85ab31c1d2cf82b72a279ad7ba5b24dac3eadcd91af9ee9e677dbe188cd9f801

Resubmissions

11/07/2023, 09:24

230711-lc9zgaga52 7

10/07/2023, 14:46

230710-r5d1dsbc92 7

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2023, 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

testfile.exe
Size

81.0MB
MD5

287a950b38c3e48e84553ca80cd0aba1
SHA1

c1f8f40fc2fbd43897931fb029cf2de81c9048f0
SHA256

85ab31c1d2cf82b72a279ad7ba5b24dac3eadcd91af9ee9e677dbe188cd9f801
SHA512

ad3331752540718b77899ca7d1bb842895302bbc22d84fd238f92314e51844de34de3d43f97935019356498f16d15777a80f0de0074b784ffb8ac5a71b45744e
SSDEEP

1572864:dqEUklqnfnDyj2EWTxFRcnUa5/8+G0dsFfZwoss6ei:kEUk+fDKWTxncnl5tsFfZwostV

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	testfile.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	leading.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	leading.exe

Executes dropped EXE 11 IoCs

pid	Process
4940	leading.exe
4736	leading.exe
4472	leading.exe
4972	leading.exe
728	leading.exe
1088	leading.exe
3600	leading.exe
5052	leading.exe
4092	leading.exe
1964	leading.exe
3220	leading.exe

Loads dropped DLL 35 IoCs

pid	Process
4940	leading.exe
4940	leading.exe
4940	leading.exe
4736	leading.exe
4472	leading.exe
4972	leading.exe
728	leading.exe
4972	leading.exe
728	leading.exe
728	leading.exe
4972	leading.exe
1088	leading.exe
3600	leading.exe
3600	leading.exe
3600	leading.exe
3600	leading.exe
1088	leading.exe
1088	leading.exe
4972	leading.exe
4972	leading.exe
4972	leading.exe
4972	leading.exe
4972	leading.exe
5052	leading.exe
5052	leading.exe
5052	leading.exe
4092	leading.exe
4092	leading.exe
4092	leading.exe
3220	leading.exe
1964	leading.exe
3220	leading.exe
3220	leading.exe
1964	leading.exe
1964	leading.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	leading.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	leading.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	leading.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	leading.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133335411706295578"	leading.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3664	WINWORD.EXE
3664	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
728	leading.exe
728	leading.exe
4940	leading.exe
4940	leading.exe
3600	leading.exe
3600	leading.exe
1088	leading.exe
1088	leading.exe
4972	leading.exe
4972	leading.exe
5052	leading.exe
5052	leading.exe
4092	leading.exe
4092	leading.exe
1964	leading.exe
1964	leading.exe
3220	leading.exe
3220	leading.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe
Token: SeShutdownPrivilege	4940	leading.exe
Token: SeCreatePagefilePrivilege	4940	leading.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4940	leading.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3664	WINWORD.EXE
3664	WINWORD.EXE
3664	WINWORD.EXE
3664	WINWORD.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 4940	3452	testfile.exe	92
PID 3452 wrote to memory of 4940	3452	testfile.exe	92
PID 4940 wrote to memory of 4736	4940	leading.exe	95
PID 4940 wrote to memory of 4736	4940	leading.exe	95
PID 4736 wrote to memory of 4472	4736	leading.exe	96
PID 4736 wrote to memory of 4472	4736	leading.exe	96
PID 4940 wrote to memory of 4972	4940	leading.exe	98
PID 4940 wrote to memory of 4972	4940	leading.exe	98
PID 4940 wrote to memory of 728	4940	leading.exe	99
PID 4940 wrote to memory of 728	4940	leading.exe	99
PID 4940 wrote to memory of 1088	4940	leading.exe	100
PID 4940 wrote to memory of 1088	4940	leading.exe	100
PID 4940 wrote to memory of 3600	4940	leading.exe	101
PID 4940 wrote to memory of 3600	4940	leading.exe	101
PID 4940 wrote to memory of 5052	4940	leading.exe	105
PID 4940 wrote to memory of 5052	4940	leading.exe	105
PID 4940 wrote to memory of 4092	4940	leading.exe	106
PID 4940 wrote to memory of 4092	4940	leading.exe	106
PID 4940 wrote to memory of 1964	4940	leading.exe	108
PID 4940 wrote to memory of 1964	4940	leading.exe	108
PID 4940 wrote to memory of 3220	4940	leading.exe	107
PID 4940 wrote to memory of 3220	4940	leading.exe	107

