6d33ad3388ccc8eb5021b2e0b1380d635dd434e28f863c682b7591ebc9bffff9

Analysis

max time kernel
103s
max time network
119s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
17-07-2023 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

barcode-to-pc-server.v4.5.1.win.setup.exe
Size

2.9MB
MD5

047a0831b0fbfdd1749f505b3b296643
SHA1

f647411ab60c35d302b6367d3995bb72a3ac9ae6
SHA256

6d33ad3388ccc8eb5021b2e0b1380d635dd434e28f863c682b7591ebc9bffff9
SHA512

50ba03efc606fdb89776970d7724ffc9b854035cfbc04a18ebdacdfb16456b3be2fe1fbc195a430c694bae27e28b0abf6e829055594ae113927a5fd9695c3844
SSDEEP

49152:JjDwK73pfqvCRDAOqM0ErZnh4vUgi9GZ0wK/JI1ZNfDrEHosPIa+2h7Y5Yv/nrP:dj7ZyOqUY8p87ei1fEHoIO5Y3z

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
23	4048	msiexec.exe
28	4048	msiexec.exe
30	4048	msiexec.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4608	netsh.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dnssd.dll	msiexec.exe
File created	C:\Windows\system32\dnssd.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dnssdX.dll	msiexec.exe
File created	C:\Windows\system32\dnssdX.dll	msiexec.exe
File created	C:\Windows\SysWOW64\jdns_sd.dll	msiexec.exe
File created	C:\Windows\system32\jdns_sd.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dns-sd.exe	msiexec.exe
File created	C:\Windows\system32\dns-sd.exe	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Barcode to PC server\chrome_100_percent.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\mr.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\msvcp140.dll	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\ko.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\clipboardy\index.js	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\icudtl.dat	barcode-to-pc-server.v4.5.1.win.setup.exe
File opened for modification	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\id.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\ms.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File opened for modification	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\libGLESv2.dll	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\ml.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\th.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\clipboardy\fallbacks\windows\clipboard_i686.exe	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Bonjour\dns_sd.jar	msiexec.exe
File created	C:\Program Files\Barcode to PC server\resources.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\libnut.node	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\pt_PT.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\Barcode to PC server\locales\ar.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\zh-TW.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\clipboardy\lib\linux.js	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\es.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\lv.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File opened for modification	C:\Program Files\Barcode to PC server\swiftshader	barcode-to-pc-server.v4.5.1.win.setup.exe
File opened for modification	C:\Program Files\Barcode to PC server\locales	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\pt.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\Barcode to PC server\locales\cs.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\en-GB.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\vcruntime140_1.dll	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\it.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\Barcode to PC server\locales\kn.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\elevate.exe	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\index.js	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\swiftshader\libGLESv2.dll	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\ext\dns_sd.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\ext\dns_sd.jar	msiexec.exe
File created	C:\Program Files\Barcode to PC server\locales\am.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\hi.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\ru.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\dns_sd.jar	msiexec.exe
File created	C:\Program Files\Bonjour\mDNSResponder.exe	msiexec.exe
File created	C:\Program Files\Barcode to PC server\locales\gu.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\sw.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\uk.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File opened for modification	C:\Program Files\Barcode to PC server\resources	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\sl.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\ffmpeg.dll	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\da.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\el.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\hu.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\nl.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\pt-BR.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\ro.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\app-update.yml	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\LICENSE.md	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\api-ms-win-crt-heap-l1-1-0.dll	barcode-to-pc-server.v4.5.1.win.setup.exe
File opened for modification	C:\Program Files\Barcode to PC server\resources\btpt.ico	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\Barcode to PC server.exe	barcode-to-pc-server.v4.5.1.win.setup.exe
File opened for modification	C:\Program Files\Barcode to PC server\Barcode to PC server.exe	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\LICENSE.electron.txt	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\bg.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\locales\zh-CN.pak	barcode-to-pc-server.v4.5.1.win.setup.exe
File opened for modification	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32	barcode-to-pc-server.v4.5.1.win.setup.exe
File created	C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\api-ms-win-crt-runtime-l1-1-0.dll	barcode-to-pc-server.v4.5.1.win.setup.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58a3fb.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB95F.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a400.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a3fb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB17C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB228.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB10.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB41D.tmp	msiexec.exe
File created	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIADE0.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB0FE.tmp	msiexec.exe
File created	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\Bonjour.ico	msiexec.exe

Executes dropped EXE 7 IoCs

pid	Process
392	mDNSResponder.exe
2648	Process not Found
1296	Barcode to PC server.exe
1536	Barcode to PC server.exe
5072	Barcode to PC server.exe
4404	Barcode to PC server.exe
3140	Barcode to PC server.exe

Loads dropped DLL 34 IoCs

pid	Process
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
3468	MsiExec.exe
3468	MsiExec.exe
4660	MsiExec.exe
3092	MsiExec.exe
2772	MsiExec.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
1296	Barcode to PC server.exe
2364	Process not Found
1296	Barcode to PC server.exe
1296	Barcode to PC server.exe
1296	Barcode to PC server.exe
1296	Barcode to PC server.exe
1536	Barcode to PC server.exe
5072	Barcode to PC server.exe
4404	Barcode to PC server.exe
3140	Barcode to PC server.exe
5072	Barcode to PC server.exe
5072	Barcode to PC server.exe
5072	Barcode to PC server.exe

