4372	ow-electron-setup.exe
728	CurseForge.exe
652	CurseForge.exe
1324	CurseForge.exe
3768	CurseForge.exe
4304	CurseForge.exe
1872	CurseForge.exe
5908	CurseForge.exe
5184	CurseForge.exe
2840	Curse.Agent.Host.exe
5360	CurseForge.exe

Loads dropped DLL 33 IoCs

pid	Process
2856	CurseForge Windows - Installer.exe
2856	CurseForge Windows - Installer.exe
2856	CurseForge Windows - Installer.exe
2856	CurseForge Windows - Installer.exe
2856	CurseForge Windows - Installer.exe
1976	OWinstaller.exe
1976	OWinstaller.exe
1976	OWinstaller.exe
1976	OWinstaller.exe
4372	ow-electron-setup.exe
4372	ow-electron-setup.exe
4372	ow-electron-setup.exe
4372	ow-electron-setup.exe
4372	ow-electron-setup.exe
4372	ow-electron-setup.exe
4372	ow-electron-setup.exe
4372	ow-electron-setup.exe
4372	ow-electron-setup.exe
728	CurseForge.exe
652	CurseForge.exe
3768	CurseForge.exe
652	CurseForge.exe
1324	CurseForge.exe
1324	CurseForge.exe
1324	CurseForge.exe
1324	CurseForge.exe
1324	CurseForge.exe
1324	CurseForge.exe
4304	CurseForge.exe
1872	CurseForge.exe
5908	CurseForge.exe
5184	CurseForge.exe
5360	CurseForge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	CurseForge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	CurseForge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CurseForge.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4404	tasklist.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\curseforge\shell	CurseForge.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\curseforge\shell\open	CurseForge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\curseforge\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\CurseForge Windows\\CurseForge.exe\" \"%1\""	CurseForge.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\curseforge	CurseForge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\curseforge\URL Protocol	CurseForge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\curseforge\ = "URL:curseforge"	CurseForge.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\curseforge\shell\open\command	CurseForge.exe

Modifies system certificate store 2 TTPs 16 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	CurseForge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CurseForge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 5c0000000100000004000000000800001900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d040000000100000010000000410352dc0ff7501b16f0028eba6f45c520000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	CurseForge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	CurseForge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CurseForge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	CurseForge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	CurseForge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	CurseForge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	CurseForge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	CurseForge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	CurseForge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	CurseForge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CurseForge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	CurseForge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CurseForge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	CurseForge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1976	OWinstaller.exe
1976	OWinstaller.exe
4372	ow-electron-setup.exe
4372	ow-electron-setup.exe
4404	tasklist.exe
4404	tasklist.exe
2840	Curse.Agent.Host.exe
2840	Curse.Agent.Host.exe
2840	Curse.Agent.Host.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	OWinstaller.exe
Token: SeDebugPrivilege	4404	tasklist.exe
Token: SeSecurityPrivilege	4372	ow-electron-setup.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: 33	5388	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5388	AUDIODG.EXE
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe
Token: SeDebugPrivilege	2840	Curse.Agent.Host.exe
Token: SeShutdownPrivilege	728	CurseForge.exe
Token: SeCreatePagefilePrivilege	728	CurseForge.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1976	OWinstaller.exe
728	CurseForge.exe
728	CurseForge.exe
728	CurseForge.exe
728	CurseForge.exe
728	CurseForge.exe
728	CurseForge.exe
728	CurseForge.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
728	CurseForge.exe
728	CurseForge.exe
728	CurseForge.exe
728	CurseForge.exe
728	CurseForge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1976	OWinstaller.exe
1976	OWinstaller.exe
1976	OWinstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 1976	2856	CurseForge Windows - Installer.exe	85
PID 2856 wrote to memory of 1976	2856	CurseForge Windows - Installer.exe	85
PID 1976 wrote to memory of 4372	1976	OWinstaller.exe	95
PID 1976 wrote to memory of 4372	1976	OWinstaller.exe	95
PID 1976 wrote to memory of 4372	1976	OWinstaller.exe	95
PID 4372 wrote to memory of 2300	4372	ow-electron-setup.exe	96
PID 4372 wrote to memory of 2300	4372	ow-electron-setup.exe	96
PID 4372 wrote to memory of 2300	4372	ow-electron-setup.exe	96
PID 2300 wrote to memory of 4404	2300	cmd.exe	98
PID 2300 wrote to memory of 4404	2300	cmd.exe	98
PID 2300 wrote to memory of 4404	2300	cmd.exe	98
PID 2300 wrote to memory of 4348	2300	cmd.exe	99
PID 2300 wrote to memory of 4348	2300	cmd.exe	99
PID 2300 wrote to memory of 4348	2300	cmd.exe	99
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 652	728	CurseForge.exe	104
PID 728 wrote to memory of 652	728	CurseForge.exe	104
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 1324	728	CurseForge.exe	103
PID 728 wrote to memory of 3768	728	CurseForge.exe	105
PID 728 wrote to memory of 3768	728	CurseForge.exe	105
PID 728 wrote to memory of 4304	728	CurseForge.exe	106
PID 728 wrote to memory of 4304	728	CurseForge.exe	106
PID 728 wrote to memory of 4304	728	CurseForge.exe	106
PID 728 wrote to memory of 4304	728	CurseForge.exe	106
PID 728 wrote to memory of 4304	728	CurseForge.exe	106
PID 728 wrote to memory of 4304	728	CurseForge.exe	106
PID 728 wrote to memory of 4304	728	CurseForge.exe	106

C:\Users\Admin\AppData\Local\Temp\CurseForge Windows - Installer.exe
"C:\Users\Admin\AppData\Local\Temp\CurseForge Windows - Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\OWinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\OWinstaller.exe" Sel=0&Extension=cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm&Name=CurseForge%20Windows&Referer=www.curseforge.com&Browser=opera -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm -AllowWindowsInsider --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --auto-close --silent-setup --app-name="Curseforge" -exepath C:\Users\Admin\AppData\Local\Temp\CurseForge Windows - Installer.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\ow-electron-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\ow-electron-setup.exe" /S --force-run /d="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq CurseForge.exe" | %SYSTEMROOT%\System32\find.exe "CurseForge.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq CurseForge.exe"
        5⤵
        Enumerates processes with tasklist
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4404
    - - C:\Windows\SysWOW64\find.exe
        
        C:\Windows\System32\find.exe "CurseForge.exe"
        5⤵
        
        PID:4348

C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
"C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:728
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1728,i,10469320344576538881,8544555016158367403,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1324
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=cs --cs-app=CurseForge
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:652
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes --bypasscsp-schemes=owepm --cors-schemes --fetch-schemes=owepm --service-worker-schemes --streaming-schemes=owepm --mojo-platform-channel-handle=1804 --field-trial-handle=1728,i,10469320344576538881,8544555016158367403,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3768
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes --bypasscsp-schemes=owepm --cors-schemes --fetch-schemes=owepm --service-worker-schemes --streaming-schemes=owepm --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --enable-sandbox --first-renderer-process --lang=es --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2456 --field-trial-handle=1728,i,10469320344576538881,8544555016158367403,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand disableSentry=false /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4304
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes --bypasscsp-schemes=owepm --cors-schemes --fetch-schemes=owepm --service-worker-schemes --streaming-schemes=owepm --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3468 --field-trial-handle=1728,i,10469320344576538881,8544555016158367403,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --uid=cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --muid=7669410e-8e67-41c6-8402-7b5abeec199f --phase=96 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:5760
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5832
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes --bypasscsp-schemes=owepm --cors-schemes --fetch-schemes=owepm --service-worker-schemes --streaming-schemes=owepm --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3508 --field-trial-handle=1728,i,10469320344576538881,8544555016158367403,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5908
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes --bypasscsp-schemes=owepm --cors-schemes --fetch-schemes=owepm --service-worker-schemes --streaming-schemes=owepm --mojo-platform-channel-handle=3596 --field-trial-handle=1728,i,10469320344576538881,8544555016158367403,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:5180
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:3332
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:5228
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:796
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:4480
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5060
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar.unpacked\plugins\curse\win\Curse.Agent.Host.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar.unpacked\plugins\curse\win\Curse.Agent.Host.exe" --port=65407 --to-port=65427 --pid=728 --appDataPath=C:\Users\Admin\AppData\Roaming\CurseForge --clientId=Overwolf
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:3360
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:6112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:6060
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:4036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:5256
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:5364
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:5224
- C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe
  "C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\CurseForge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CurseForge" --standard-schemes=owepm --secure-schemes --bypasscsp-schemes=owepm --cors-schemes --fetch-schemes=owepm --service-worker-schemes --streaming-schemes=owepm --app-path="C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3456 --field-trial-handle=1728,i,10469320344576538881,8544555016158367403,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5360

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c0 0x3c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\fonts[1].css

Filesize
2KB

MD5
c5a6e21d20976d6450088edc3316188f

SHA1
45d0a70e411403531c462ea8639afea35a48f7dd

SHA256
feda76e4c54c75b9258d2c37fc1e253792cf40d4c857cd9e9ea9342bdda3fd2e

SHA512
8dbdd656746acc1060469d7a6022927b977b74c99dec8c32b2e77477d23a04cda0fff20a5c21ca2651a61e3594eedd2466a9bd717d5aec03cc19804bdb725008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\style[1].css

Filesize
1KB

MD5
e023da8680e512fe7145360c08fadb4f

SHA1
a9e9025e74d8f349a2a374c9a9df10a0839890a3

SHA256
ff236d60366c4c9ef2df6f8bd2d48f8dc7aadb34851936ef68730d15159b706a

SHA512
0c58ec571b046b31c3fee2a6d5a204cf41b944fa38f6d3e25946dc7ad0204cab73d09ed76d4e965d5f063fd66ae2fafb7ea0020fd11182f4c5e92459210d1e7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\block_inputs[1].js

Filesize
281B

MD5
78958110509900367e8bd8f6fe554e70

SHA1
7559eccda81669fee7a06b4ec54a22a672d8c64c

SHA256
b2a763b225eee36970d4525500d538ed2efb00cfb2fed01b13ccc4d98beeab57

SHA512
7662859b3b5cd3713293118c101d6afa0017924ac49e731f8b80b9fa938021257b4fe04befd6b810c10cd4420fe5c611ef4167b7d4d028593abf59d588dbb0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\index[1].htm

Filesize
2KB

MD5
a30bf826425658f805cccb5242ae257b

SHA1
15352de3b99275a2fe6c6d40ad4fd616bd42e000

SHA256
9c6482700b5560798e7e414d03e39f393ecc2899917dbac3eb47aa35fafcd957

SHA512
97dc15d32aeaa1c66cf1b13f84b6fa4254afb4604ac13604841c45ac5f5579db0c298c067a1d70c4f4e3be3dc18ca9b7e37a4139e91bf201d33ba5c3320cea72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\jquery-1.10.2.min[1].js

Filesize
90KB

MD5
44e3f0db3e4ab6fedc5758c05cf27591

SHA1
2d408aa1d35661019c95adcc60b78c0727ed25b4

SHA256
bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144

SHA512
4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\reset[1].css

Filesize
460B

MD5
4ebcc1d4f99cd574bb79eec4264779e5

SHA1
3cde690248ac2890d2e302bc24d6dabdf47e3ba7

SHA256
99c76c11b75bd34f2396496b8150dbce2b8170cd5a84ac815c1cdc16d908634a

SHA512
4ef5d89fd1e64805bb2dc2716998abadfedf87c820b65811b60fc94aaeeef17adc9fa3a2024d37eac83a9ec0d606626f1dca33e387e77d312e78bbbb2ae971de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\progress[1].css