C:\Users\Admin\AppData\Local\Temp\testfile.exe
"C:\Users\Admin\AppData\Local\Temp\testfile.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe
    C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Leading\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Leading\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Leading\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Leading\User Data" --annotation=plat=Win64 --annotation=prod=Leading --annotation=ver=1.1 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d0,0x7ffd913629f0,0x7ffd91362a00,0x7ffd91362a10
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe
      C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Leading\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Leading\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Leading --annotation=ver=1.1 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff7c423eb78,0x7ff7c423eb88,0x7ff7c423eb98
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4472
- - C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Leading\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp" --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 --field-trial-handle=1980,i,858333445890203828,17328569965507392984,131072 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Leading\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp" --start-stack-profiler --mojo-platform-channel-handle=2080 --field-trial-handle=1980,i,858333445890203828,17328569965507392984,131072 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:728
- - C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Leading\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp" --mojo-platform-channel-handle=2336 --field-trial-handle=1980,i,858333445890203828,17328569965507392984,131072 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Leading\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp" --nwjs --extension-process --first-renderer-process --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\gen" --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1980,i,858333445890203828,17328569965507392984,131072 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Leading\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp" --mojo-platform-channel-handle=3944 --field-trial-handle=1980,i,858333445890203828,17328569965507392984,131072 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Leading\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp" --mojo-platform-channel-handle=3668 --field-trial-handle=1980,i,858333445890203828,17328569965507392984,131072 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Leading\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp" --mojo-platform-channel-handle=3788 --field-trial-handle=1980,i,858333445890203828,17328569965507392984,131072 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3220
- - C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Leading\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp" --mojo-platform-channel-handle=3944 --field-trial-handle=1980,i,858333445890203828,17328569965507392984,131072 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1964

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\Recently.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Leading\User Data\Default\Cache\Cache_Data\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Cache\Cache_Data\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Cache\Cache_Data\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Network\Network Persistent State

Filesize
405B

MD5
6426cdcba5a3dacc030238ab8a56b799

SHA1
bb968c68d9626569c9cfcc5fbf10b39ae8258188

SHA256
07d289dd2019922728b934d63bdab2c69085a1de02feeda05525354c86f449ed

SHA512
88fd14c607ad0b12abb504ddb9774657b52d35f29f3ff3217d61bbf20a1d9b1d6ec33da9fe2e179aeff750bcff05d4e9ea993e693580356b574a8462d4782139

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Network\Network Persistent State~RFe597640.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Network\TransportSecurity

Filesize
186B

MD5
7ae73462491ae02595ac1814e662f68f

SHA1
2c0e22242297d8ac653fc2e52f7d9b8a1014f1ac

SHA256
e5800192ada1563b09969d024d3128624b4ed41afc5653471fcfb2342c8fd197

SHA512
65628398cfca08ad99653b5adc72cd40dd4ecad448d8722683cd5d5303da7c82c4fccaca56c767119b9b1ce5b3c436ee23d0aecc5e6f873ec3a345afcbd538e2

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Network\TransportSecurity~RFe597640.TMP

Filesize
188B

MD5
a052ce3991272000f0bee1e571f34b6b

SHA1
255a5d62dfd33e240f3fad657f77f1ab3d898910

SHA256
baed59a7e3089aca956aa58e91e37e98b1f26996a1da23b4f341c2ea50e11c4e

SHA512
d7b055e48469b36457b8698bb7af96679d07c025e81227a8cfc15a210607d8a5d28b93fc11c8d1d74f4301db8b49803c4d10166e1944d349303a6bb493415e2f

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Preferences

Filesize
3KB

MD5
5e30e39a70c3aec3aac65b265aaa7edf

SHA1
6c35db38aedab8cdf2f9746c13159b8e88986c0a

SHA256
8c42962cdc20af4bad5caf1438cc524190b42236e37ff44f763a609337f4ec6c

SHA512
f16b1e8fdabc0b1c63a5e44883ecc69dbad95dba396b3cfc2ced7413030cac9ba545abc46af82981be4f49b1937ad4cafec3a72f7f7ee4e4e7033afaf5b130cb

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Preferences

Filesize
4KB

MD5
1b6a6fc8f0ccbd0a8f96a0f957940ac2

SHA1
044a1f3289f7f89e0a6016b23a00d9c58eb98d9b

SHA256
704bd0d661f54117c1b488eb68609eb78c0b8182bc22d2478909aac538cc355d

SHA512
c789d2b508a7f50b1c6dbdff70e95471bdaa0b935b572f99e4a644da426bfb8e53fcc4a2f0a1866c99d9aba50cad8a2054a969db77d0ca2fce794683ce666c63

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Preferences

Filesize
4KB

MD5
5fe67d5706ce7caefc70e41aa8c37e66

SHA1
6290bc8ae75b497fdb4a215a57d24f817f392344

SHA256
1355838014ec6baf9a1cd519fba727674fda53970929e5a0d4b3e30b1c6abd2e

SHA512
fb7ddef0d84980a1411f483125f830641d0bac154213c10e77cf91f7315dc172be09834258a3edb4ca20de2c9a863ab1c939f477064f6407c80fe699ec69c6ca