Registers COM server for autorun 1 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ThreadingModel = "Both"	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\VersionIndependentProgID\ = "Bonjour.DNSSDRecord"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord\ = "DNSSDRecord Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B0163E6D0340BE4183EB2758E9BEDD8\Bonjour	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B0163E6D0340BE4183EB2758E9BEDD8\mDNSResponder = "Bonjour"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B0163E6D0340BE4183EB2758E9BEDD8\JavaSupport = "Bonjour"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B0163E6D0340BE4183EB2758E9BEDD8\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3229013990-3330391637-2814184332-1000_Classes\btplink\shell	Barcode to PC server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B0163E6D0340BE4183EB2758E9BEDD8\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{56608F9C-223B-4CB6-813D-85EDCCADFB4B}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3229013990-3330391637-2814184332-1000_Classes\btplink\ = "URL:btplink"	Barcode to PC server.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\NumMethods\ = "9"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ = "DNSSDRecord Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0\0\win64\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B0163E6D0340BE4183EB2758E9BEDD8\SourceList\PackageName = "Bonjour64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord\CurVer\ = "Bonjour.DNSSDRecord.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\ = "IDNSSDEventManager"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ = "ITXTRecord"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0\0\win32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\NumMethods\ = "19"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1523EA646D34FC14C8FD9E203C58611D	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Barcode to PC Output Template	barcode-to-pc-server.v4.5.1.win.setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0\HELPDIR	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ = "ITXTRecord"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B0163E6D0340BE4183EB2758E9BEDD8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nsh8C14.tmp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\NumMethods\ = "7"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDEventManager\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3229013990-3330391637-2814184332-1000_Classes\btplink	Barcode to PC server.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
4472	barcode-to-pc-server.v4.5.1.win.setup.exe
1296	Barcode to PC server.exe
1296	Barcode to PC server.exe
1296	Barcode to PC server.exe
1296	Barcode to PC server.exe
1296	Barcode to PC server.exe
1296	Barcode to PC server.exe
1296	Barcode to PC server.exe
1296	Barcode to PC server.exe
4404	Barcode to PC server.exe
4404	Barcode to PC server.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4472	barcode-to-pc-server.v4.5.1.win.setup.exe
Token: SeShutdownPrivilege	2288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2288	msiexec.exe
Token: SeSecurityPrivilege	4048	msiexec.exe
Token: SeCreateTokenPrivilege	2288	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2288	msiexec.exe
Token: SeLockMemoryPrivilege	2288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2288	msiexec.exe
Token: SeMachineAccountPrivilege	2288	msiexec.exe
Token: SeTcbPrivilege	2288	msiexec.exe
Token: SeSecurityPrivilege	2288	msiexec.exe
Token: SeTakeOwnershipPrivilege	2288	msiexec.exe
Token: SeLoadDriverPrivilege	2288	msiexec.exe
Token: SeSystemProfilePrivilege	2288	msiexec.exe
Token: SeSystemtimePrivilege	2288	msiexec.exe
Token: SeProfSingleProcessPrivilege	2288	msiexec.exe
Token: SeIncBasePriorityPrivilege	2288	msiexec.exe
Token: SeCreatePagefilePrivilege	2288	msiexec.exe
Token: SeCreatePermanentPrivilege	2288	msiexec.exe
Token: SeBackupPrivilege	2288	msiexec.exe
Token: SeRestorePrivilege	2288	msiexec.exe
Token: SeShutdownPrivilege	2288	msiexec.exe
Token: SeDebugPrivilege	2288	msiexec.exe
Token: SeAuditPrivilege	2288	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2288	msiexec.exe
Token: SeChangeNotifyPrivilege	2288	msiexec.exe
Token: SeRemoteShutdownPrivilege	2288	msiexec.exe
Token: SeUndockPrivilege	2288	msiexec.exe
Token: SeSyncAgentPrivilege	2288	msiexec.exe
Token: SeEnableDelegationPrivilege	2288	msiexec.exe
Token: SeManageVolumePrivilege	2288	msiexec.exe
Token: SeImpersonatePrivilege	2288	msiexec.exe
Token: SeCreateGlobalPrivilege	2288	msiexec.exe
Token: SeBackupPrivilege	3740	vssvc.exe
Token: SeRestorePrivilege	3740	vssvc.exe
Token: SeAuditPrivilege	3740	vssvc.exe
Token: SeBackupPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeBackupPrivilege	1192	srtasks.exe
Token: SeRestorePrivilege	1192	srtasks.exe
Token: SeSecurityPrivilege	1192	srtasks.exe
Token: SeTakeOwnershipPrivilege	1192	srtasks.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeBackupPrivilege	1192	srtasks.exe
Token: SeRestorePrivilege	1192	srtasks.exe
Token: SeSecurityPrivilege	1192	srtasks.exe
Token: SeTakeOwnershipPrivilege	1192	srtasks.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2288	msiexec.exe
2288	msiexec.exe
2288	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2288	4472	barcode-to-pc-server.v4.5.1.win.setup.exe	71
PID 4472 wrote to memory of 2288	4472	barcode-to-pc-server.v4.5.1.win.setup.exe	71
PID 4472 wrote to memory of 2288	4472	barcode-to-pc-server.v4.5.1.win.setup.exe	71
PID 4048 wrote to memory of 1192	4048	msiexec.exe	78
PID 4048 wrote to memory of 1192	4048	msiexec.exe	78
PID 4048 wrote to memory of 4448	4048	msiexec.exe	81
PID 4048 wrote to memory of 4448	4048	msiexec.exe	81
PID 4048 wrote to memory of 3468	4048	msiexec.exe	82
PID 4048 wrote to memory of 3468	4048	msiexec.exe	82
PID 4048 wrote to memory of 3468	4048	msiexec.exe	82
PID 4048 wrote to memory of 4660	4048	msiexec.exe	83
PID 4048 wrote to memory of 4660	4048	msiexec.exe	83
PID 4048 wrote to memory of 4660	4048	msiexec.exe	83
PID 4048 wrote to memory of 3092	4048	msiexec.exe	84
PID 4048 wrote to memory of 3092	4048	msiexec.exe	84
PID 4048 wrote to memory of 2772	4048	msiexec.exe	86
PID 4048 wrote to memory of 2772	4048	msiexec.exe	86
PID 4048 wrote to memory of 2772	4048	msiexec.exe	86
PID 4472 wrote to memory of 4608	4472	barcode-to-pc-server.v4.5.1.win.setup.exe	88
PID 4472 wrote to memory of 4608	4472	barcode-to-pc-server.v4.5.1.win.setup.exe	88
PID 4472 wrote to memory of 4608	4472	barcode-to-pc-server.v4.5.1.win.setup.exe	88
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 5072	1296	Barcode to PC server.exe	92
PID 1296 wrote to memory of 4404	1296	Barcode to PC server.exe	94
PID 1296 wrote to memory of 4404	1296	Barcode to PC server.exe	94
PID 1296 wrote to memory of 3140	1296	Barcode to PC server.exe	95