Filesize
1KB

MD5
dcdca2c926c187de04accd16248edc42

SHA1
c97cccbd696d04b5d46ba0c9f09aa7bc6dfc2b06

SHA256
f46e3436ebd7b0e6a8d954902352f7d3c1f9204148ba52f149c6f864b4eac8cf

SHA512
532675fe7a57dbf4016aebdb176824705930b1ee15575cf8ac39664b097e69a19c709d2bdb230f27c96f9b43ad7b1fa9e171d67d1558899bdb2877c4aaba6c87

Download Submit
C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml

Filesize
752B

MD5
d2bd3b03c242a052ea9edf7ac86626f0

SHA1
509c78a50c38c1904a5f0d99d527799a76c87f7c

SHA256
68708c02b482317eeaca861ea369a6c957cb8c2d8635474c88bfd1b4d08b89ea

SHA512
0fd5fbf3ac8f99f1e31d384a2d2917dd791b54170618c867f096e32621e9096db3a3908bf3f0909890252a6b768f5489b9c246ea2386404bd4383d89cfe7db67

Download Submit
C:\Users\Admin\AppData\Local\Programs\CurseForge Windows\chrome_100_percent.pak

Filesize
126KB

MD5
d31f3439e2a3f7bee4ddd26f46a2b83f

SHA1
c5a26f86eb119ae364c5bf707bebed7e871fc214

SHA256
9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e

SHA512
aa27c97bf5581eb3f5e88f112df8bfb6a5283ce44eb13fbc41855008f84fb5b111dfe0616c310c3642b7f8ac99623d7c217aecc353f54f4d8f7042840099abc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\CommandLine.dll

Filesize
68KB

MD5
77eecb33d25e45b3f66aea548fe0e0b4

SHA1
c12762c606398ab74a80bd7ff2af487b8c31f81a

SHA256
2d8c7e423c65325e4d170d3762eaad3ae36dbdf1a92b8b87b6f6e6f5c0e7a978

SHA512
b6b73dae952cbb6be2ee8f278d12120e8b83320a7b041110913000f74dcb75c7fe73d54c54af6d70e25145ed8f9d5c3dfdc13a64ffd09b1758f93f6f6a1f8f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\Newtonsoft.Json.dll

Filesize
692KB

MD5
98cbb64f074dc600b23a2ee1a0f46448

SHA1
c5e5ec666eeb51ec15d69d27685fe50148893e34

SHA256
7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13

SHA512
eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\OWInstaller.exe

Filesize
325KB

MD5
96364dbfbf752c978b8d9a585bb22967

SHA1
804672777a9cfb4c50509eb9e556589494638fb8

SHA256
0449ae496aa3c81f0efb4c100f5b920858fe39f28fd0439b086ed6eb25b20959

SHA512
aa930a3d1da192992640669edea3beb9896a81535f80da852b7eaa8bcb86113de6c930bdc1f299c1dc99e7da860527da3c919fe9d41547357413ca8ef7c22248

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\OWInstaller.exe

Filesize
325KB

MD5
96364dbfbf752c978b8d9a585bb22967

SHA1
804672777a9cfb4c50509eb9e556589494638fb8

SHA256
0449ae496aa3c81f0efb4c100f5b920858fe39f28fd0439b086ed6eb25b20959

SHA512
aa930a3d1da192992640669edea3beb9896a81535f80da852b7eaa8bcb86113de6c930bdc1f299c1dc99e7da860527da3c919fe9d41547357413ca8ef7c22248

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\OWInstaller.exe

Filesize
325KB

MD5
96364dbfbf752c978b8d9a585bb22967

SHA1
804672777a9cfb4c50509eb9e556589494638fb8

SHA256
0449ae496aa3c81f0efb4c100f5b920858fe39f28fd0439b086ed6eb25b20959

SHA512
aa930a3d1da192992640669edea3beb9896a81535f80da852b7eaa8bcb86113de6c930bdc1f299c1dc99e7da860527da3c919fe9d41547357413ca8ef7c22248

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\OWinstaller.exe

Filesize
325KB

MD5
96364dbfbf752c978b8d9a585bb22967

SHA1
804672777a9cfb4c50509eb9e556589494638fb8

SHA256
0449ae496aa3c81f0efb4c100f5b920858fe39f28fd0439b086ed6eb25b20959

SHA512
aa930a3d1da192992640669edea3beb9896a81535f80da852b7eaa8bcb86113de6c930bdc1f299c1dc99e7da860527da3c919fe9d41547357413ca8ef7c22248

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\OWinstaller.exe.config

Filesize
632B

MD5
82d22e4e19e27e306317513b9bfa70ff

SHA1
ff3c7dd06b7fff9c12b1beaf0ca32517710ac161

SHA256
272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827

SHA512
b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\OverWolf.Client.CommonUtils.dll

Filesize
576KB

MD5
ba5b3f5dfaeebb84a8b53a3042f71e97

SHA1
178c530ad88a12036f07b96f85c497a201a50c96

SHA256
2c7a781c465d59b55847c9879b229f40dbb3f3c049c3cbe7b2a59db42ace8a15

SHA512
e5f6022621c1504b8268832752459f0fafd01c8e19e1691b2992f046c58cbbc77f24514491ae64265e42e3017cde99b348e9ab859995b020ba06d2db373b2472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\OverWolf.Client.CommonUtils.dll

Filesize
576KB

MD5
ba5b3f5dfaeebb84a8b53a3042f71e97

SHA1
178c530ad88a12036f07b96f85c497a201a50c96

SHA256
2c7a781c465d59b55847c9879b229f40dbb3f3c049c3cbe7b2a59db42ace8a15

SHA512
e5f6022621c1504b8268832752459f0fafd01c8e19e1691b2992f046c58cbbc77f24514491ae64265e42e3017cde99b348e9ab859995b020ba06d2db373b2472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\OverWolf.Client.CommonUtils.dll

Filesize
576KB

MD5
ba5b3f5dfaeebb84a8b53a3042f71e97

SHA1
178c530ad88a12036f07b96f85c497a201a50c96

SHA256
2c7a781c465d59b55847c9879b229f40dbb3f3c049c3cbe7b2a59db42ace8a15

SHA512
e5f6022621c1504b8268832752459f0fafd01c8e19e1691b2992f046c58cbbc77f24514491ae64265e42e3017cde99b348e9ab859995b020ba06d2db373b2472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\SharpRaven.dll

Filesize
80KB

MD5
42fcbc407c2019d4f2887935f1c1ca27

SHA1
1ffa364fed6c1d0d4da323267c7b3f9d5ca327a3

SHA256
ea5d4141a5deaacc3eccd327159ebe32f31d837121146dfc1e7a0f1999f9174b

SHA512
bac6462a5b1ce4313dbc467fb05f0f984c34caf164f61d91b8f8d61bdce0a01c41eac9ba6e3526e8641389198c6154222036b6fc74e547494c8917d109ec3da3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\UserInfo.dll

Filesize
4KB

MD5
9301577ff4d229347fe33259b43ef3b2

SHA1
5e39eb4f99920005a4b2303c8089d77f589c133d

SHA256
090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc

SHA512
77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\_locales\es\messages.json

Filesize
11KB

MD5
494ae00495d1b528be0536ef26436449

SHA1
2335325b094a221a81de09725e6defd36a39ed9d

SHA256
8c200e8e47aef4609324ceb084a08f4d0d928236de30f83a4aef6c0df94dd67c

SHA512
37d98ca09802c1cab77d372ed6b2a34d1acd2f803e41c747c3c1ab518b205de7c6e5ba8ffcfa941e9cee7f62bc8ef04ce0282ac95e97fa1e03bbb0a3ba710da2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\assets\fonts\lato\LatoLatin-Regular.eot

Filesize
66KB

MD5
6cfad5881181ae658a6efdd68889a690

SHA1
5b54f6ccc20ed3a078fbdf94d7a68ac80002624d

SHA256
c6c970b103b3c3aa83f7a45172619a4451ea5f015f9f3ef4fd08c9a4aa895cbc

SHA512
ddd3d43540eb3d4eef48d0834136de1e7bf23a52f286d0a666cf57c7d685aadf1cea6d37c88f9d7ce5ad6143d7c3213f54b16a11f616b7dce154bba50997bbe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\images\bottom-arrow-hover.png

Filesize
294B

MD5
f5d76b21fcab6cc89fd0ebc1089c2c26

SHA1
160645c02dcfdcd4d6d6a8339557a62b80493e40

SHA256
3b8043e64994a53126afe1250b80fa2934196c3305bf93fd3e7a6963867a6eb9

SHA512
4c4fd737cd771e8e0c025295c598aeb4ffb2d20df10658f7cb992aa49b4817be5d291c0c6530b4e9aaa241ab76df3c52e01a40a505e7b60d1d968a96fd4de991

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\images\bottom-arrow.png

Filesize
279B

MD5
847fab99890ddd7460e758ad8d463ba9

SHA1
bdf8c1e45993ee33ee0bf9a2e43d6048df71cb8a

SHA256
46bfb08af2269108c681b78373c98e899b4234adce39394322c7dfd6d40dcdac

SHA512
0bd2075c61eafc2946a9431bd4fbbbb141f3743144782376874640e4aae1ee97a05844589661b3a0912b23dacdf57e0a667d8ffa8ccd0f4358e5802e653aef1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\images\checkbox-checked.png

Filesize
321B

MD5
6067f0ee8d785e960b2fa9e68b9f5321

SHA1
ac42da8bc80746f4ae2288c65562105fe6da05e6

SHA256
deb8825e21f9f0153bd769de7e8537c52df5bdda35c32a2e610078f8f0445581

SHA512
b8befca32779fc1cfa245bb8e0c9b43bcd932550f1f518766d2946e1b18aa8a634e240627839c646c87c19c8a9ed5a7790cd1799835c5c3dd1d1c4f1043f43a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\images\close-hover.png

Filesize
399B

MD5
5b691eb1c6836563447358b108bc9f39

SHA1
14104e60754aa46034effcbdf21af44e13f3c4cb

SHA256
aaad22634eed5977eb3a690652f16f4efda3143dfb0c165cd391bd862de6eef0

SHA512
d239bba8ce1c22dcf6d8c830614c158290b1fd9f684f7eda86e959f5cfa86cc572fa01711e0d0850f48e13c654a9e69675d83148a3bf22f64de91f7a51eaa124

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\images\close-normal.png

Filesize
330B

MD5
1acb62ec3fa5a82347c330512f2259d6

SHA1
c81389f19687e791bc4ada896620b17471371c04

SHA256
e8bd82cb680ae552f587a3f0bdc1df18fc7624dffec501840cc508d327baeec3

SHA512
a6693f68c41f8a7c137f3129403b14144329c132b99956ff2c1cc5317b046eaec70aef82c7c05b9220c3c3a7f2a417718fb65bbbe486250c05191778456f602a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\images\icon.ico

Filesize
34KB

MD5
2d76837971d64e5ad529ddf8b03820b0

SHA1
1ac4cf8f20905f6bb109c4c7e8cdf3b7cafcbb3c

SHA256
2b0767136e971cbc99daf157675af67cc997852d996ea01d0dc2aa482959aa00

SHA512
50fd1c547da87d26b54432ee8e773d33e7297e6af3e0d02f62b97d0aebaee2d603ea9c69c03d76339649dc61a87ff78ebb0ce5ca8570282a0015a7dd1a40d236