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Preferences

Filesize
3KB

MD5
984738024be4244f93bef415d0c69ee2

SHA1
93996781f3f5ce9abd4401b3aa21954f2f67dbf9

SHA256
5bbc0e8f95adf9f4d8e14fc6ceb917ceba9867540079a8c63cd4fa1b8cdb3758

SHA512
d044d6d7f875841d2c5953cb7877755afd0c2e3e84b8dbd3e956018a0b2d99cf24fd6ae4a42377372156d895feff854a120d6253046f733c5c85ffeceda459f1

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Preferences~RFe588855.TMP

Filesize
3KB

MD5
804c31e646d8951c39e971d0c45c3fca

SHA1
2b36596bb7d17a4d76c9ace4c8efc8f87202dd93

SHA256
7c2615cdaf01d199af8c39f6e399f25ad56104c11551b5a0ceb087d0dae5c64d

SHA512
7272f4ee4f2cd291553e563125a92527afd219cefe00fbb9de9233269a71b224e31c9052734b0386e1db57bc1fe13e4182d9850bc7b67bba62adb5e738821c3a

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Default\eb1e53c5-44ae-4fa5-91fb-41e5c0a1de72.tmp

Filesize
148KB

MD5
728fe78292f104659fea5fc90570cc75

SHA1
11b623f76f31ec773b79cdb74869acb08c4052cb

SHA256
d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20

SHA512
91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Local State

Filesize
3KB

MD5
18d3afab77cbea925eac982da7229a38

SHA1
7aa79c72f8d70e45d3ddf1185fa4faf1c95ea0ec

SHA256
86fa3594522e98a6bd33a956e3ca10b920106967a850d41c6d9b4372c58eee6a

SHA512
e150efe5154c4c792d660d3113fad57822f309a38e958b44987ae284b00e7d37801dbb1183cc588a64f7fa92f353751a4fd49257b2a026a68fe8516ab7f13cf0

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Local State

Filesize
3KB

MD5
74defdd7896eb8201307d5733d91871b

SHA1
a990650ecbf10376a6b3fb5fc64d6ff29b82b45b

SHA256
c78b02a162a7ee93e5d9f179ee0542720c680cdd43be9260a2643c1932508fc3

SHA512
e7a4574ce966ffa0fdfcc5988da97c55aac5ad176159fb132e22d211b8f8a17d1ac169d50330816f7bf2dcfa2755ddfa19f8a4fd0909ef40d590e935f355fe57

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Local State

Filesize
3KB

MD5
aa3728fec2ef1c7620234fe5778b1bdd

SHA1
618518b77d39ec2a451447ae7fd9551cbf52232f

SHA256
8efddbd877dff34c7db19c71dae912a9764c601441898e205361193451c37797

SHA512
d178cc0752dabe01d106c350c898ca9987cd642e26c4f96950e79d898280dc06abad5a07dc7b99b179b8f15a4db7491810035c38316d3eafa08b39e3a770d9d7

Download Submit
C:\Users\Admin\AppData\Local\Leading\User Data\Local State~RFe58602c.TMP

Filesize
916B

MD5
b864bd4c223093563b9541e26652bd3c

SHA1
af5e1a1636da099fee0d41846dd9cd2a3f915e79

SHA256
f2eb1e697c97410c29857e288721dfd50e77d719529f36c2caf8b171291f2ff4

SHA512
ac01d9d3605ebf9678c9cc7836524a78c628c4f627e4c0a05dba2993eb7db31a2589cf5c7b63590fedd681e1e09bfd09e8c41145be6b12a436d9a21ffaa3863c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\D3DCompiler_47.dll

Filesize
4.7MB

MD5
2191e768cc2e19009dad20dc999135a3

SHA1
f49a46ba0e954e657aaed1c9019a53d194272b6a

SHA256
7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

SHA512
5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\d3dcompiler_47.dll

Filesize
4.7MB

MD5
2191e768cc2e19009dad20dc999135a3

SHA1
f49a46ba0e954e657aaed1c9019a53d194272b6a

SHA256
7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

SHA512
5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\ffmpeg.dll

Filesize
1.9MB

MD5
fd7c24cec812df6da5ab450c7dff4b29

SHA1
d2beb2a9af3f670f4b976dd48332f2463014d36d

SHA256
f80d4d15f22ffb74b5f6716d2b018edd406b903b1d4d775a028c52b0b1a5098c

SHA512
5e64e2b243b9e82739fabad48cb5682bce872c856d214bf5840ee5015e57e7a666327235f88619407ac407d0c6e299ee10f34ee939dfee21e7535969b2a69705

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\ffmpeg.dll

Filesize
1.9MB

MD5
fd7c24cec812df6da5ab450c7dff4b29

SHA1
d2beb2a9af3f670f4b976dd48332f2463014d36d

SHA256
f80d4d15f22ffb74b5f6716d2b018edd406b903b1d4d775a028c52b0b1a5098c

SHA512
5e64e2b243b9e82739fabad48cb5682bce872c856d214bf5840ee5015e57e7a666327235f88619407ac407d0c6e299ee10f34ee939dfee21e7535969b2a69705