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\barcode-to-pc-server.v4.5.1.win.setup.exe
"C:\Users\Admin\AppData\Local\Temp\barcode-to-pc-server.v4.5.1.win.setup.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\msiexec.exe
  "msiexec" /i "C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\Bonjour64.msi" /passive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2288
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="Barcode to PC server" dir=in action=allow program="C:\Program Files\Barcode to PC server\Barcode to PC server.exe" enable=yes profile=public,private
  2⤵
  - Modifies Windows Firewall
  PID:4608

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1192
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EF0D2879B388FBD1B7CFB15E5AB38F23
  2⤵
  - Loads dropped DLL
  PID:4448
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D343AFC2313DFC786507A8E320782EBB
  2⤵
  - Loads dropped DLL
  PID:3468
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 981D65D477D9234DE60E56C4D86DA281 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:4660
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:3092
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:2772

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:332

C:\Program Files\Bonjour\mDNSResponder.exe
"C:\Program Files\Bonjour\mDNSResponder.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:392

C:\Program Files\Barcode to PC server\Barcode to PC server.exe
"C:\Program Files\Barcode to PC server\Barcode to PC server.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files\Barcode to PC server\Barcode to PC server.exe
  "C:\Program Files\Barcode to PC server\Barcode to PC server.exe" --type=gpu-process --field-trial-handle=1508,18352935499923410933,2122046331809999271,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\barcode-to-pc-server" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5072
- C:\Program Files\Barcode to PC server\Barcode to PC server.exe
  "C:\Program Files\Barcode to PC server\Barcode to PC server.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\barcode-to-pc-server" --app-path="C:\Program Files\Barcode to PC server\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1508,18352935499923410933,2122046331809999271,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
    3⤵
    PID:784
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
      4⤵
      PID:3232
- C:\Program Files\Barcode to PC server\Barcode to PC server.exe
  "C:\Program Files\Barcode to PC server\Barcode to PC server.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,18352935499923410933,2122046331809999271,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\barcode-to-pc-server" --mojo-platform-channel-handle=1952 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3140
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic list full
  2⤵
  PID:4644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  PID:4632
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2168
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic list full
  2⤵
  PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  PID:4492
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:1576
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic where "NetConnectionID = 'Ethernet'" get MACAddress /value
  2⤵
  PID:536
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic where "NetConnectionID = 'Ethernet'" get MACAddress /value
  2⤵
  PID:4480
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic where "NetConnectionID = 'Ethernet'" get MACAddress /value
  2⤵
  PID:4612
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic where "NetConnectionID = 'Ethernet'" get MACAddress /value
  2⤵
  PID:4600
- C:\Windows\System32\Wbem\wmic.exe
  wmic nicconfig where "MACAddress = '72:2D:6E:41:73:06'" get IPSubnet /value
  2⤵
  PID:964
- C:\Windows\System32\Wbem\wmic.exe
  wmic nicconfig where "MACAddress = '72:2D:6E:41:73:06'" get DefaultIPGateway /value
  2⤵
  PID:5040
- C:\Windows\System32\Wbem\wmic.exe
  wmic nicconfig where "MACAddress = '72:2D:6E:41:73:06'" get DefaultIPGateway /value
  2⤵
  PID:4380
- C:\Windows\System32\Wbem\wmic.exe
  wmic nicconfig where "MACAddress = '72:2D:6E:41:73:06'" get IPSubnet /value
  2⤵
  PID:4548
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic where "NetConnectionStatus = 2" get NetConnectionID /value
  2⤵
  PID:4512

C:\Program Files\Barcode to PC server\Barcode to PC server.exe
"C:\Program Files\Barcode to PC server\Barcode to PC server.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536
- C:\Program Files\Barcode to PC server\Barcode to PC server.exe
  "C:\Program Files\Barcode to PC server\Barcode to PC server.exe" --type=gpu-process --field-trial-handle=1544,8113310544951530732,11927090416434708302,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\barcode-to-pc-server" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 /prefetch:2
  2⤵
  PID:4948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58a3fe.rbs

Filesize
119KB

MD5
4e90347e3b02bd972f2636fa5fc60540

SHA1
3e11294eaa254eb02db2d8a27faa4007436a100f

SHA256
9a9ab6530c2493cdd40a9fefb61650ac3651c04424368c2d1d7ad93e440f94b9

SHA512
4c6a70b36497a3fef60ee1435fe1e1c827f22cb8b70c19900d52b476de6f2caefbe8d07a62bcb101f6224a24dd0de2b843903cde5697fd37307e01b451990266