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\images\minimize-hover.png

Filesize
171B

MD5
f4b8851b9ef5a55b0d45392baceb31fb

SHA1
03a87a04dc75579a8568543d40db963b6e9f4051

SHA256
d84b877f7a2d601b1d71cf878b33ff78c94c2d144a0f4d72436a7dcf64e712c2

SHA512
a849659d4ba4e40b924108cd567a58f4b1569afc5c7517a10c26fd6d64422fa61812683292da1c3b19dbe91c63aacd5cd1c5b342ccce98b6815e94b55767ce4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\images\minimize-normal.png

Filesize
150B

MD5
1bcfd10e50ab56ac335a463ec19b8d33

SHA1
b5054dd1cdd714a6771bc11e43291df361a16ccc

SHA256
aa2b021cd0dd9563705503dad48866eac926c7ace608ff8d00f755afc509f39b

SHA512
7257c401db826ed1f4a549b1b899d0fb4a5bcc3c599ced49b07a64fc308b08fb208dc378a32d9c3cd193b4d603ae76f82bb297334998ca6abb790081a5467edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\index.html

Filesize
18KB

MD5
d367bf95bb13abbb839927ef76618253

SHA1
95b95767ec022a74f4c9a6b74895557439817ac9

SHA256
a7db7133613735b6b5c96d4ee3eb8a1630ee783dd41a81260f2461a66c3728d8

SHA512
98fa35e39b3dc54d410c7b4af0efe31845e195473843d2ce0e25ad4b892784a2fba6a9e99964b47a4c3c1d49bc9e839c210a73c7cc788643ef36abe8a1966952

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\app.js

Filesize
21KB

MD5
7c15ecdc0a6c4894af1ebf28e32aed6f

SHA1
db55a0d8935fb49b9be45da4bb4ee88a5277b7db

SHA256
5e67c50e827ad0e651d58646ffeae6a22d6c048e34e33b5e8f1fa98a21f40eab

SHA512
792a28a59330c60f8769d46eb32d1e0c0ff25b27b338288eb6c6e4c7278d3c4dacd44d58bf8c5006e4b8fa5dc313ee23581d0c33e2b0696632dafd7223893472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\block_inputs.js

Filesize
789B

MD5
b5b52c92b90f4283a761cb8a40860c75

SHA1
7212e7e566795017e179e7b9c9bf223b0cdb9ec2

SHA256
f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544

SHA512
16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\libs\cmp.bundle.js

Filesize
296KB

MD5
c3dbbd4cfe15de60c8c3606ddf9c8784

SHA1
ef44afa8b6fb172b04aa62242b78d90b7ff34a3f

SHA256
a1d99c498fb84e20aeffcb22e7b473fa88e2909f2b9eacdc63d8e09aa56b5aec

SHA512
849a71028e2db8a14178c14c05de413d23282fa49b59befddbc5279d203f27e0d2b21ee9ef43d0aa15b2c81c17d42301d52760c894b9f7ee78ddad258f31a5f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\libs\jquery-1.10.2.min.js

Filesize
90KB

MD5
44e3f0db3e4ab6fedc5758c05cf27591

SHA1
2d408aa1d35661019c95adcc60b78c0727ed25b4

SHA256
bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144

SHA512
4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\libs\mixpanel.js

Filesize
1KB

MD5
344e4265b3d4e1fecfd81c561293edab

SHA1
51dbcac23b839e64362d11763bbe64538ad80bb8

SHA256
88872b5b01a8d1dfee124333aba630ceb8535390130833dd2a312c461ac52217

SHA512
dcda17cb89861c4cd0be4b7cd93b58283cd1acc3c7a4a2176add3ea6403079c8567bcf88d878aa2e91e96c43b15a7ce668299c3d015c6dc4db5b15cddbe4ea7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\models\notifications.js

Filesize
4KB

MD5
a94dbd9bd18433d3bdc6c9efa61cba7e

SHA1
16260be72ae3101010b34b7f721edb72d0550dbf

SHA256
4eb5c8f6679df6f4a23455fe20230e1dac155324709dc8e5cb97b7ede46614bc

SHA512
6ea99466ad1252d203ba4c9a13baf6874b5603422676036aac9a03d4145529747e35b9819ce5fc35182fca78985daa4856c1d621be566b5e86e3e161135b6b61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\utils\analytics.js

Filesize
3KB

MD5
00da91079bba7d8b219376f9a9b20961

SHA1
fcaeffa5cc73a667c8ef69442ba62964fddeba5a

SHA256
15f8b8bd605296723e1322465f220e173c750da0745bdf39ec400ab6215c28c7

SHA512
d906ae32a0e2d5b65a030ac6a20a95bdba63cb86ded7d48a6f9d809fe000631c309eb81a5445fa68b45e16f06fe5d282827c026208429297f78be1e7d9ed9961

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\utils\commands.js

Filesize
12KB

MD5
8077c868435c2ab49cc70683489d229b

SHA1
31dfe51f87ec33073b2209e60de7ecd647007c7b

SHA256
72947e14b9e17653b7557c7083a39e453d05f3ef529ddab77c6d6099a95cc881

SHA512
a9f0247a0e1242c02928567f5e9d71564af930446a2be9bcaf51b415a4d30e3a064b1bcaf2c7115a268b01597f2b57905f49f42bd1989398213c262abbafe2ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\utils\cookies.js

Filesize
1KB

MD5
6c60e675f8c8c68c0174b644d3a63a2a

SHA1
3635a3fe07ccc4a6f33a986ddb690522d0611abb

SHA256
9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287

SHA512
1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\utils\modal-events-delegate.js

Filesize
1KB

MD5
117e4fdbdb0ecf211c8bd909efd337d1

SHA1
9f8684d856b7c95bdffb139217dfd89f41373187

SHA256
267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857

SHA512
f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\utils\strings-loader.js

Filesize
5KB

MD5
9c94eb933d8a43dd3825e67a7e30c980

SHA1
7ec7b16af6f399219209ba5967d377040486a11b

SHA256
96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf

SHA512
a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\utils\utils.js

Filesize
118B

MD5
a0952ebeab701c05c75710c33d725e7e

SHA1
1da8a2e889f1213d481ae3cd5571670c01e64adc

SHA256
b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246

SHA512
5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\cri\cri-controller.js

Filesize
5KB

MD5
d222c95a2ef0b75ad6c96a3abe20fdc5

SHA1
641c39f92a169f0ca435ed12d2a4d276eb415642

SHA256
aafb56625ec30b24035baafff7bc20215e8ec7e4be4ea58a90aa5b46bdd14a6e

SHA512
e9e66abf6d95fc15a6ffe46cf85c3c9d3b80f3884ca4c8cbb5d2b024fa1dcc46a5e2f39041a4a120a8b8b881d07b3d70b18b552332180aa08c4a67577ea6242b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\cri\template.js

Filesize
1KB

MD5
76c1ef0cb437db144c2bed53a5a8a5d7

SHA1
aaab8fff649f8e46d1e9510018118ee9abe01498

SHA256
505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e

SHA512
822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js

Filesize
1KB

MD5
01878b1f0f27ba2af34f89c648f3e16f

SHA1
b45e04411d06052772b4645d1feb7a594b722067

SHA256
4c96454e5b0493676af666aa5716ba12209aa72fb30e8dbde8e85ab000a4350a

SHA512
5a7860c8df74ad9dd2eea3bd0927dbfa1fff1de7b9a093a6d727ecc2abb7139d721cbf76c55a7ade24ade5e08e6547321a62e3a1440eb202b7a8569305dfa782

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\finish-with-recommended-app\template.js

Filesize
681B

MD5
d1cb34b57cef7e28b9286454b197b712

SHA1
f3a964b319bab82d4eda07e126bbfd6dec35c349

SHA256
b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42

SHA512
3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\finish\finish-controller.js

Filesize
2KB

MD5
cbdfd75bb47bda0ae536b3d45958b615

SHA1
9a69d440e1d8ba1976b2880964f7041c46e8bdf9

SHA256
b4221b80fbbc4ef93b3a1f668d8a3445353db9f3e1ec77c9b6520a7312ac46f9

SHA512
e78272fcd6af8656cd054c91b97508603792dcc75c4f7a123880671ff6ed126e03cd19ec13d005f655e8281a1e90f6b190be650ddf07522fa613a940148dd475

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\finish\template.js

Filesize
1KB

MD5
f092de7ea66d8e920b345f38537fa35d

SHA1
82d107a409f18878307ae0cefe24074db64937c4

SHA256
b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f

SHA512
14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\main\main-controller.js

Filesize
11KB

MD5
15b665a5c915004e1aa7e9e11a710f7e

SHA1
7821924e42bb19d60c572ff80bbaaa04d7aaeefb

SHA256
84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653

SHA512
dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\main\template.js

Filesize
3KB

MD5
a118c7724c208f12083240cafccfd10b

SHA1
f89c676a215b869626737862a08c9eb07d440211

SHA256
63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc

SHA512
9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\modal\modal-controller.js

Filesize
2KB

MD5
995aa365976d4166ec6de5fe212b0255

SHA1
0d0e8c6aabfc8c967d5af224f66045314c0564b1

SHA256
cff5f7519eb05899df67ae1d79c9318ea344b068d95b565ae8dafacb70a1c52b

SHA512
71a51e34e92e2c478397e70ade9b33e39f4fb9a6da14f04a27997dfd9149978f4d90f0cb6d35e9ede116a2f6ed7f3c6f291383ef84d10994050893c1741f3de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\privacy\privacy-controller.js

Filesize
2KB

MD5
9caf44e466f9dc19ea102980da4ae5d5

SHA1
da7e0fa627f6f3d2d9f0ec091ba19aa81e66332f

SHA256
f0b55a937f0bdc60394c4259dc226562b552a6eaaac61950fa29400200f5380a

SHA512
e88b1e18b14e0abb6f625c4210196609f8f8c001dd3ff66b1807d66113df471468d6c8548bd1af1e1f5c25faf759517c4eb93108394ff1f9abc7b36a8b6ad11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\privacy\template.js

Filesize
655B

MD5
cf8d2c26520d7c84e560dfa79e31dcd3

SHA1
716f2ec17480d5cc9c145bc147833fbfc39d36f0

SHA256
95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8

SHA512
d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\progress\progress-1-controller.js

Filesize
2KB

MD5
4bc723bda9cc718301f2533ca3196768

SHA1
7f78b74746762fd5007ea3fbce45349bb0ef7901

SHA256
164bbdea64ca671a04b91747191227a89992a34159f1578a2cbf0e16398af1ec

SHA512
920f898d1592ae8d713410ac3fb43e9d490d567f2bb70b8f8d2958a0899fb8bf6a0a735db63a8eb3e1bf2cb02be70354a0f7b92d12584b1ecbde2d5ec19f9a53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\progress\template.js

Filesize
242B

MD5
92b145e6649ba0add3dee9a69d3fa91e

SHA1
4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d

SHA256
a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab

SHA512
747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\settings\settings-controller.js

Filesize
6KB

MD5
7c30acb5d090c141185bf36c991c44ec

SHA1
59c12294a10835566e6ababc81ca6f66c0cfa984

SHA256
8928a80ed2c782ac5538cf7b2b5cbac05b5b70e03abb2e9c44cdf3061cf2f6ef

SHA512
9af7605aec15b76147060b592834568c023618ee9f1b6f375649c1a8f342476775f0b7b1fed1b015362dc481b1065a657f9a4b0aa8ae186a381acf6aef894ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\settings\template.js