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\ffmpeg.dll

Filesize
1.9MB

MD5
fd7c24cec812df6da5ab450c7dff4b29

SHA1
d2beb2a9af3f670f4b976dd48332f2463014d36d

SHA256
f80d4d15f22ffb74b5f6716d2b018edd406b903b1d4d775a028c52b0b1a5098c

SHA512
5e64e2b243b9e82739fabad48cb5682bce872c856d214bf5840ee5015e57e7a666327235f88619407ac407d0c6e299ee10f34ee939dfee21e7535969b2a69705

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\ffmpeg.dll

Filesize
1.9MB

MD5
fd7c24cec812df6da5ab450c7dff4b29

SHA1
d2beb2a9af3f670f4b976dd48332f2463014d36d

SHA256
f80d4d15f22ffb74b5f6716d2b018edd406b903b1d4d775a028c52b0b1a5098c

SHA512
5e64e2b243b9e82739fabad48cb5682bce872c856d214bf5840ee5015e57e7a666327235f88619407ac407d0c6e299ee10f34ee939dfee21e7535969b2a69705

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\ffmpeg.dll

Filesize
1.9MB

MD5
fd7c24cec812df6da5ab450c7dff4b29

SHA1
d2beb2a9af3f670f4b976dd48332f2463014d36d

SHA256
f80d4d15f22ffb74b5f6716d2b018edd406b903b1d4d775a028c52b0b1a5098c

SHA512
5e64e2b243b9e82739fabad48cb5682bce872c856d214bf5840ee5015e57e7a666327235f88619407ac407d0c6e299ee10f34ee939dfee21e7535969b2a69705

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\ffmpeg.dll

Filesize
1.9MB

MD5
fd7c24cec812df6da5ab450c7dff4b29

SHA1
d2beb2a9af3f670f4b976dd48332f2463014d36d

SHA256
f80d4d15f22ffb74b5f6716d2b018edd406b903b1d4d775a028c52b0b1a5098c

SHA512
5e64e2b243b9e82739fabad48cb5682bce872c856d214bf5840ee5015e57e7a666327235f88619407ac407d0c6e299ee10f34ee939dfee21e7535969b2a69705

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\ffmpeg.dll

Filesize
1.9MB

MD5
fd7c24cec812df6da5ab450c7dff4b29

SHA1
d2beb2a9af3f670f4b976dd48332f2463014d36d

SHA256
f80d4d15f22ffb74b5f6716d2b018edd406b903b1d4d775a028c52b0b1a5098c

SHA512
5e64e2b243b9e82739fabad48cb5682bce872c856d214bf5840ee5015e57e7a666327235f88619407ac407d0c6e299ee10f34ee939dfee21e7535969b2a69705

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\ffmpeg.dll

Filesize
1.9MB

MD5
fd7c24cec812df6da5ab450c7dff4b29

SHA1
d2beb2a9af3f670f4b976dd48332f2463014d36d

SHA256
f80d4d15f22ffb74b5f6716d2b018edd406b903b1d4d775a028c52b0b1a5098c

SHA512
5e64e2b243b9e82739fabad48cb5682bce872c856d214bf5840ee5015e57e7a666327235f88619407ac407d0c6e299ee10f34ee939dfee21e7535969b2a69705

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\icudtl.dat

Filesize
10.1MB

MD5
2134e5dbc46fb1c46eac0fe1af710ec3

SHA1
dbecf2d193ae575aba4217194d4136bd9291d4db

SHA256
ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41

SHA512
b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\init\first_page.html

Filesize
226KB

MD5
816ed1e223f547df4ff1191ff52751ba

SHA1
37b6adef330c249cc9b47935aa113ee931bbde33

SHA256
a342a27d05bb0f1ddc8fd0c15d1b5c7c9a3017b49e4b280cc920d381bcbdf842

SHA512
57108b5235ed4f4f50cf22fe3b8a88013698fbecbf22ede7ea253de89123f2378d53935e43d32e9119c73a88813c74dbbdfcca13256f1f1cb797dfede95b8d9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\leading.exe

Filesize
2.4MB

MD5
0262b8204546ab726b863ddd4950c01e

SHA1
ae985bf18df5c6e90e450b37ad905666d36ffac3

SHA256
b6e493c92ab21d3cffc5efda72a0afcee29e817e87256ae754aecfe9a1b421ea

SHA512
8f49e6058d3aafa87a5f75529e23dc496ea6a56408fd3d375987cd544b332da20a95c41460a4a71351e8ac6c0fde804f0f60fb66c4b356f6bacf4dfd100b923d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\libEGL.dll

Filesize
447KB

MD5
c18cbf7e22b2e98288aa3af348e686df

SHA1
2ea21855ae28e9bc46185aab99c792e7044f6a9c

SHA256
43c16a5debbf298f8f3b447542f34dd21e35f0f81d9ad4f72944250e2d5a4de6

SHA512
89c0ccce3f5f16ebcad32b2a4de78c95a797bfb72152e29afb8bc9c3fbdfc84b65af489b0be6c8278f710c668cf188720085e3b66507065e0f82eb30519f0493