Download Submit
C:\Program Files (x86)\Bonjour\mDNSResponder.exe

Filesize
381KB

MD5
db5bea73edaf19ac68b2c0fad0f92b1a

SHA1
74bb0197763e386036751bf30c5bbf4c389fa24e

SHA256
10f21999ff6b1d410ebf280f7f27deaca5289739cf12f4293b614b8fc6c88dcc

SHA512
63b718288c266debf3f58ac1a62cdcca6f09350616d53a406271d8f4fe6144751eddf7b7ba2dbfe79cfda671ee5afbdbae5798204edaaf4f0391895b824ae7c5

Download Submit
C:\Program Files (x86)\Bonjour\mdnsNSP.dll

Filesize
118KB

MD5
40947436a70e0034e41123df5a0a7702

SHA1
6c27e1dd1c1533feb6435190a5074300ac2a9822

SHA256
5d40fd92da5ca59c1badb58ad509db6a6d613f18660a9a270a53eca85d34c3a9

SHA512
ba5634cc82f306245f9f0350bfa0b91e2f5ffc6c355b1452a95483f47e6acdb42c4e063f6c15115faf0f0630005df4fe8ef0e01539c270031cbd07a34a929704

Download Submit
C:\Program Files\Barcode to PC server\Barcode to PC server.exe

Filesize
130.6MB

MD5
43bc55780520edad03a49af18bade7c4

SHA1
981cbe7c457337c724a2c20614e1bf985ecf4650

SHA256
be0d6a0aaff6caf1d178efc54505419fd94a96f8c165a40d55d761763022632f

SHA512
7126b5713acab052baaf374321bd7c7ec189e299144f3d7f7d0aaef1d04aacdcb9c37225d4f2526c1197338c10cbd2033f5ea88c3f3bdb1f5597ed8dee4a3aa1

Download Submit
C:\Program Files\Barcode to PC server\Barcode to PC server.exe

Filesize
130.6MB

MD5
43bc55780520edad03a49af18bade7c4

SHA1
981cbe7c457337c724a2c20614e1bf985ecf4650

SHA256
be0d6a0aaff6caf1d178efc54505419fd94a96f8c165a40d55d761763022632f

SHA512
7126b5713acab052baaf374321bd7c7ec189e299144f3d7f7d0aaef1d04aacdcb9c37225d4f2526c1197338c10cbd2033f5ea88c3f3bdb1f5597ed8dee4a3aa1

Download Submit
C:\Program Files\Barcode to PC server\Barcode to PC server.exe

Filesize
130.6MB

MD5
43bc55780520edad03a49af18bade7c4

SHA1
981cbe7c457337c724a2c20614e1bf985ecf4650

SHA256
be0d6a0aaff6caf1d178efc54505419fd94a96f8c165a40d55d761763022632f

SHA512
7126b5713acab052baaf374321bd7c7ec189e299144f3d7f7d0aaef1d04aacdcb9c37225d4f2526c1197338c10cbd2033f5ea88c3f3bdb1f5597ed8dee4a3aa1

Download Submit
C:\Program Files\Barcode to PC server\chrome_100_percent.pak

Filesize
139KB

MD5
109ee8ffd715c63e3e2248c2ad5ca559

SHA1
7f89b213e80e2b4f52f75b449baecb88054d5e07

SHA256
b581f176c6bdbf8a152947fb37af9c0e6d7651616408cb7312b336c37a704580

SHA512
3fc5e1de128ce0ddf6dddba758a651f4030323e5285b54859019eb95fb0ae11321ba9c391e8bc578acb7f49dd4d82821c4f9947f39972d79360fd2e6abc67de8

Download Submit
C:\Program Files\Barcode to PC server\chrome_200_percent.pak

Filesize
203KB

MD5
3e50e56e351309566b7e3e5a5ca7c7b6

SHA1
3ef35792e0b9c3b902d4da59d0a4bb34590c5400

SHA256
abd207d3e55f0250b27ce23f2a15b0a5ff6f769c08f54e705e2fd0273dca5f1e

SHA512
b24b20fe5dd9766b86869c51b6d92fd3b191bc3a2cac8a4b43b781644958b49500a0fca3fc69781d9c5a80868508f1fa0af9bc1896dc73f944cf1af8546815f0

Download Submit
C:\Program Files\Barcode to PC server\ffmpeg.dll

Filesize
2.6MB

MD5
615fefdaf9e42deb3857fd03b0f4ae92

SHA1
89cdf69ef75e8202de78fcfd49463045bcd43a49

SHA256
cdc10a7bd09c80d479407d9577648e4b9b30fd4b5493ac7875543dcc2981d05c

SHA512
930ff64aa2f0b7a79d8c035aa6e9ee6ef59617bb19a30fc9ca59d50138db8b3bd148606c1311aba7c9af4272ac127d664621ce401c42ca8b008b1e7245211359

Download Submit
C:\Program Files\Barcode to PC server\icudtl.dat

Filesize
9.7MB

MD5
224ba45e00bbbb237b34f0facbb550bf

SHA1
1b0f81da88149d9c610a8edf55f8f12a87ca67de

SHA256
8dee674ccd2387c14f01b746779c104e383d57b36c2bdc8e419c470a3d5ffadc

SHA512
c04d271288dd2eff89d91e31829586706eba95ffbab0b75c2d202a4037e66a4e2205e8a37ecf15116302c51239b1826064ed4670a3346439470b260aba0ea784