Filesize
2KB

MD5
aee08bbe8994d59ce5b0fd4611968394

SHA1
3533ee4e288625aefdf5b2cd2a17494e340fa097

SHA256
91bdc29c6bee6de168cec29912e46d8bfb53a2a7c3d5082e3933eff8db887ecf

SHA512
13462812b482f5bad79260ca1ae9f11db38d32c9ca01204f5b1fb5c512e11b963d070fc2c5ab88d40e0069144d9a96eec86990e4d05b3032085607dca3bc9b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\welcome\template.js

Filesize
1KB

MD5
17f54fca6723b983875d940d931e0afb

SHA1
01774cd5cea36bd74c80a708d6f77567e8091024

SHA256
42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb

SHA512
401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\js\windows\welcome\welcome-controller.js

Filesize
2KB

MD5
6127f0a4ee214776271ea6fce1fb58e9

SHA1
378cd32ccf043889de731fce6d96b6c21632a165

SHA256
aa42af897b154c05a5a5bdf5c9420e698bc943cf1a6fcd830aae7c5b8317f654

SHA512
f2b35ced730fb95b64dd72be81345788d1fb66d38f26f2ddeb205cbecfc767703a12c455d2bb8ba1dbada1a409e123aaf020a822321b8ad80947e67c53e83a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\app\manifest.json

Filesize
691B

MD5
3a21806224b428d7edb8e5f50938aa5c

SHA1
dfe1eca9483849849bdd70a826bdb110d27de098

SHA256
8d407b22388304ec08a21c11450097343dd455155e4b6cd859c423b9d7b314fc

SHA512
d74de8210e5f52668790d549e3fd194feed9086f6839780d48cfd433724fbe89b660e86716e85ddad84b4b7a5e6d14efb7dbd4dca7c8cad1456637094e0c18f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\log4net.dll

Filesize
270KB

MD5
f15c8a9e2876568b3910189b2d493706

SHA1
32634db97e7c1705286cb1ac5ce20bc4e0ec17af

SHA256
ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309

SHA512
805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\partner-custom-asset.png

Filesize
3KB

MD5
bde9497e8dc11d5c9b79124140f354e8

SHA1
3e13607d15c1950118656d43ee957efc0f4070ce

SHA256
fcaba7c68adc0fcb328538b5e26595484f3bc9ec2a95624179c5ea86e76c35cd

SHA512
5449c92d854ebccbee129354067ab6441a06dbea267c71ec0348ebb3e17733f617319d57ace8fd3a18685c1f8e1149e6239066a65b7d04a9ceceabd683fad74c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\uac.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\uac.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\utils.dll

Filesize
55KB

MD5
aad3f2ecc74ddf65e84dcb62cf6a77cd

SHA1
1e153e0f4d7258cae75847dba32d0321864cf089

SHA256
1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8

SHA512
8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk7CC7.tmp\utils.dll

Filesize
55KB

MD5
aad3f2ecc74ddf65e84dcb62cf6a77cd

SHA1
1e153e0f4d7258cae75847dba32d0321864cf089

SHA256
1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8

SHA512
8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\CurseForge.exe

Filesize
151.4MB

MD5
5cf2ca0d9504bb442e893ae013f1a9ca

SHA1
d3d42e51fd820f0af9372c038dcfc5155d840da2

SHA256
007d7d2308409ddd79791fed862ce18c76e5a433353a3e39f2bb077870d1ee7e

SHA512
6824f987761d7824c45e7067257ec0f417a070aabfc6b05c1df5c2eb5275a022912a4754c098c3c24c3fc5eb2fdf13302673f58d7ddb970fec0640cdc53aefb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\LICENSES.chromium.html

Filesize
6.5MB

MD5
bf40c645ad5c911d2b38ab8116879ea5

SHA1
57097c913154a4a1b28fb8ba7336e0346405c16a

SHA256
a49330e0999344fa963fb301ae87a44416cc33a54584f95a5d5c2edba744e5c6

SHA512
04781eff62565694bdc378f5784258799c856175416475e44328d5e704229cfc38a4135f202da41d2e73d79835a78b79bb2979264655047f6178903901d294ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\chrome_200_percent.pak

Filesize
175KB

MD5
5604b67e3f03ab2741f910a250c91137

SHA1
a4bb15ac7914c22575f1051a29c448f215fe027f

SHA256
1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c

SHA512
5e6f875068792e862b1fc8bb7b340ac0f1f4c51e53e50be81a5af8575ca3591f4e7eb9239890178b17c5a8ff4ebb23719190d7db0bd8a9aa6dcb4308ffa9a34d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\ffmpeg.dll

Filesize
2.6MB

MD5
3c4080f202ced5c2bef89aaa62e831ac

SHA1
b89376ce5bb992b324a6ef8ee338f410f58cfc5f

SHA256
444718a88d6514a900be5de172649ad069b3bd16c04d823570d947ad24b394a4

SHA512
8045e768819cd3ccf2480b4ee8c6ea923892acefbeb78b53814831afadcc208ca0fe0a0c8d8f6aa6fd835f4cbad9e9c09f7e003e507c681751b2547bf12d17d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\icudtl.dat

Filesize
10.0MB

MD5
76bef9b8bb32e1e54fe1054c97b84a10

SHA1
05dfea2a3afeda799ab01bb7fbce628cacd596f4

SHA256
97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3

SHA512
7330df8129e7a0b7b3655498b2593321595ec29445ea193c8f473c593590f5701eb7125ff6e5cde970c54765f9565fa51c2c54af6e2127f582ab45efa7a3a0f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\libEGL.dll

Filesize
473KB

MD5
9b7988671f4eb20a61fdb77c75768950

SHA1
0c1476c9187dd35f0a64e7a1bde7ed1bb4177bf4

SHA256
8d2ababe83bebed65c7f61b365b78c063f161988293b0ad6ea8a661e684a1553

SHA512
cb4f6a833c91f697189206307d9aa81cfbd97a40e250ce9ca07ae2407e5a582ee8c6e58b334c028835f3e592531f17230cf346410948d61ab983f5293e2729b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\libGLESv2.dll

Filesize
7.2MB

MD5
c868b120eb624d3d7dcf057ffba1cb66

SHA1
6ec632069e89909579e13d36063f6b7157b5f251

SHA256
edae083380e4a5cd288c5db0716a6dbbabe7925ed3a314c725a52b8578650e55

SHA512
11fdee721f1754981791aaa780e107b293fda0b26349d87d5e0142b68ea2776d1d74e66e2e9d8352f141fb9e3994e6d95224b16148fc17a19c9fc0117be84a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\af.pak

Filesize
340KB

MD5
198092a7a82efced4d59715bd3e41703

SHA1
ac3cdfba133330fce825816b2f9579ac240dc176

SHA256
d63222c4a20fa9741f5262634cf9751f22fbb4fcd9d3138d7c8d49e0efb57fba

SHA512
590dcc02bc3411fa585321a09f2033ca1839dd67b083622be412d60683c2c086aac81a27bc56029101f6158515cc6ae4def39d3f246b7499b30d02690904af0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\am.pak

Filesize
551KB

MD5
952933d2d388683c91ee7eaa7539e625

SHA1
7a0f5a10d7d61c32577c0d027db8c66c27e56c7d

SHA256
55357baf28716a73f79ac9a6af1ae63972eb79f93c415715518027fc5c528504

SHA512
5aa5ef0ed1da98b36840389e694dc5dcef496524314b61603d0c5ee03a663bb4c753623fb400792754b51331df20ac6d9cf97c183922f19fc0072822688f988d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\ar.pak

Filesize
602KB

MD5
98f8a48892b41e64bef135b86f3d4a6c

SHA1
32f8d57ec505332f711b9203aed969704bd97bc9

SHA256
e34d5cabaed4634c672591074057c12947bc9e728004228a9e75f87829f4a48a

SHA512
6ed3fe415b2f6de24136917da870b47c653d15c7a561baae55a285946a6f75e5141aba3bc064982f99baef0a893266693864c2d603c5c22c2b95627b2035f7a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\bg.pak

Filesize
631KB

MD5
9dc95c3b9b47cc9fe5a34b2aab2d4d01

SHA1
bc19494d160e4af6abd0a10c5adbc8114d50a714

SHA256
fc4a59ea60d04b224765be4916090e97ed8ddda6b136a92a3827ed0fcc64bb0e

SHA512
a05a506a13ac4566ecbfe7961ace091295967ea4e72a2865e647b5fa9adac9f7cf5e80b53fae0e3917dfb0b9a3f469189cd595cc4ae9239d3a849f5cedd60e46

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\bn.pak

Filesize
812KB

MD5
d6ccc9689654b84bc095cec4f1952cca

SHA1
286130971826b0af1b6d29c5283dfa71af7cd7b0

SHA256
e325d936cd97c3f9ddfca2d87caefb8b6e7465ffa31d0386ae2456b18f7a92da

SHA512
db0400820c5cd1100337c955084eac3036b55bbf66b403337bec2079bc47696e2e48a771214662b286f4f45f763d2ad423aeccbd0f06cf0bc11038662558f4a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\ca.pak

Filesize
384KB

MD5
2f8d050c228583559cda181291b76e5a

SHA1
b047f1cfb30b1162b1dd79f7e424a83fd807eec7

SHA256
e1d6b5fd0bc411f2895eaaa1409916f5ffe39a5c6bd1bafe8af7ce33da5be17d

SHA512
e4f150cd9942ef5105e72376835da6edc31ef91783e41cd2fc04600c04f342bbc96e08e23c8af1c0c1e563bb8a7d3840a2289767525c30d08c2f23d0e837801f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\cs.pak

Filesize
393KB

MD5
26765c7be201444f0238962bb16a506b

SHA1
f9d4a33795e45127c14bcf35cc770845627e15e8

SHA256
936466784a55b965d23b016bc49377655bc5d281d012c8369c0809c961e05c74

SHA512
577d52d2d5048cd952aff1e76121a495328c1978cdea2eaa4f85812cc513917f69510e135e96f7967f4ed43cf88e180cb1d9059e17c855c8d4f94ca036730214

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\da.pak

Filesize
356KB

MD5
fecabf71853bab84eacdd95699c49f69

SHA1
8519afc13e100a550ca3d756518a0bc33674e0d3

SHA256
1b0793b1cbeb6a56ff1e64523c37ba753457320aa29f9718022caa07b4981d8f

SHA512
e932d382d41a79ece172349e916221a67d97f5fd4b2dc1325d6bd2f7c6757cbc01d6fbc8d9846f6ec462eb637210f7c650f6944418edbd3f8614ef99030d9392

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\de.pak

Filesize
381KB

MD5
ec069f60c9825080b9d18ff6492e816d

SHA1
34ce5101c9646f9c2deb9820a3b26eb91c525ebc

SHA256
e0f632ce324951002c80e019dd0169be9f6b0640533fa434cd6ca80f28a1d3f7

SHA512
95a88ac98f0957e5f200af76c1a743b976228f7da1bb6c6b3b88a54adcff05e1172d7cf2e6f0a82cbc8ad0aa79974a1bc046516250a3a5889fd7b2e4d7c0b804

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\el.pak

Filesize
691KB

MD5
306a80dadadb1f9182810733269537fd

SHA1
bc01a65a9d024ec72e613aedc60f4838be798040

SHA256
92403b6160e38746597d4dd7f64d64cf19e30b5e7862901263c39679187b2c91

SHA512
491016b8fcca59a7dc9523358c4a7b56c55360f424e8fe9330d6f01480835805e961f1e48f8777660510d9af9a66961c639df162190dec595a867d54150eecfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\en-GB.pak