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\libGLESv2.dll

Filesize
6.5MB

MD5
cda6711894c01216c808a48f6f992a83

SHA1
e7a3ce25073f5c196402ac10b3e01f63700e0bec

SHA256
db7001f8f0dc3197c95209dda66a405c41ec9780420a19e54009ab0b7e718e5e

SHA512
bdf32e9175e8ba39a3fc026d02d0d8ad6528869dc879c6d5f342463d2e3a38433310b1a94dffd94228796d1628f2837decf4cf1bc1b640a41d58709d2ef86e39

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\libegl.dll

Filesize
447KB

MD5
c18cbf7e22b2e98288aa3af348e686df

SHA1
2ea21855ae28e9bc46185aab99c792e7044f6a9c

SHA256
43c16a5debbf298f8f3b447542f34dd21e35f0f81d9ad4f72944250e2d5a4de6

SHA512
89c0ccce3f5f16ebcad32b2a4de78c95a797bfb72152e29afb8bc9c3fbdfc84b65af489b0be6c8278f710c668cf188720085e3b66507065e0f82eb30519f0493

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\libglesv2.dll

Filesize
6.5MB

MD5
cda6711894c01216c808a48f6f992a83

SHA1
e7a3ce25073f5c196402ac10b3e01f63700e0bec

SHA256
db7001f8f0dc3197c95209dda66a405c41ec9780420a19e54009ab0b7e718e5e

SHA512
bdf32e9175e8ba39a3fc026d02d0d8ad6528869dc879c6d5f342463d2e3a38433310b1a94dffd94228796d1628f2837decf4cf1bc1b640a41d58709d2ef86e39

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\locales\ar-XB.pak.info

Filesize
858KB

MD5
99fdbd0a8d3e2f81c7dcbc5d58f2290a

SHA1
427cf8f04ab3971549fa6088673cce0c891bdbfd

SHA256
06b0e6d5e613dca6b5b764f70dffb04279638c51238cb53c990863088dd56fe6

SHA512
52ae660c7d3181e3e62788b8cb62c690d39ded93e2878afaae4b6484f81beb2d4d4d2da65a1c000f614d527183952777351bbe06b7b4cd2b92be4051e7cb6c10

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\locales\en-US.pak

Filesize
376KB

MD5
21bcad89f0b1506ecd763a5f264d661f

SHA1
742aa12ee4d8a6799cbc6dc56234fbc9328bc2f7

SHA256
6dd77b6637cc17108e035b9117c925456f6a991dedd4e0fdc353e0053cd8cc3b

SHA512
e64977d865b0063b359cbabc15eac972968c43759f54265457b99438a66ac7bd88795054d19c10dfb82f2c4c4e395de45be9b34a5ed9f34ff968233b5cf0fcf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\node.dll

Filesize
16.4MB

MD5
90051db88efa84fcf78d0de3deab1250

SHA1
691be263d65025552b75dac724f1f31bb905d24b

SHA256
01506561879947dfdcea9af183bb1dd3bbe84ca70e7fd94c1d895ee2286df576

SHA512
9ba8d8c030d765d226223bd1a5d7163b661fbf62f2919c1ac04f808294227e8809aa7bd94e7cb6d3010903c8f1758835e2a8f5de4d9d304d8138d28a7b5104da

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\node.dll

Filesize
16.4MB

MD5
90051db88efa84fcf78d0de3deab1250

SHA1
691be263d65025552b75dac724f1f31bb905d24b

SHA256
01506561879947dfdcea9af183bb1dd3bbe84ca70e7fd94c1d895ee2286df576

SHA512
9ba8d8c030d765d226223bd1a5d7163b661fbf62f2919c1ac04f808294227e8809aa7bd94e7cb6d3010903c8f1758835e2a8f5de4d9d304d8138d28a7b5104da

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw.dll

Filesize
184.8MB

MD5
66a5492587255f16eea3387a8a274745

SHA1
716f69612ec516a0f33ee82dfee2db77989d454e

SHA256
ae4c397c0367917cbf50dfff0d85e70946c4b33530c98b4b930faf2b3923e10f

SHA512
16c390ee1a17ef8c9f987bc75baa350aa0f0f126fdfeebab3812331fbdc75ac69e8f1aec62d2569b3c46bdf73dbd0e68ee44a0198b646fdc9b705ece8a0d039c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw.dll

Filesize
184.8MB

MD5
66a5492587255f16eea3387a8a274745

SHA1
716f69612ec516a0f33ee82dfee2db77989d454e

SHA256
ae4c397c0367917cbf50dfff0d85e70946c4b33530c98b4b930faf2b3923e10f

SHA512
16c390ee1a17ef8c9f987bc75baa350aa0f0f126fdfeebab3812331fbdc75ac69e8f1aec62d2569b3c46bdf73dbd0e68ee44a0198b646fdc9b705ece8a0d039c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw.dll