Download Submit
C:\Program Files\Barcode to PC server\locales\en-US.pak

Filesize
95KB

MD5
a986c722c10b0639d00250468bb41100

SHA1
7d5d7188ec4723f32bfb13e3573db39b234d934b

SHA256
cb40b01d42057e1aa9a3660afa5db2507e4dadb9b23099ab087c4ff14a99d5e9

SHA512
768145c6dd70e9d3df09cbabb0562249442e86369c6d60d27b2408b8e9d767899911bcc254c0aedc0d29705ab51367a08ff1e25e387a5eb6daae5365c2082d81

Download Submit
C:\Program Files\Barcode to PC server\resources.pak

Filesize
4.6MB

MD5
d98298d188d7ebed9b3e89a822f95df7

SHA1
a50523cc15f47abb6f1b50982db454e4e956ebc8

SHA256
0acd9cafd7c4fac398e85a6e008bad6d7ad34f90b0bfd207df330d3e69bcfa75

SHA512
24cd58294f12f0541d49d180c23b89796596a599d1fc4346d8155b552d765bad0e759c85dded98cf4f3c74ec150b98baf27528f0e864fd37f71dd41c90345791

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar

Filesize
79.7MB

MD5
7bc9de663e59799c0df9876c981b868f

SHA1
970b65d36540dc509c380729816d37cdc0c23926

SHA256
ec94b3ce5ba41c568f68e3238abfaf20405bd83019d898a65bcc1b9d4ebafeed

SHA512
f1ed5a269c20ea912b80b702f95216986be8a6a8c38585848cfa639794733450972f593cbcd1e3d47e12c7a5d59dc466397718568465cb488d32ebcd2884e706

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\MSVCP140.dll

Filesize
618KB

MD5
9ff712c25312821b8aec84c4f8782a34

SHA1
1a7a250d92a59c3af72a9573cffec2fcfa525f33

SHA256
517cd3aac2177a357cca6032f07ad7360ee8ca212a02dd6e1301bf6cfade2094

SHA512
5a65da337e64ea42bcc461b411ae622ce4dec1036638b1e5de4757b366875d7f13c1290f2ee345f358994f648c5941db35aa5d2313f547605508fd2bcc047e33

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\VCRUNTIME140.dll

Filesize
85KB

MD5
edf9d5c18111d82cf10ec99f6afa6b47

SHA1
d247f5b9d4d3061e3d421e0e623595aa40d9493c

SHA256
d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb

SHA512
bf017aa8275c5b6d064984a606c5d40852aa70047759468395fe520f7f68b5452befc3145efaa7c51f8ec3bf71d9e32dbd5633637f040d58ff9a4b6953bf1cbf

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\VCRUNTIME140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\libnut.node

Filesize
56KB

MD5
cf11a982c7fd2562bced2628b2406286

SHA1
2d8eba20c91c916fb1502720952e49fb1b2b3f05

SHA256
751bd9e33880fdd08e55364476356944661ae0a2b1ae41c0bfbf08976f48f122

SHA512
8c1d37fac6de83c3287887e47ce84e16e050b56bfb15bbd56f2194fe44a7f5c3a8f3d0c947370a0a97c3878f7f3eaf50289ee07589e2a56b3015876a921a21c6

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\index.js

Filesize
1KB

MD5
e5774fb9c70c64bebc8c4df8c012debb

SHA1
3c9cbb02757dd516b798236df6b521d36887e911

SHA256
1fdb0751af296c5a3a4bf9f55b26817be7aea140d1a239acec379558e3f25ae7

SHA512
7dd321fcc5e4934d22074a6511028d3a66837f6c90150255ee1992d05289d4a9f941c851e15c5cc6544514b582bfc7ff4d46f4b8f27b2ab3784b8f8eb19b4a3c

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\package.json

Filesize
692B

MD5
f849d3dd7194af3995ec9e8b8fe94f64

SHA1
8e21664270fa9db06207ace6abff175ad0cf3b0a

SHA256
6d8de962f076d5d9773205870b0540bd0bb50e12db225007a021126cae207c72

SHA512
b1a6096dcc792987e2ff897307ca90447163638dbc829a7040277bfa646628ecc4cee9b589e9721cca0cd2ac5807f575ac4eb94e1218589d93c684b4abf0a718

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\clipboardy\index.js

Filesize
1KB

MD5
76ddee29be6d109fb8bfd6c0f387ada6

SHA1
99d6f7e30c631c246e63f0bd48cf7faaf078a02b

SHA256
66880b0d3ec39ba64b224a34a5ef0352032ee95862e1f4e6b2951df85cbc9399

SHA512
555b1d9dbae2b39a0d06b1f8f2ca73ee5faee759deb6e76064047b82aa63e7ea16f69b18856660e9811110a2590696fb8f967182878dfce1e342c391e0d0541a

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\clipboardy\lib\linux.js

Filesize
1KB

MD5
56d77986c00c7c8bc6000f4068578295

SHA1
657e0769181d7d0f1c36036117763b41c342566d

SHA256
0b364961d2374291c79cf8556f065b7bc272f117fcef6b9b67aefa2b9d762109

SHA512
16f2b7c4fe77d38df07c0b05a72329d5c820b5d727390dc9780b2f9962a766d3cc65decea01a6d7caad32f6127bd280c55e38a07bccd5dba6307e6b8f8728777