Filesize
310KB

MD5
502260e74b65b96cd93f5e7bf0391157

SHA1
b66d72b02ff46b89ee8245c4dd9c5b319fc2abf7

SHA256
463af7da8418d7fb374ebf690e2aa79ee7cb2acc11c28a67f3ba837cf7a0937b

SHA512
0f0f9aac8e6b28c1e116377ab8ee0ffadbf0802a4026e57aedb42d21c38fbf70159be9e0314799c1de1f7638fbbd25d289dff7cd2c9eb7c82e1b62b6c4e87690

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\en-US.pak

Filesize
313KB

MD5
3f6f4b2c2f24e3893882cdaa1ccfe1a3

SHA1
b021cca30e774e0b91ee21b5beb030fea646098f

SHA256
bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f

SHA512
bd80ddaa87f41cde20527ff34817d98605f11b30a291e129478712ebebe47956dbd49a317d3eeb223adf736c34750b59b68ad9d646c661474ad69866d5a53c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\es-419.pak

Filesize
380KB

MD5
774ced79da2fd32bd1ba52a0f16e0a19

SHA1
ff36dcf8b62046871f441f301dd7af51cb9ce7ee

SHA256
5aff3762747a6e8c6df9f2a3b470bf231b44163006b17ce87e2a03694be27b81

SHA512
7763c15fa97efa9a5af73dcdedd4fe260139bd8ff782ca3aa0937d9355b2d14c3e482e570844ac33d22d7b016c7b9097d727c1dd585f421dccd59ca7bbc24269

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\es.pak

Filesize
380KB

MD5
ba80f46ef6e141cef4085273a966fd91

SHA1
878f35e15b02558f75f68ec42a5cc839368c6d61

SHA256
267e7b6376e7e5ab806b16fde93bbbcd961bf0c3a7b3a2cabccab37faa9a1d16

SHA512
8a8b4f7db23d4c93756b6dc4219f00c77358a8fe992da1f51431597b82c3aa87abf3a98d79e13e7b4a14a1a9e94d388760fb6abf3a744406dee951c8e78cf361

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\et.pak

Filesize
342KB

MD5
e97fe1e6d06a2275a20d158dc4e3b892

SHA1
1575b9b1fc331a70bbe4ca7d1095d4ed6777ecc1

SHA256
d984aee4d18ca24a88846b1b6e0294d373733430f30bb4f1b97bc7d50d512c2e

SHA512
77879a4d1062671b616ba9b2ce0b6f69a5dbed6bd56b73ded902d1f9f44ecd96a2212690b3568c0ba273c73d91589ff2bf18c7ef9b66e0630fbaafde2a61b1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\fa.pak

Filesize
557KB

MD5
d55f65c6fda6ed6f549d2c9f0a4ce874

SHA1
952792f2da5ed9cb1cfed14e5afb8abf5cf29cb3

SHA256
221bbbde078d135f6daca4978a31cc6a82f8f46536467ebc9a0cd322c58a7785

SHA512
d0bb83467182d8b3a8f8371d749e682cf05f89daefe28764f2c263e7cfbfc3f86cb388061b48dadda26c3dd246dd6f7a57af58ca9344c2f6b90de87af1e91c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\fi.pak

Filesize
351KB

MD5
fa7dbd2ee35587ff31fde3c7107e4603

SHA1
baaa093dcb7eccf77ce599c8ff09df203e434b60

SHA256
5339b8ca52500bd0082e0ba5a5f440c5f04733803da47963280479760c7fff2c

SHA512
587f6d0e216d1688227345a8a75b94848ee710ec633fe6805db66bb0e8cad1b8d24a1e6a7e234061516770d881571166c78d8fa1c40e6335f3dcb1339fbffc14

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\fil.pak

Filesize
394KB

MD5
3126f74d021e9423d71913bb45a62935

SHA1
c9a80c8585aabbfec34ae891416794b1b3e29a11

SHA256
4cd3fa70487e894400ad29e3bfbfba3e1c5edd799aab12c62c3aff3c2580ce5e

SHA512
fb360723ee53b3f7038eebd1b919a36784a0e3dc878e810bc905c4297379dade6006c8872ed68412b06161cacb0d6e32a7157ecf97d9e103a4ca3b2b71db8765

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\fr.pak

Filesize
410KB

MD5
51ee1ed54fec49effd103c29677885b5

SHA1
ced6fd3354007d1ef3ea7b6689aae5213c20cc69

SHA256
1f6bc09499ee37456968a28b67b81bbf5b9df4f0c6035a388242d2037a3b65a1

SHA512
dfd50ad99b89345940afead11c3a6940d4408a0e6265cddda1d71ad92527ea00d8057ac77ceb2ffe137a3f0d2f321c210bc7cf97ed821f01e538dc08d07149a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\gu.pak

Filesize
787KB

MD5
b7f4c73d56be31042d8edd7e8ea080f3

SHA1
c0c3595701c0a75c14931ed65958d36df0d925c5

SHA256
c36a20730d5f2b91cb61b5b2a5912db2ea5a328a9b8abe0fca0af300446d3c20

SHA512
ea0d766a754604cad4d5f3180c30f7dfdc3e1cfe79d67365b72adc0d7574851f21bdd5b748b16e8b4a95ade40c8ed0442bcefd511a2934cc9c701e379c955d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\he.pak

Filesize
488KB

MD5
6376d0a5f4273b76b1f4aabade194e0c

SHA1
337ba39f09454c0779ab64872b9fa11f866d6adc

SHA256
875712bb852c698f677c0c74e088f62d31adb2bce65648fc390607aad8705c45

SHA512
00347f16b5abbaf47fb08663d5efde26ab7de0c7a2fa42e6b5f03c41a83cecbd8e78cc3aef41d5f08658cf346e0ade732774485e8a10008a43fa41ffaf73b2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\hi.pak

Filesize
821KB

MD5
ede7fa471c5eebc1fa55b9b3b6f92d00

SHA1
1d1f529c615799bb3a3319ddd1357cb5dc71464e

SHA256
1e9623c7407ae8b8a88df3f69a47ae8117f74c4dcb56897bb794a9c38ee5805b

SHA512
0f51ea54e828700080effa6c728230c523ff8e26fb350e6f337028d18614d5dfc4a2792cb92b5e606bd0702067f55fea546029cddd1ebf7fa74ef5521ff08338

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\hr.pak

Filesize
381KB

MD5
7095ef4caf6bd39174487002a4e09300

SHA1
1efe686bd0b7f035aee7ab4c52be6133121cd0f3

SHA256
3d7685163c5eb6a11e745ff934312b8681c5f85dfa8d9ea701e9dcaee1e7a285

SHA512
45488d46dfe7a31a007932917f7baf4c195da899de5dc56d98e555336668af3edb77996487649b86f56beac688374ce77f8feadc01e3f84d30d83bd67631f9c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\hu.pak

Filesize
411KB

MD5
d6904e7d1b6750d43a6478877c42618d

SHA1
919f090a6a3aa1112916f5bb0d5b73a62be43c1e

SHA256
3ec43893c6de5ec0f9433841afd5fa9feaaf59ddcef05f7e1cab14dba799887f

SHA512
d600fedb5ef1b2eb49a0122536c642b350ce67bb7a9da205890d9d13a195ac17c14607b4489715fd34506ec0ea4c80f245e09cf048aef52dcc8094f3138b2fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\id.pak

Filesize
336KB

MD5
881ff04e220aa8c6ed9d0d76bfa07cb8

SHA1
cacf3620d1bf85648329902216e6cdc6f588a5ba

SHA256
9210c4c4c33e7ceb5f70005a92a4fd36ca4facdd41701fdc1d2ce638db8adf22

SHA512
9134102928aa80c49bbf2b862e8079b2ee23636ce63412a4c3813f234d623ff563f5ca1ac407ddb77cecf1224896ed59ae979dcf63435d35a4f13de9c22755d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\it.pak

Filesize
373KB

MD5
91391f388b4b6c12a72710c35f4c355d

SHA1
f89e6ea977a10a9f050395489285ce8c041c2c05

SHA256
c0dc0a4a87f7bb054a30eb1174c3228ea2014bd94668a7d22995b99c4937d817

SHA512
8796d69d1a8bdbc7690ded45404174b7fa0b5bec8453d79a3c85bf4707c3f32caf634c792c72ce7bda3522eceb5fc6761b696471586397064d9f1f1988ceee88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\ja.pak

Filesize
456KB

MD5
8209dd8cf4e416416e015ff239b7c483

SHA1
7affd1707b9eec52c26a4c17708c8471c369e2f6

SHA256
3accfd9a1833ddeedb2082fb94101beb59b555c60f42e3070e9e04a372eba84a

SHA512
6a58a1ea8a46c325cac0629f2e3b571532a9a2a342ed61ca47bd1dcee20ce0b0350e4f6d3e8e4c6903c7ba4a4592a6382bf0fcb5437febd1673b3c2ce8cd7499

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\kn.pak

Filesize
910KB

MD5
d3d6bc60bead608e68e776e07d21ad30

SHA1
e40e38ca99026056c127e9e1a1ff821a50310887

SHA256
90b2df3338468e84e2cf2f2f67597cba5c3ceb5dba9c59ebd072ec15a70ce741

SHA512
05421db2f1202573a34de1e722c6bdb55a35821c4aebd54c80e6594fc92075cd9b97e5bfdfe93b4228c3a2646b92a27da4722ef3826e2807238dcc56ba273706

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\ko.pak

Filesize
383KB

MD5
b31780fff9541290c1d9f5b76141430d

SHA1
8b0fbdccd0a7f8141846763a0d27e4e0da0552dc

SHA256
b04c1b91cab31054be70cb851dc6716065545445801045daceb96eeee4d2334a

SHA512
a573dd09520059832e7f53386a64dcdde47452b02ce1e5d7e11385abbc8b734dcee0065b4ca351591bf9cc2f66fae204b9300702246d20265e8ddff4f7c1e6d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\lt.pak

Filesize
412KB

MD5
7b6bf901352885c0699db71239b7cf24

SHA1
9e3ec5f327c0d0e54a449332061e60a8c79243cf

SHA256
9200a9509bd77834d9912f4ba8f4219d2b9bd2cdad49a11873db30e99b9d1350

SHA512
79ebef723fb4c17581eb869b4b4e1a364a3d28df0e168e7e1a3583e0c1ec5b9716dd270925c0545b8247421a64b03705f10910fe3416900de9258840c470d580

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\lv.pak

Filesize
410KB

MD5
e664eb35f1284e9fc615e1bb4fab892b

SHA1
e777653abec377a394170b04f79e78acbe4b6a3b

SHA256
b5a31cbfcb40ad8d911de1618c4eb7e8cc67b97eb8878220f15d40eb014d8ac8

SHA512
c3232997e8d306e91ded72e9d81ffae2018af3e6c32fe620532e03bccd2883fce59b2a2290a1580d7080c468c02bcd24c1bc90051f06bfa9a4e17857d4aa583f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\ml.pak

Filesize
948KB

MD5
00292b0801e0dd0a74091bf53f1574c9

SHA1
63a002e7a8796bc4b4459a19c95ce426fbd1ec7f

SHA256
61a372f170de0a22712be980c3c78b22035ebf40ce79332fab75cdcc4208c9e6

SHA512
e2e15f66851aa435e3bf4de6672f4aa8b01204d8efe11ec6ee9a51d9877ec4f2e71d7e9547d6eab9bfa04af1bea71fa72aa4963fa08b48717bf1c3fd21c00cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\mr.pak