Filesize
184.8MB

MD5
66a5492587255f16eea3387a8a274745

SHA1
716f69612ec516a0f33ee82dfee2db77989d454e

SHA256
ae4c397c0367917cbf50dfff0d85e70946c4b33530c98b4b930faf2b3923e10f

SHA512
16c390ee1a17ef8c9f987bc75baa350aa0f0f126fdfeebab3812331fbdc75ac69e8f1aec62d2569b3c46bdf73dbd0e68ee44a0198b646fdc9b705ece8a0d039c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw.dll

Filesize
184.8MB

MD5
66a5492587255f16eea3387a8a274745

SHA1
716f69612ec516a0f33ee82dfee2db77989d454e

SHA256
ae4c397c0367917cbf50dfff0d85e70946c4b33530c98b4b930faf2b3923e10f

SHA512
16c390ee1a17ef8c9f987bc75baa350aa0f0f126fdfeebab3812331fbdc75ac69e8f1aec62d2569b3c46bdf73dbd0e68ee44a0198b646fdc9b705ece8a0d039c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw.dll

Filesize
184.8MB

MD5
66a5492587255f16eea3387a8a274745

SHA1
716f69612ec516a0f33ee82dfee2db77989d454e

SHA256
ae4c397c0367917cbf50dfff0d85e70946c4b33530c98b4b930faf2b3923e10f

SHA512
16c390ee1a17ef8c9f987bc75baa350aa0f0f126fdfeebab3812331fbdc75ac69e8f1aec62d2569b3c46bdf73dbd0e68ee44a0198b646fdc9b705ece8a0d039c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw.dll

Filesize
184.8MB

MD5
66a5492587255f16eea3387a8a274745

SHA1
716f69612ec516a0f33ee82dfee2db77989d454e

SHA256
ae4c397c0367917cbf50dfff0d85e70946c4b33530c98b4b930faf2b3923e10f

SHA512
16c390ee1a17ef8c9f987bc75baa350aa0f0f126fdfeebab3812331fbdc75ac69e8f1aec62d2569b3c46bdf73dbd0e68ee44a0198b646fdc9b705ece8a0d039c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw.dll

Filesize
184.8MB

MD5
66a5492587255f16eea3387a8a274745

SHA1
716f69612ec516a0f33ee82dfee2db77989d454e

SHA256
ae4c397c0367917cbf50dfff0d85e70946c4b33530c98b4b930faf2b3923e10f

SHA512
16c390ee1a17ef8c9f987bc75baa350aa0f0f126fdfeebab3812331fbdc75ac69e8f1aec62d2569b3c46bdf73dbd0e68ee44a0198b646fdc9b705ece8a0d039c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw.dll

Filesize
184.8MB

MD5
66a5492587255f16eea3387a8a274745

SHA1
716f69612ec516a0f33ee82dfee2db77989d454e

SHA256
ae4c397c0367917cbf50dfff0d85e70946c4b33530c98b4b930faf2b3923e10f

SHA512
16c390ee1a17ef8c9f987bc75baa350aa0f0f126fdfeebab3812331fbdc75ac69e8f1aec62d2569b3c46bdf73dbd0e68ee44a0198b646fdc9b705ece8a0d039c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_100_percent.pak

Filesize
594KB

MD5
4bda83b1eb1537cd67d948f695195ce2

SHA1
b22e6f4801c60146e16db8c76debdc300b013598

SHA256
28373cf7fd7833376e82addcda9e912088a18a40c015ccbc6c4141a60789f03a

SHA512
58759d5413d86c02c5ed1798c9168e9732f44fc0adb5457e6e10cebed0709b6116415f99a7e23122d7d48befc89d7720f1b2d8712f8189f2567d1bc146abf109

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_200_percent.pak

Filesize
892KB

MD5
df8cac034cf524b50ce4f33f4e02d0d4

SHA1
0c828f136bd35caddcbca2f100d2dec61f20c65f

SHA256
6990dd16706aa10fd1b204a2731e05e380b60bef9e4ee1d08f02cd74c4657c4e

SHA512
0089e77e53f67174fe2bf36ba4ad8972b82b3f771d87b84419c2e5eaaa669f672a2b737e3598bdcc2bb62670d55d9211f2d135d6c506060195da75cbcc92bb8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_elf.dll

Filesize
1.0MB

MD5
10c43dddda567948b2f7377db36374e7

SHA1
bf1ddc58a8f050a6de18b51d1f9bb0f159cd098a

SHA256
f75c76ff8766c993c1d5fac647f94d17c622d9d9462fd590ae37997f507bbc82

SHA512
617cbaf731f0dfa3e8a5cb1ffbbcc49780e33f685573687d07bd1674ef659b4cfd25a8c10702fc81b531e84d1ad5f5d6aaa2c79866fb6016d45c83a5df55c361