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\clipboardy\lib\macos.js

Filesize
379B

MD5
4814022b2ae67df02bc84afd6e218ef3

SHA1
a4a6a3280110acd5f8c15f51fb98030a7d9e1f03

SHA256
e50f203ab3894301fd7e3ec2d2581739d5f39f395df34b754964927cfca6aeda

SHA512
415d98b8825d8b95c3c6931a0e42bacc3a7ab4b67fe2dd4f09b2319cf52fb516696229dc7c5ccdf5218ac4effe76b361dc455e1f58eea5a87b2a52704ea3a597

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\clipboardy\lib\termux.js

Filesize
797B

MD5
42964227cd4d18db36d54abb31751ad3

SHA1
3194be24a98f6a8493eb1cf96081c592c5986320

SHA256
20177609ef84109cbd8e76f554d622ec14587297c1d2a98100a42cfb0f181535

SHA512
e523b1a1edad998294f7a3c4feb10bb8946bd8284f09457ac56dd721970c792d3dc8d58bdbf3dca8e24d8a109b13aac461019d6c47a5acbe0b2db013af2deaa7

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\clipboardy\lib\windows.js

Filesize
669B

MD5
f912cda66cb6fc434824a5aa3ffcb717

SHA1
95a9e0e407db544a16745af494aaefe3e8693231

SHA256
a56136479ba0522e8138839c4453571bb28fa9e1ac009f103e251cc75e8066d6

SHA512
5466dfca3b5ce776cb34fec8ff48e82ac22ef759f2d62ac2462c184b5e629487e10a07d7fc1b7babee2abbda97f0250103b65c307acdd516ad5c713b70c19e5d

Download Submit
C:\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\clipboardy\package.json

Filesize
844B

MD5
e6126ff0e260010b514f84d2494e3c63

SHA1
5f4ac94548efcea60fd8305fe44b7699f235d76e

SHA256
befe70211bc2cc9f4ef41b239918da01de990ad5a6324f02a6b49cac5df6a49c

SHA512
92320b5a19b8e7de01d9341ad9589f7a8b998a7c1016d65767360c1215516f82de23d5579c7dee3e1adcb24c61c34a601850e39abaa44eb0faf605910173cca5

Download Submit
C:\Program Files\Barcode to PC server\v8_context_snapshot.bin

Filesize
160KB

MD5
1c153a96607d3e2c38f11a396533fc80

SHA1
42d11efbaa549ade29c341e6b8ad5a0545047c62

SHA256
18ad1a1abeec0230f2a3e38a80c00d4e298bb55d2bb76a2c8e8b113814023815

SHA512
c3ed01af43532d75c845152f35e844f730f6c7ee14f59ef77222a9b62c52354b4c995fc32b95369d888353da56c308dd32cdec97d34d2aab968e426018416248

Download Submit
C:\Program Files\Bonjour\mDNSResponder.exe

Filesize
451KB

MD5
ebbcd5dfbb1de70e8f4af8fa59e401fd

SHA1
5ca966b9a5ff4ecd0e139e21b3e30f3ea48e1a88

SHA256
17bffc5df609ce3b2f0cab4bd6c118608c66a3ad86116a47e90b2bb7d8954122

SHA512
2fbfcff6bc25461e7c98aabdae0efb33f2df64140aaf4b2b0c253e34294e1606077ae47b000ebababb3600bd4d9154a945036c58e4e930da445a0dda765ac8a4

Download Submit
C:\Program Files\Bonjour\mDNSResponder.exe

Filesize
451KB

MD5
ebbcd5dfbb1de70e8f4af8fa59e401fd

SHA1
5ca966b9a5ff4ecd0e139e21b3e30f3ea48e1a88

SHA256
17bffc5df609ce3b2f0cab4bd6c118608c66a3ad86116a47e90b2bb7d8954122

SHA512
2fbfcff6bc25461e7c98aabdae0efb33f2df64140aaf4b2b0c253e34294e1606077ae47b000ebababb3600bd4d9154a945036c58e4e930da445a0dda765ac8a4

Download Submit
C:\Program Files\Bonjour\mdnsNSP.dll

Filesize
129KB

MD5
f9d908de6b166dac9b89bf62fa291ce8

SHA1
938b53238291fc41ae852fdde51eed7a2bff0604

SHA256
d0a918ad60221623bb0278ea94cd6938744617fdbb2054968afafc2940648f02

SHA512
6643a7066974abfd5904df73ed225fd5eed4a84341b12199b6eb9a8a2ad234dba865d50f8ccff8a88002ce4c6ae2131745cf43aac88a3a0a66b596fb0d93e56e

Download Submit
C:\Program Files\Java\jre1.8.0_66\lib\ext\dns_sd.jar

Filesize
16KB

MD5
ca086bb31b598febd7e8d44daf14714a

SHA1
4838808e80df811cfb2bf7faf361b3cbc16f9f81

SHA256
3818abdee5b1d3d77ae4a5ace25a638b2d7d624605f8e8ce14dd6d4c6639c00c

SHA512
54188bf433a0da1b6b8f6f881af6d681a6bb629693191c7ee46f852953529cb94dfa894aca574e1cd7355985ea8d6187e7694c8144ea1db880922676f0dfe0c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\LICENSES.chromium.html

Filesize
5.2MB

MD5
02ca1f89c7e4815b82bc8974bffcd183

SHA1
45bf8a20bad7953b7e16a74348fa034ff5844475

SHA256
fcbf6d29363d798b931f4fb0dc95b09c1a44c3ccaf79a9651ab280a8562e82b6

SHA512
024794b3303ff4ea5f3852c505e39e140113264d24e5dc14a365e8a1fb6f9a0683e72098f1923cca187c666b39a904fc18ac53645b8a25bd8a235cf01b661a60