Filesize
772KB

MD5
b9a2aa88c69c42ebcc41fef00c980a38

SHA1
9e373dfa11f95c31ffdca70bd83d2f66e1ddcef8

SHA256
481faf7dd66cf10a476d8b156fb4ea452f920322d8007f7e25d41b2837bdbc09

SHA512
5f4582723429a44dd517322babae4466efb4e8723c0247754e2a9a2929133d6fee5c3533c4cf567954e2a5aab47940a136a178405de36e38b50e8d4a6d5c504f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\ms.pak

Filesize
351KB

MD5
d5da199f347452c5904bff9332a08f84

SHA1
b5fb8c22708a7e3130684f1a9923b6dab10c3ae5

SHA256
fe58cc4f62fc31e32c1fb9a0893a5483391ab6a91b1c92ed4a5e3103a962da7a

SHA512
9fddeb376bececc51dec997b3ed1e22821340fa172636f641af774dae8bc9b5c0780757380bf3fa8df0f9682a555ede81c449ae9468f63215c17123d13ee9f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\nb.pak

Filesize
344KB

MD5
bbae0915edec081b04bb903b689bc40b

SHA1
6a0fc635ce1c431e512b8b3b8448176aa4025556

SHA256
d565c6c95dad89d3f2b7210de4ec3fc437633de4dcfc994fde0704b92bb53ff8

SHA512
573a9fe43213829a6a4b39e67be25bc330b417750ea6d66e26163de7a80c29f6f5deeb841d9ff8303595943a81fc01ab668aab02a5cac4eda078ed06120138b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\nl.pak

Filesize
356KB

MD5
9f547a24e2840d77339ca20625125b4c

SHA1
23366411b334f990a0328a032b80b2667fda2fcd

SHA256
55413d5eddb3300e0ae0fa5d79d26fdf1e5a12922d7018c8054b1faa9d660301

SHA512
34da7a0b58ee3904d00cf02d16d5a3ef508fb708d7c0a887286fc32cd6145b2bd857d317c784d1d1b17662041eadcf7e225908980eb93f2b81161d845c0bb67f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\pl.pak

Filesize
396KB

MD5
0dc77139d3530695cb4e85b708bc0bf6

SHA1
6915655afd1e37361c011f5c2113d72c7a0e85bc

SHA256
53b59486361b11512fb90f15065104b15ee2322bb7804f859cde2f2ecf9581fb

SHA512
ee1ca1d99ac279df4cc0e532aef2fc531061736b636a84310bdbd627e0f2435eac1a386ebb19aa901b6eae3929bda1c5da4f41b73a25a1b20137522e34547600

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\pt-BR.pak

Filesize
374KB

MD5
a064cb9d7cf18936600e9ccc03297006

SHA1
eb436a0c584ba91acb05dfccde139afbe26fe9f4

SHA256
c9ec3822044365457b8736348cf95a8e39bdfe3ed36267449bf3ed739accef2e

SHA512
95af684abf9d24cfc4d0668a02da1e2e69f5e671d671d8cdfadc22ec991908c6aa5663fe1fa88ca8e85c0508f409fa6c2bbc174c53674270f2b188018d358415

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\pt-PT.pak

Filesize
376KB

MD5
3f367760b57a5e4360dabcd4a650bc5f

SHA1
8d7cd6b0eb42361ee862455ecfa475d28f5aa934

SHA256
c89170385b3afb2ec89fbd61b8470ac718713c7296441c8430f173dac218e74b

SHA512
3dc30780d57dee91215a716dc6b4cb432838aa0161af4371f49f70db2076bd155b170fd2c1617f59e1b572144a2e150a34143eda82d9f2227d24d2281d5aba60

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\ro.pak

Filesize
387KB

MD5
745a9b8c6422682f2cfa5561cc1f4022

SHA1
31e3616ef09f9b1fd1c41cf8f43e504a6f90276f

SHA256
7247470057a936d03bfa2a8776508ab66aa1040c41a4eb8f79c1e93551c74bb8

SHA512
8e0b7f98cb842a862ceca65e0166462275feed26c32c9c299aba9986d36b716a90d4a8db5ccef355ac266b7e969071014cc7ab6439778e77c52754bc23b4c575

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\ru.pak

Filesize
634KB

MD5
5cc0f54e022a9996773dbd64906d5580

SHA1
87c103bd69724579b478f904235e03caf61d5d79

SHA256
b4223b56ec88235819a427d60bb937eb3984076523f02a018f57819e0429bea9

SHA512
b3365fedcba50643cecf1a70297e1e67990d63ae05caa87de01a70ef6f28e0f73a9a0edb0ff80b4138c624e51aa2dac065a2d40877fc92137714ae07734c2f4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\sk.pak

Filesize
399KB

MD5
72946b939f7bcaa98ab314cfba634e0b

SHA1
71c79a61712c8c5d3dac07a65d4c727e3b80ab17

SHA256
75f179897cad221ca6e36b47f53cead7f3fb4159ee196f1d10a5181b84e1b5b7

SHA512
2a8fa7108c58f4cb263900a555714d5638d961d14d9f4ddf8a9ab5b880afdbc5d2325fed1e158dbaf42a9cd20e8e372e6a8f52fce842a6940ea52e43e4a1f1e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\sl.pak

Filesize
385KB

MD5
4ad22c6c64dbe0fc432afaa28090c4d9

SHA1
19eb65ae52a585dbd9c25c32f22b099020c43091

SHA256
6002c129a56558832e9bd260c427c0bd2e1566e0aea3ad999f89c8e479534f9b

SHA512
94f9d34e76560059ef80fc04be4d54e52a7d934dd28747db7f0f6684243b841087245699a471a55d667623d2ce5e597a3d2c6bc37cfd7ebd2f5b8fb40e6207e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\sr.pak

Filesize
595KB

MD5
fca817ed4b839b976ebcbf59cac66d68

SHA1
413efa65470319999032b6a25b3b2ee33b8cd047

SHA256
524acc64e70918a77cda43fd9b27a727645b28ad2d4cce16b327105101c8bbeb

SHA512
cb246d5c5cea30d6e7514841ab93803984cda37461a09b6c340ca64f7cbce4e1212951a4de421d928d433a619dac18454fb403b42581757b76c7eb124ce70cf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\sv.pak

Filesize
347KB

MD5
5130a033016b45ae2c3363edb3df7324

SHA1
9f696d78b1b9efec180dc89ee0defc3ba23e6677

SHA256
3420a1fbcca5bf8c2d65d6dcb0db78b03f95f7f2fc56479a0de6e3312333ce6f

SHA512
401b71360dcacf3b1fdc411c92195051370db110863cbed37143263e7804cb24b75ff1908ee39ee848c28776df00d6edd8cc748acf3725668af7815929e8066b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\sw.pak

Filesize
365KB

MD5
9632dd7d883fa4deb3963ea663e0ffd4

SHA1
0db135be4b3a7c54c39e9df5034d5576b68ea92e

SHA256
690027c4a31c4aea00b7d1b32ec6cd3fa50b1eac412ae273ab15e72eb485dd6e

SHA512
3aac1857784dfecd2ae5f7c4056f58e27a966a6cb949e02eaba56fc1fc283243ed6213f17628d62d435e33fa4771eb43623f25da6510aa4ce6f2149f72ab0d37

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\ta.pak

Filesize
936KB

MD5
f100566697a96ce1f0a0c7e0bbfbe36d

SHA1
4c80a4930ba7d174c4203c199492463242bddf62

SHA256
7e818deedd50a533851bbf08e056bf2ad8d45f442a1a61d9b48e66804ea848db

SHA512
dfa6132a5b7e819e8d326bf5ee539d9ecb2dcd7fea429c75afec2291df9eeead6fa347b01f9feaf2235bce627fd39116176195f7a3d7d74de28951f939db1645

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\te.pak

Filesize
869KB

MD5
b1b6a9e3a04be79080ebbfacc1a0eb2d

SHA1
a5c8eb6a930062f6021d073d5f74ae146dc7fbc8

SHA256
d839531c4ff4a2885c993e0d358f78667215b0950c77a06ef01a6acff9221c5b

SHA512
bf0b163c8fc3988bfeb3cbb4b981596ce5afdf7e40149622fc3b60994e7d8efa5bb24c830036d168a6638feca48b8755aefa8640faae37055cae8fffb6a85568

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\th.pak

Filesize
731KB

MD5
a970b7e9d3aec2cd1b8ab798b3179f07

SHA1
bf17a7e80e01ac1704a1efdf27baf271b4c21e36

SHA256
cd80bf232f2f128a3d411f52c8039987559dbc1055f746eed6e0e8478b116dc1

SHA512
880555a2ac2f278aecb8794d8cc51f0833052e9f4ca187ed91fa35bb475e68ae3255cfe1dc074eac960c73c203e62c6b38077b266f5fab66ccc3ca73e94d4d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\tr.pak

Filesize
371KB

MD5
46f9b2a35efdf1120a8a946e4f1d0115

SHA1
af7bec1fba32d912b50288a7d988440627e4ee85

SHA256
b22fc7b75c52cc142f201d5cf107d17c1b173a494a6add022127f559fb46bcb0

SHA512
cd67f9c328408a8295f224aec190c7c411a868755fc5c9e90b4985b3c41a05d6d34dd30d4a3866f6c24e1d640f4c324bfba8c7ab806a6b216151cf0a504a03d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\uk.pak

Filesize
634KB

MD5
3b2a976a25dca963e91df3695c502d8c

SHA1
ce7ae51211f512c3723bb43ea0de9e6debb70597

SHA256
28ea88f19b2c34699d535ca0c691449b7e4001c12e8aed8d04b2078916e88a37

SHA512
ba41ee074239afdf8f194b4ccb33060fa9655e3ccdac6a16090959d3214f8db15396b3e038d7de26c478fdd003472f680d2b6ac9a92acaf6ebf8aa258747ecc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\ur.pak

Filesize
552KB

MD5
ba86f1f13fdc37a2c48c1da34c84f4c4

SHA1
2f1578d0eee76e60effb63967712b15c0d56829e

SHA256
4c7affdcc324cd791d10e235da809ce7501e8005be64340b6e8bf5595647a707

SHA512
fb2fe1548574da860bf27408a4f29d781fcefc300f744f4214843f343e343ad8bae29cb7047f87f5c3277641f561c6a30e5bc9d6490afbefc7af36974305a688

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\vi.pak

Filesize
439KB

MD5
065179c466c5b7457e249f11d152b99f

SHA1
cfc05e9dfb91b2af2944aed4718fa05b43844914

SHA256
b75694e390bd2e20780b3bc72f6e1473ba45d7537c27642a7d888dfd3bb6c3bb

SHA512
fb598391a028b7d3c7e25cae21ccfde655e6f871e498767a54f7cf0d5d4e48207213cd2598ca88e4f46c303cd2d8175238a5a5b720ab37beec1873d681165a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\zh-CN.pak

Filesize
319KB

MD5
2febe4ef32e1a3884089908f402ad62f

SHA1
e65c54adc127b78494dd6189cca71f1c7bd2a5b0

SHA256
a7ac9fda6f4cd189b75fdadc4b70cd0d369a09b66eaeb5d032678cb97ffc98f6

SHA512
8e8b030af4c952c32ec277850d5573414630ff5196eaed52820f44e9c5bd03ab6f71a8add19215b0456eed859be0d5a6f28d48e12f1677d39842f35feffd5e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\locales\zh-TW.pak