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_elf.dll

Filesize
1.0MB

MD5
10c43dddda567948b2f7377db36374e7

SHA1
bf1ddc58a8f050a6de18b51d1f9bb0f159cd098a

SHA256
f75c76ff8766c993c1d5fac647f94d17c622d9d9462fd590ae37997f507bbc82

SHA512
617cbaf731f0dfa3e8a5cb1ffbbcc49780e33f685573687d07bd1674ef659b4cfd25a8c10702fc81b531e84d1ad5f5d6aaa2c79866fb6016d45c83a5df55c361

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_elf.dll

Filesize
1.0MB

MD5
10c43dddda567948b2f7377db36374e7

SHA1
bf1ddc58a8f050a6de18b51d1f9bb0f159cd098a

SHA256
f75c76ff8766c993c1d5fac647f94d17c622d9d9462fd590ae37997f507bbc82

SHA512
617cbaf731f0dfa3e8a5cb1ffbbcc49780e33f685573687d07bd1674ef659b4cfd25a8c10702fc81b531e84d1ad5f5d6aaa2c79866fb6016d45c83a5df55c361

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_elf.dll

Filesize
1.0MB

MD5
10c43dddda567948b2f7377db36374e7

SHA1
bf1ddc58a8f050a6de18b51d1f9bb0f159cd098a

SHA256
f75c76ff8766c993c1d5fac647f94d17c622d9d9462fd590ae37997f507bbc82

SHA512
617cbaf731f0dfa3e8a5cb1ffbbcc49780e33f685573687d07bd1674ef659b4cfd25a8c10702fc81b531e84d1ad5f5d6aaa2c79866fb6016d45c83a5df55c361

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_elf.dll

Filesize
1.0MB

MD5
10c43dddda567948b2f7377db36374e7

SHA1
bf1ddc58a8f050a6de18b51d1f9bb0f159cd098a

SHA256
f75c76ff8766c993c1d5fac647f94d17c622d9d9462fd590ae37997f507bbc82

SHA512
617cbaf731f0dfa3e8a5cb1ffbbcc49780e33f685573687d07bd1674ef659b4cfd25a8c10702fc81b531e84d1ad5f5d6aaa2c79866fb6016d45c83a5df55c361

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_elf.dll

Filesize
1.0MB

MD5
10c43dddda567948b2f7377db36374e7

SHA1
bf1ddc58a8f050a6de18b51d1f9bb0f159cd098a

SHA256
f75c76ff8766c993c1d5fac647f94d17c622d9d9462fd590ae37997f507bbc82

SHA512
617cbaf731f0dfa3e8a5cb1ffbbcc49780e33f685573687d07bd1674ef659b4cfd25a8c10702fc81b531e84d1ad5f5d6aaa2c79866fb6016d45c83a5df55c361

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_elf.dll

Filesize
1.0MB

MD5
10c43dddda567948b2f7377db36374e7

SHA1
bf1ddc58a8f050a6de18b51d1f9bb0f159cd098a

SHA256
f75c76ff8766c993c1d5fac647f94d17c622d9d9462fd590ae37997f507bbc82

SHA512
617cbaf731f0dfa3e8a5cb1ffbbcc49780e33f685573687d07bd1674ef659b4cfd25a8c10702fc81b531e84d1ad5f5d6aaa2c79866fb6016d45c83a5df55c361

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_elf.dll

Filesize
1.0MB

MD5
10c43dddda567948b2f7377db36374e7

SHA1
bf1ddc58a8f050a6de18b51d1f9bb0f159cd098a

SHA256
f75c76ff8766c993c1d5fac647f94d17c622d9d9462fd590ae37997f507bbc82

SHA512
617cbaf731f0dfa3e8a5cb1ffbbcc49780e33f685573687d07bd1674ef659b4cfd25a8c10702fc81b531e84d1ad5f5d6aaa2c79866fb6016d45c83a5df55c361

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_elf.dll

Filesize
1.0MB

MD5
10c43dddda567948b2f7377db36374e7

SHA1
bf1ddc58a8f050a6de18b51d1f9bb0f159cd098a

SHA256
f75c76ff8766c993c1d5fac647f94d17c622d9d9462fd590ae37997f507bbc82

SHA512
617cbaf731f0dfa3e8a5cb1ffbbcc49780e33f685573687d07bd1674ef659b4cfd25a8c10702fc81b531e84d1ad5f5d6aaa2c79866fb6016d45c83a5df55c361

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\nw_elf.dll

Filesize
1.0MB

MD5
10c43dddda567948b2f7377db36374e7

SHA1
bf1ddc58a8f050a6de18b51d1f9bb0f159cd098a

SHA256
f75c76ff8766c993c1d5fac647f94d17c622d9d9462fd590ae37997f507bbc82

SHA512
617cbaf731f0dfa3e8a5cb1ffbbcc49780e33f685573687d07bd1674ef659b4cfd25a8c10702fc81b531e84d1ad5f5d6aaa2c79866fb6016d45c83a5df55c361