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\chrome_100_percent.pak

Filesize
139KB

MD5
109ee8ffd715c63e3e2248c2ad5ca559

SHA1
7f89b213e80e2b4f52f75b449baecb88054d5e07

SHA256
b581f176c6bdbf8a152947fb37af9c0e6d7651616408cb7312b336c37a704580

SHA512
3fc5e1de128ce0ddf6dddba758a651f4030323e5285b54859019eb95fb0ae11321ba9c391e8bc578acb7f49dd4d82821c4f9947f39972d79360fd2e6abc67de8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\chrome_200_percent.pak

Filesize
203KB

MD5
3e50e56e351309566b7e3e5a5ca7c7b6

SHA1
3ef35792e0b9c3b902d4da59d0a4bb34590c5400

SHA256
abd207d3e55f0250b27ce23f2a15b0a5ff6f769c08f54e705e2fd0273dca5f1e

SHA512
b24b20fe5dd9766b86869c51b6d92fd3b191bc3a2cac8a4b43b781644958b49500a0fca3fc69781d9c5a80868508f1fa0af9bc1896dc73f944cf1af8546815f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.3MB

MD5
7641e39b7da4077084d2afe7c31032e0

SHA1
2256644f69435ff2fee76deb04d918083960d1eb

SHA256
44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

SHA512
8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\ffmpeg.dll

Filesize
2.6MB

MD5
615fefdaf9e42deb3857fd03b0f4ae92

SHA1
89cdf69ef75e8202de78fcfd49463045bcd43a49

SHA256
cdc10a7bd09c80d479407d9577648e4b9b30fd4b5493ac7875543dcc2981d05c

SHA512
930ff64aa2f0b7a79d8c035aa6e9ee6ef59617bb19a30fc9ca59d50138db8b3bd148606c1311aba7c9af4272ac127d664621ce401c42ca8b008b1e7245211359

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\icudtl.dat

Filesize
9.7MB

MD5
224ba45e00bbbb237b34f0facbb550bf

SHA1
1b0f81da88149d9c610a8edf55f8f12a87ca67de

SHA256
8dee674ccd2387c14f01b746779c104e383d57b36c2bdc8e419c470a3d5ffadc

SHA512
c04d271288dd2eff89d91e31829586706eba95ffbab0b75c2d202a4037e66a4e2205e8a37ecf15116302c51239b1826064ed4670a3346439470b260aba0ea784

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\libEGL.dll

Filesize
432KB

MD5
049adf5cd9fcb42c2975e9e76b6476aa

SHA1
c31816bdb4660e10d1334bcb43eeac339c1309cf

SHA256
2632debdaf26930f57fa1c83f33557374dc2593e8862859f40de3088cdd64efc

SHA512
d2939c88106f7a8c0fcfe3b1b2e6ae9d42ec96db1fa9ecff4a0b68a8a51021c9bd6134a50e91371aed7553ecef9df363347fc2855bb42d74bec3c2e543b377b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\libGLESv2.dll

Filesize
7.8MB

MD5
ac324ec723610cfb043726a3125846aa

SHA1
8664589aced913e385bdec71acf264965fe39538

SHA256
8b2cfc78172c477177c31a1c656d7d8ecff02474fdd199242e1e100b4c233a44

SHA512
e79e3ebae16dff397aa524670c7af78025eed076dca7081a766001b47a3a63586243c30384950f20b0a8178bb49ffae8638d0e8cff4aefc42d532bc8e57881b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\am.pak

Filesize
165KB

MD5
d3c12cbcfd29adb63f8314fe0fd3f8ec

SHA1
71404885cd93305a6ccc196de8601ab2cd542197

SHA256
d61b254715fd71356b55a700b4b818c050507ded9f7474225e6e1aa1825616b5

SHA512
fd354ac4e65d04cafc75fe772c840257ff1cc03a4499e81bc988504d557382dcf78361933503dea09ad9449c9f6b0fd13708ccea7b03a7c6ae2131c7bb8e4fc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\ar.pak

Filesize
170KB

MD5
35c44770be6e0efdd0441d8b7822fff7

SHA1
817ea730072c3745f354bf0e7d817e349152ebbd

SHA256
dd4d43c7529525cb21885e12b337f8e8a9db3ec993d08d34f5d3a6cedea4ecd0

SHA512
f47b20578fe93b57665c4fe6c716b2eb34e9bdfc334ee1e3dce64b3004515ab0e7896773fbc672b087a0c53c7e1da8f599b533d04d93932202236619da3c82be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\bg.pak

Filesize
180KB

MD5
9c5a545da2150eae00a0240097fd423f

SHA1
96012d94d903c76c2b2a058c6ec94488a074bfa0

SHA256
a47c73ae35583c284941793a1ed8b80b3bc8a3e2ac1a049354a3b1c408232b00

SHA512
83e33a8e574f8d0c323fad29d82fd749715902ad288b082708b970c0efb0e15c2e7f7ca4e704f98d9125f998bed72cf725677d28ad4acac796d2e5bb36c057d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\bn.pak

Filesize
235KB

MD5
35c3ddc2656d79af4b6f84f5c222acbf

SHA1
0aee7b3b7ed037ab111d34d2fb6687f6c2a022fb

SHA256
c5316a524046786f7b05993b35bd4bcbeaa397b3750302e029671214e1ac5ef4

SHA512
fd93ea72e37ae14c0d651708709cffe547eb866ddc7779879b7ad74b80cbc6c8f357e8685be266ad2b5eef063cad8d1f20cd604a7a15e8c9adf6f1c42c0a40aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\ca.pak