Filesize
316KB

MD5
02e9e0bc5c30ca60a869ea761fb662eb

SHA1
c5200f692544b681af8757627da430aeea4283ee

SHA256
c5061ec00bd969f76f3c0c6ff15ddacafed7491260bd8ced78118691ba57bdff

SHA512
07b5f401f89dfc36499a3e74318b471d9b2e795dc363dfd5a9394089d4783a4b51fd78e2092701b6974f1c51020f3b5f81171ce21690f8547ff3c8f3d54ce781

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\owutility.dll

Filesize
1.4MB

MD5
0b72a72b76b71076c78773802495d377

SHA1
921101f1342c180677c4bfc7006baf3292a77f9a

SHA256
c127bd152b674d35a7c5a65cc933c385d64622ae2ea09b7194c1de7bdda1c690

SHA512
28afe1b4982e31784393182a06925b6758a19436eba28f89dedc2a380845939d31e947ef676fe8e34f382c7ae28fa88078380df9e83ba9ce7d7c1e9df96a952c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\resources.pak

Filesize
5.1MB

MD5
5370f2a5baf5f81cf4d642df6b6a8a36

SHA1
4b714936795723bbf1ac7a2091235acf2fa04043

SHA256
1844aa96d85132a00f48587853a5dbd3d70d3dad6221b055abc4d64a547a4350

SHA512
703a001c148c91e8bdfa86c61691f7c7ed8f23bd75b0e7c552da8e11e0bea76cd560853a2ceee46247bb6943694ce31d4ea39dde13022cb50ee9b8d25f4f4caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\resources\app-update.yml

Filesize
126B

MD5
689d67bfbd74fde86102a4659db5d88d

SHA1
96d5bd8e07eabb8456b65492e8e643f29f50f54a

SHA256
de9ae7bf3761939a544396d347c649467f794d99ae2deb4ce246d217d0c4ca40

SHA512
0b5737360ef64f58e5c00ed90e262b50a338d0c650bce9acfa4857e5d480233d30e25d7eb39097370050a1ea2814f2e9135d0ef412f2328d4c7d3e2cffd1fa3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\resources\app.asar

Filesize
8.0MB

MD5
e34777b03d422757598eb91cfcb5f1c0

SHA1
806d3b446c2d904c329688d7ff7cf0812745d18e

SHA256
3652d66f9a5bd82a5778c4b74bcabeaba0747b7cc7c0bb970c8e31e2a3901cdf

SHA512
78c2bfa859086623a3c1fc4bf9d087d52d0a1c47da4d03000cdf0568782500bae303c15f308d353bc17b8c67f1d3facd50c21d980845fb954a8dc7d73aa4638b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\resources\app.asar.unpacked\plugins\curse\win\Curse.Agent.Host.exe

Filesize
24.1MB

MD5
ba3bad552eca76c20318b7436a9f2c16

SHA1
d398d5855d9e6abc30125a10e07b17373aede0ab

SHA256
8d24ffcbdd598a523dc469d403f36c5044d7c8396ecdddb041521d39bba9b371

SHA512
132b75a1ff2a702290c3eae18ffb47baf601eac6aa4971a7ce4a6e5103a764c684d0980c973ce2531266b0e28af42eb7682525ad8bee2123780dfec5ead65276

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\resources\elevate.exe

Filesize
127KB

MD5
fa9643090287ba2f168e6879db722584

SHA1
503241c559af542c82418fe7a112b38bda69c6f3

SHA256
0b2b625edf2dd7541741d8d4ade79fcbb640eee0e83b2a3e7bde1e4ed2a3cb60

SHA512
c11a0cb98dfc60fbb93d50aaa670df613fa7768bad639a8f02413a8d512b7e4339237098701f0dc8c02d1254f3a1af15c49612e24fe73fe0aadd9ef0bcf23726

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\snapshot_blob.bin

Filesize
168KB

MD5
b82ff216a0babf602940759b9a3af870

SHA1
07e8a22dcf8d7be04a6ddbcab3098e040494bb0e

SHA256
943b27009d41801c5a649caf680e32d4dd25de002787a4ccd86b0925b3aac3a5

SHA512
da157570afbab7be135f7749df7f4518df1452ea24f98d8f5189430e732ad06ed438afc701cb70451bbc7137b5f35a0c5957df92ecb40d47d54c1071ea79fba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\v8_context_snapshot.bin

Filesize
471KB

MD5
031ea03da08fe1247280cfe781658791

SHA1
e91db50ad16b5a5fbbaf4118672d60b347ea6161

SHA256
c16dcec41919a6d2850214f2275824be8a97d8c5e694e2ec8dd7d16ab2d5015c

SHA512
b3d6f282761f8ab8760728ecb108f64741f6f3cd2a143813042ff63a3b6604fcfe7c1feabafb65f9f67906217edb5851f44605a34f7a50ed2058c25ce5efb30a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\vk_swiftshader.dll

Filesize
4.9MB

MD5
6e539f76f68e514fa07257acbb2cb2f1

SHA1
5aa886986a419fc56f0a8da22c10d736761cc836

SHA256
be58539145e91b3a6b849c030ffdbcb7dfb7e0db8deaf3826b2dafa5a502729f

SHA512
75944b935ed9b8e7d547f9e45b275971d2fab434353cae23ddf53c3da5e7ac06721a6b4c66a92f1d634761bf0dd127bea04889bd942d0a3f8fa94da0d8fb23de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\7z-out\vulkan-1.dll

Filesize
894KB

MD5
5c6450f55a60e723398ec80ad14bc2c9

SHA1
de29c621863b3f5154fd9ff18f04fdc2c4e01a86

SHA256
e6910693255a0f0fbbca7cf6e0e77d7dc138f0e19a25417dbc586344931714fb

SHA512
9ff93ffdce036bc7ff04bc86a98f4b9b8ae70575d55d5cb2dd57741ce4951ec2c5e2dcd642630431c3cb6680b227db83202d000904abffbad4729d982a4fab80

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu2C8F.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\ow-electron-setup.exe

Filesize
77.8MB

MD5
08f3246870cddad5a9982af777ee2301

SHA1
29987ea5e1e6e0fdb5dbe6c6afd03146ece7e333

SHA256
51730129230bda978e9e9bb4958a3c83b9bb69881666e0bedc3e46a70ca96b97

SHA512
8dc494c73b4456b5815be668c1b2d856e98c1ed7b984bfcc69d81fb69af4790e698717908bad4866cb0f3959df9f75c2d02be60424bf16ba28d747dcb9f149c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\ow-electron-setup.exe

Filesize
77.8MB

MD5
08f3246870cddad5a9982af777ee2301

SHA1
29987ea5e1e6e0fdb5dbe6c6afd03146ece7e333

SHA256
51730129230bda978e9e9bb4958a3c83b9bb69881666e0bedc3e46a70ca96b97

SHA512
8dc494c73b4456b5815be668c1b2d856e98c1ed7b984bfcc69d81fb69af4790e698717908bad4866cb0f3959df9f75c2d02be60424bf16ba28d747dcb9f149c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-cfiahnpaolfnlgaihhmobmnjdafknjnjdpdabpcm\ow-electron-setup.exe

Filesize
77.8MB

MD5
08f3246870cddad5a9982af777ee2301

SHA1
29987ea5e1e6e0fdb5dbe6c6afd03146ece7e333

SHA256
51730129230bda978e9e9bb4958a3c83b9bb69881666e0bedc3e46a70ca96b97

SHA512
8dc494c73b4456b5815be668c1b2d856e98c1ed7b984bfcc69d81fb69af4790e698717908bad4866cb0f3959df9f75c2d02be60424bf16ba28d747dcb9f149c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2023-06-13_15-31_1976.log

Filesize
974B

MD5
a6c6fe2afd6a87cbcde9926cef3af21c

SHA1
7dbecd1b67aa9f643fd7560f0a6afee096440881

SHA256
4f509b7b257117de976ed51b594c3489507119c18a9209d65229029471973da1

SHA512
bdfa7d1350d7c6085770a1c3f3f2a23df16f53678a60699cd38ddb69d1b6c0bc11bcf34111c0a38cd52e91d13314bc643a989ad45d96d94c3ace9f24d327c7b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2023-06-13_15-31_1976.log

Filesize
6KB

MD5
a69dae08ce8b0d60627621176c3a67f0

SHA1
a3d02a29f10c57dc8ba9372e010df752f8a2e258

SHA256
a258c48f5e1bb8a404fd231092e826b26587e78c01a26ce1b3b377051b021bc7

SHA512
595192febe5865f21b03102b6de362db309e08f75a0839469a7b9f976557e4caa24c9bd67d2e6d6bdaacb1aa7a266d0097e357f14c5934891c74d43ac0b6ba7c

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\5a80a32d-1e24-4ac1-8c6b-081181de56ed.tmp

Filesize
57B

MD5
217c781be08416f5b6fa33aedf027293

SHA1
0e76955a55f31406fc64e3b136f1bb9214bc2d79

SHA256
3de8ead96083d18355eed62a5b8089a61f6c7f97ba3dba04cbefae364f0455b0

SHA512
964b588d2bb87d3e19924cf8a16f1c35807c45ccb41caa00be9dd4e34b9fdfa0625973828a9df1f5f56354f00bf13939e01798c40a8a7089c9aee4535e45b099

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\Dictionaries\es-ES-3-0.bdic

Filesize
766KB

MD5
471061756215fd1f387f076ac014303c

SHA1
d8397cb5900f52a5cad2416ed8ebf53caa1a3adc

SHA256
e6334dcf080aaeca679db70565762a2c296ff5780c1af263530ac7345736bfa9

SHA512
ba9d0f2deb2fcd77e75bfe8a9c6241da25c7eb9012d0374ccca8e9cd9cd1c9615efd5f3980166b0b3431c7e3e55ef013cbc37f0d53bd1e2411afb9363ceccb05

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\Partitions\__owepm__\Cache\Cache_Data\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\Partitions\__owepm__\Cache\Cache_Data\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\Partitions\__owepm__\Cache\Cache_Data\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\Partitions\__owepm__\Cache\Cache_Data\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\Partitions\__owepm__\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\agent\logs\CurseClient\20230613153246-0B18.json

Filesize
8KB

MD5
537e06c72517b8635d65cc308e5d7200

SHA1
973496eda1f951296237d2f648752e2f9f10202d

SHA256
3db61e982f1234dc689750b09abd45f1e4e5c1ba3faf71a1fed11cbc6a0eadf1

SHA512
952a2935eda8b393d256d0b38e8a9bfa411077f45a83d2a8616dd5bb5bb6e47f7f1be836d296061ab0ceecd5edfdd611a8aad0e8c3451dcaf28c4c22e25e7eb1

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\logs\main.log

Filesize
1KB

MD5
e97fc0bc6701cbee95c396e591206df8

SHA1
39d7fa77071a421015b0855f1cadf74463c6ccd5

SHA256
9ea5fa7f574809ed06536974449a4fe5b611aa567f02e56b872b11fc6bff20c6

SHA512
576c09f225dddfafc32914d45ed70201f807666ffeb9779d65bc5520db7aa5582f4823af403392d7ac8e47b01de5970bdee94de006574898f270005a699f4efe

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\logs\main.log

Filesize
2KB

MD5
83072b9f6034bf065f42b5d299164974

SHA1
93af3baac82a12f970bcb8a0892382224782e738

SHA256
b150583f2ca4388bd0e005ddcc0f2a189975ce4f8eb1369e380a1b4a5b3aad25

SHA512
9cac4b482d88c829010707ab94ea49577c09a5da8690f4212a87db86dc0e47bb3103e6e4bd978e8db95b85f4b91b7a97fcde8a4543bff1a45af223e4bee7983d