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\package.json

Filesize
301B

MD5
5672b11b538c09d1db78b9bf9fa7cfc6

SHA1
850ad88e7506a1d3f43a35e06348645cfe30ca75

SHA256
f2162636435644a704f8d5ff826e41cc69a0b30475976c9610c4f43ee47d29b8

SHA512
466c9ddb54394958c93ae9669be7d0d92e2fc23674c2d2b62895053fb37c4e7072d3e4e5f962450f79c27faeb3c382823546b0685dc0773f9d9f275d1182f02d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\resources.pak

Filesize
4.4MB

MD5
35526eace95213b5700faafab7b78010

SHA1
67862f1cee594ba072d4c307d044209065b67898

SHA256
a2864d0ed4a09fe7d41b7327dcb301b75911a34788a7d9285f170d5a063d765b

SHA512
baa5e7f40f1d8096ea858a17fdb822d525875a547bc22c2219d730049d5ee15d5311222391c7e120d403bf62543019abd19b9110d672286b7d2314170d14408b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\v8_context_snapshot.bin

Filesize
563KB

MD5
94a5220fa58e66db857db80a34e1de52

SHA1
e2c5659c3a256b053b20d396dc950d5c1d7c02fe

SHA256
b071ef6395ac47112591258be2afaa4ebd5c2bb79d57f3c76d1f435e89d78f85

SHA512
d7318d1e80e9745f70ccbd822efc08a1173ff370502dc568ebd84d28ba5d7e27f3ab5aff59536321b882b4526b2fc9468382c6772697360b8156fd97bc40b95d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\vk_swiftshader.dll

Filesize
4.3MB

MD5
2c74b1ce5c53fee3ae3d028651503292

SHA1
e5be4b8a390547d9f953733608a084d28a410294

SHA256
03f72e6d2111c8bdb7e907293eda8d1946abfbdd5302ccf960e04b8090a1daed

SHA512
c715cc99d3bea9138381cb8de7382c0238b1437a50ec6fcd31d2efaf04a9063c46de7487448247c5d5ee8c6fee58488580544b0828735e8877d5a50ec5c40410

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\vk_swiftshader.dll

Filesize
4.3MB

MD5
2c74b1ce5c53fee3ae3d028651503292

SHA1
e5be4b8a390547d9f953733608a084d28a410294

SHA256
03f72e6d2111c8bdb7e907293eda8d1946abfbdd5302ccf960e04b8090a1daed

SHA512
c715cc99d3bea9138381cb8de7382c0238b1437a50ec6fcd31d2efaf04a9063c46de7487448247c5d5ee8c6fee58488580544b0828735e8877d5a50ec5c40410

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\vulkan-1.dll

Filesize
869KB

MD5
2d2549ec719bc6de8fbcb0f3b194dad7

SHA1
08f998c46229a00546ed8ca8c6915d179ef880b1

SHA256
882b2b701efe7fdc8979099c089ae51c386d574b9c49d333f778d7b166883cb1

SHA512
d34e2d713a3b6e4dfd2a257891335b1a31636832e6582295a724820244e0761009dd877705fc558f64498fa913ee6c0af2f7cfcecf13ba5a46bdc582139571bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAE80.tmp\vulkan-1.dll

Filesize
869KB

MD5
2d2549ec719bc6de8fbcb0f3b194dad7

SHA1
08f998c46229a00546ed8ca8c6915d179ef880b1

SHA256
882b2b701efe7fdc8979099c089ae51c386d574b9c49d333f778d7b166883cb1

SHA512
d34e2d713a3b6e4dfd2a257891335b1a31636832e6582295a724820244e0761009dd877705fc558f64498fa913ee6c0af2f7cfcecf13ba5a46bdc582139571bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
202B

MD5
8e56ace3e1a321219fb91f6a902cbf3f

SHA1
a891636695dbd8ebe582bada0a821c0b0b2c5ffe

SHA256
8f87addb7d39c9cbbc86110d8f6eb08a97fa9402a82054f241b3901ba0afc9e8

SHA512
79f346ef5cfd4779430b472c80d1e2fb585cd944e9b83c55f18badd8b1cf697e84a4054bb31fe46fa08b2ad00cef2c0bcab5be4f20ef19d925172bce0c8fb8ba

Download Submit
memory/3664-710-0x00007FFD6E230000-0x00007FFD6E240000-memory.dmp

Filesize
64KB

Download
memory/3664-711-0x00007FFD6E230000-0x00007FFD6E240000-memory.dmp

Filesize
64KB

Download
memory/3664-712-0x00007FFD6E230000-0x00007FFD6E240000-memory.dmp

Filesize
64KB

Download
memory/3664-713-0x00007FFD6E230000-0x00007FFD6E240000-memory.dmp

Filesize
64KB

Download
memory/3664-714-0x00007FFD6E230000-0x00007FFD6E240000-memory.dmp

Filesize
64KB

Download
memory/3664-715-0x00007FFD6BE50000-0x00007FFD6BE60000-memory.dmp

Filesize
64KB

Download
memory/3664-716-0x00007FFD6BE50000-0x00007FFD6BE60000-memory.dmp

Filesize
64KB

Download