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\logs\main.log

Filesize
4KB

MD5
343259029fb4bb3064c8d2e4b35c6846

SHA1
8b1e35ed0454d93ee097af4fc8bd593ea44af3c3

SHA256
92a4183efabd652e1c40eaf5b23616ab9fe0f26abfafb2ec7cc32ffa988b51ab

SHA512
c05bab7ac5f20c74e84a64da7fc3f196651e49640dea8191656b21c5abe2c2d5815d6f812ffcbca0e32e141e42ebb4940de7bdbd8be7e1a676710165893c12e9

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json

Filesize
520B

MD5
4b61f6e4de7749300fc5b5d62640e29a

SHA1
d3ad90edb679ea4b495f8b6c0a57e0c358291f50

SHA256
85f9342a89d0ac400bb86762fb9f2c7a37fd3ddb1a70fbb2c82ef71e6208a38a

SHA512
95748d1401ac603a00bb2e1be632f71db3cf8543e6e7b6fbe39742d586401ae98504a0ccfcb4ba3b11d8cbfa4dad4d61eaff1e9fd0a7d6b14e97bbc6a8c3d5fa

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json

Filesize
611B

MD5
a544d4a1dab6b8f3897dd0e91d5f6e7a

SHA1
4f45f179edfc9a803daaeeccae2ca18fd064435f

SHA256
cd5111556dd2aaf0aaac2bd56af01c324f7140912543cdbebb48aa11b34468c1

SHA512
089ebfe0b06d50ca6be37b05cc82f3499cc198f8f3e33f45020ff1d6bdf27c22e11962464dfe7766aa09559b992de1c3650e6247098ff6273b90f945c3c64399

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json

Filesize
914B

MD5
1c6c2daaf7994fd815d2da7211a48741

SHA1
ad90dd02db2e70acc55b76dffec05cb581e44999

SHA256
00da3522e64b06971cccb3bb49f699eac27522fdbf870a9846e25778ec0b6c28

SHA512
469da3b0cf114e32f4124633d82eacaf3ac2cf72f46df72bb639910640189d0adc6ef7150be6a5bb5360acf5dac46121b85bcbc5f0f19419334a5c6364d45b4a

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json

Filesize
1KB

MD5
c234d0b5460d0f6230cb75e29e6c07c9

SHA1
5d3ef9dd6bc1c5f53e4422f12474843e7c0c76ba

SHA256
d1b213e27aaad7eba038debaea2b27a215499cf8d40cc0c6dd21c4abf9b0426a

SHA512
daac68a34017cf4b85765bb91f471b7a87e412b76d401a52935aacf49c11a2b06914ce5653f3a7ed8cc2f144b39aa8e29e2bd8cccedc219a2c28999d27711445

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json

Filesize
646B

MD5
4769fc7eb92b1f43b88c4567f2e42a3e

SHA1
8651759d2acb376ea6ff0f6ca56b244b2ee93503

SHA256
856a9dfd9ec1974cac280a385da05f7b177d7f8c1bf740ff9f46e8a702bad3a7

SHA512
74f5eeb6b80d4b81abbcf7a1db39efba6b0e70a90ae912c45d7e6b120fd3783354db40ef981a19619dd26e856e4ca1839e806dc4b326f306318fe09b7f4e9630

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json

Filesize
1KB

MD5
40950ee2f6ce997eeca57a1a139591d3

SHA1
815e39b078a6af0280795f1154646928e998d1cc

SHA256
bbffcaedcab497b65018fecb8c1a90354e361bfee5189fa8580bc1f723b7090a

SHA512
8b576c531dcea3f98400737507ee28ebaf8c0761991849b83896bfcada50ef3f8d603d6616a7cecd78531d50f6ad1d5fdae488c2746037bda333f900fc2a754b

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json

Filesize
47B

MD5
2a09ee8cbb0583f46aef129c379a86c9

SHA1
116c2887bf509c9e1807bf8bd2dd1503435d3e3f

SHA256
674ebaa3c6e339fa277c64e4b4088c28272330f1ee58b74e86d8d316c449f9cc

SHA512
ceeb19588af267ca99caf95ded55926e3f05e1e91d0a22255d9ad5d3fe7c88de76b58571a279cb563e391ca4b09806a557c1b0f86eb6025d939f4cfe82f26f4c

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json

Filesize
100B

MD5
479359f7ba6ebd1086e02841ddb3d646

SHA1
a832cbf0d0553346145d812b2fb5bb7a3a647187

SHA256
d161805285235ebacab8de7d3735dff65457a98abc42b674fda29683a5f0a183

SHA512
0fb1b28b135684f577a44ae087d765ffae3e26cfe792fe9c83466863408f424c20a4e589cb111cc55a9d73af55a4619a20bb54e7fed4f27108b7d32710a75f42

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json

Filesize
870B

MD5
d32e2824594fe75a10af598abc28b3da

SHA1
6d832daaedd58d510fb8600f77c832256b47b2b9

SHA256
cef855427f447aa3f712eb053a0cad22d7f36fee6d7cd46d698abbd5f74bcc31

SHA512
87bc6fd5d4b766cbb6e2c983e2b5627526184e7cb13d8b00a3f740f7474cb899c1ee446c1be8f2b095e8ce6a74f1d2ee20149f0b3e64a33351c28cb7d9e05247

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json

Filesize
139B

MD5
8bd379251add713859df71929b686ab8

SHA1
849d8000543b42c0c36feb31feab8f354c0780fd

SHA256
e74b22552e6ea82be353748b83dda43de8c784fbcb49c64f8defb753b5ae50a6

SHA512
3caf583fe09e40b560dde43899762613367dba568c26db21912526ba0a2d190e91e5096755356792cd4ecc687f2a509c547631cb05811179e00509a556bfbb9b

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-6670339984c4c42a

Filesize
72B

MD5
a0faeee91fcb9d482ae4f375735b38f7

SHA1
c8892e978fa188b58a4ba0b0e44ee60c36cbbc2a

SHA256
09190951a001f6ecb55621f7ed15eeae6f6a4ae3b834cd306a5214c18fac09b5

SHA512
aa8d125a74cfc5821e6ed933b895d94fd9035d9ffee67e17c2e6536cf55fa407835a2a5fd8b00c1335de0b9c87b33b71451105d959f7d8512a060137c9bc59ac

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-66703408453a1800

Filesize
467B

MD5
60f1c943b81c1151c138316f02859b1a

SHA1
15c02b106ce4477c58923d30cec8d46ec6c32590

SHA256
2e8b97ab73cf4a3b11bd901f608a08b9db3504c0f82863c45a75b6ea68a77878

SHA512
f0877626ebd2b8b9f8b7d33d68f6389c8e9639740cb603e104c4ec69d5f4febea284f0a554b741b90ebb8ce844e1254c50af45f27e5d2dcd7872ac78b9fb62f7

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-6670341184ed5935

Filesize
555B

MD5
0066d6f867dfb7ad9020099c3e6d2761

SHA1
2d35bbd4a489cf4ce22ff8e5bbef55b01aff3885

SHA256
8cc309693ffe21c169539b0ebb4b660df22562d470226194b25f1dc4ec9759f8

SHA512
6ba6068a2271107211e18cef4a83cdc886f19bf4837edaa67a09a4bcee003d8733157ca20350245bce156210f46d8b4ffec46a5f6c0ec6032231e195d045ba7c

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-6670365083b05180

Filesize
709B

MD5
9d3692b9ccafb7c85f58b5ae89f80e68

SHA1
58179463a2d4bf122f83d586b679a25abead3887

SHA256
368da9813e892e1acd41d8b25ec490227f11aaeb5b425f9ed059825f65020bd3

SHA512
95d7ce96e83ad8a2610e24717bbceed52a0cfca8725a95f8c82e4a86837ee03a7a0e16dc1b40507a2085d2e8db1a3516806bc3d50963e1a4049db5c27dff7673

Download Submit
C:\Users\Admin\AppData\Roaming\CurseForge\storage.json.tmp-667036511502f341

Filesize
965B

MD5
140058f734c91802c15432cb355f4dcb

SHA1
5d60de49f4bf4dc9a68bd140507390b41dac1806

SHA256
45ea6b61e7dfe9988ceed2517c6031fac52859aad177e7cfc807a6ce543d1eda

SHA512
6d182313042ddc1981bdc9f5b7d380d1e6a3321aaac18208ed38163acdd9052bd08720b7d514fe2f95161406ac344dc76ad86c92c6de954f01f1f7f69fa3cec3

Download Submit
memory/1324-1270-0x00007FFA14260000-0x00007FFA14261000-memory.dmp

Filesize
4KB

Download
memory/1976-308-0x00000249F2B30000-0x00000249F2B40000-memory.dmp

Filesize
64KB

Download
memory/1976-303-0x00000249F4FB0000-0x00000249F4FD2000-memory.dmp

Filesize
136KB

Download
memory/1976-344-0x00000249F2B30000-0x00000249F2B40000-memory.dmp

Filesize
64KB

Download
memory/1976-345-0x00000251F80B0000-0x00000251F8856000-memory.dmp

Filesize
7.6MB

Download
memory/1976-422-0x00000249F2B30000-0x00000249F2B40000-memory.dmp

Filesize
64KB

Download
memory/1976-426-0x00000249F2B30000-0x00000249F2B40000-memory.dmp

Filesize
64KB

Download
memory/1976-260-0x00000249F2680000-0x00000249F26D2000-memory.dmp

Filesize
328KB

Download
memory/1976-306-0x00000249F59B0000-0x00000249F5AB2000-memory.dmp

Filesize
1.0MB

Download
memory/1976-424-0x00000249F2B30000-0x00000249F2B40000-memory.dmp

Filesize
64KB

Download
memory/1976-264-0x00000249F44B0000-0x00000249F4542000-memory.dmp

Filesize
584KB

Download
memory/1976-266-0x00000249F2A40000-0x00000249F2A54000-memory.dmp

Filesize
80KB

Download
memory/1976-307-0x00000249F2B30000-0x00000249F2B40000-memory.dmp

Filesize
64KB

Download
memory/1976-284-0x00000249F5060000-0x00000249F5110000-memory.dmp

Filesize
704KB

Download
memory/1976-274-0x00000249F2B00000-0x00000249F2B18000-memory.dmp

Filesize
96KB

Download
memory/1976-425-0x00000249F2B30000-0x00000249F2B40000-memory.dmp

Filesize
64KB

Download
memory/1976-267-0x00000249F5280000-0x00000249F57A8000-memory.dmp

Filesize
5.2MB

Download
memory/1976-270-0x00000249F2B30000-0x00000249F2B40000-memory.dmp

Filesize
64KB

Download
memory/1976-269-0x00000249F2B40000-0x00000249F2B86000-memory.dmp

Filesize
280KB

Download
memory/4304-1326-0x00007FFA14E10000-0x00007FFA14E11000-memory.dmp

Filesize
4KB

Download
memory/4304-1327-0x00007FFA144A0000-0x00007FFA144A1000-memory.dmp

Filesize
4KB

Download
memory/4304-2625-0x000001FC94310000-0x000001FC94A4F000-memory.dmp

Filesize
7.2MB

Download
memory/5908-2285-0x0000028C3FE80000-0x0000028C405BF000-memory.dmp

Filesize
7.2MB

Download