Filesize
114KB

MD5
e285ad8235b1ee37782ec312a1f26568

SHA1
dbf7e749d045527353e22575c18933d1a1d2e77a

SHA256
39702855f1542560aa20a36f243a87c29488ac9f16c702cc775d8a451720b1c7

SHA512
972ab076069a202c4cdf80a45f1b61710124c0d1c994b62093a786ad9438bc6d29f3601f79f040cd2df641f54a649bec92cb20b462099e4cf784574baa9d71d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\cs.pak

Filesize
117KB

MD5
43d386593e5a1e1171e8d4b44099deab

SHA1
93394e1ed0f62a0067b0b5cf7c3f1d1a844b8dfc

SHA256
901786dd658fe0d92c8164c602eb6c561671348705945527cbb1f762184f7ea0

SHA512
1ca613cf3ad927b745ac8ab2009eaeabdd2d305ba39edb197748e738b751449f99f6ad75c8466f4336914cc8404b6e6dd219d6c978ab3aad5e68bc33e8344c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\da.pak

Filesize
107KB

MD5
bb894d74dd92ef0aa83df6175dba7019

SHA1
fbc61c8ca2ab0829fcd3c7ddce50456e90e67a42

SHA256
4c38c8e4848c103935993f7a7dbcf691e540223150b38313bf4874b05f8e072f

SHA512
3040c1905a79bec17d25748a88ae2f833303bb7e0116b60baacdcd8be54fac2af418b9e1fc49ea0dfb39f54c1c540f0a096b98736bb7c7be0655995ba80ebb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\de.pak

Filesize
115KB

MD5
dc2bfe9dcf6af567ea9743d43e654dbd

SHA1
adcd891a7d44fd0fc28f43b205208482f7829fb7

SHA256
3b1e8df83a5846ec428e3bfa0c37e814dd66810e8815f9bb6ba3d443cfd3fbac

SHA512
75d2919a8784f1d982e1fa8536ea8fb3c67f5c28f5c4f4a816f73fa2ad64dea2c5642264b692c16734f802e8757fed5072703b49863ca18ff3fb23a99a2201d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\el.pak

Filesize
200KB

MD5
9faabc1de76443407626da99a4d1abff

SHA1
6754a7560bd95150b7840eb79c259e7129ac727a

SHA256
ff397cddc6f3cf85717fcb31bb9a8a859ea8cd980bb29825857fdd7cce46b5d6

SHA512
80e714c8e119ce9633b9b1d2675328026f36eee8115d40664effcc557d90c01a342d44d788c56b286632d050c9a9a07e79bd1374b037812320835e2128af0f9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\en-GB.pak

Filesize
94KB

MD5
a018d7cca96e723dad8ee78ce2a54e38

SHA1
b23f44bb0c3db7b41a450188ebbdcdcfeac6a319

SHA256
cce70f0b61e20e959341ae9391f03a59653895808fb3dc10a26bc18e0b06465e

SHA512
b3ccfcc6df338ceb534dbded2b66cdfb5c47161b6f7c5e3fafdee7301854f165d5ae47f988beccec37782f246a84c6d6bf98474eef5d5e95176cc80582d48a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\en-US.pak

Filesize
95KB

MD5
a986c722c10b0639d00250468bb41100

SHA1
7d5d7188ec4723f32bfb13e3573db39b234d934b

SHA256
cb40b01d42057e1aa9a3660afa5db2507e4dadb9b23099ab087c4ff14a99d5e9

SHA512
768145c6dd70e9d3df09cbabb0562249442e86369c6d60d27b2408b8e9d767899911bcc254c0aedc0d29705ab51367a08ff1e25e387a5eb6daae5365c2082d81

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\es-419.pak

Filesize
112KB

MD5
93c19079f60e28f206fe0a2ea1d132dd

SHA1
92bdbea3ccdf934190b0672d6660d7e9ddcf2d51

SHA256
548eb08c2f822c6d4c19130bd01c7e434ec4a677997490cf9c2acff1442ba5f3

SHA512
a3fea3ce9129651205626231254fa052031b9966321129505e8f8110d8e55fa5c74bb036ba9b1712aa9b26d69a3190d91c2606a12ca518b26045d720c526d97a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\es.pak

Filesize
114KB

MD5
c7849e2c968c78cc4de1447395dbf8dc

SHA1
a8641721822c29c38eaea10a17c957d9712557ab

SHA256
2a5c127356c37feba93144ddf4184887ea75c51e5a109dc658aca99f658be83b

SHA512
d24471bd148bd7614826310b87f4bcef22c7db59d99ac7432760ca826458cc8059e9903c3f3166eca3301a57229454d892c61df51c1fe307bab33cc0c93dea66

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\et.pak

Filesize
103KB

MD5
158f1611fae6353d53e81e6a4864b3f3

SHA1
6d4e9b592d1be3e47eca32153914e7a7bfb7f3e7

SHA256
0963025006e19a797014b08401d2a094034599ca8928729e5a15723d42ee3970

SHA512
811d9f32da15363568c481454e61f12a6d8f05c1d57cec4787056863b1efe82a060ee2bc40d02e2ce813fd317be7676e56520e3ec3049c03747d063c6a6e5d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\fa.pak

Filesize
161KB

MD5
7b4971f90f97b194d94271cba61b8fba

SHA1
2920d1acc7787c68f8038aacc02c9038818d8eb4

SHA256
e3894f96a14f6e81ebe6a3e6c0c0e64d80457c066b3ab733be8aac4fad3ca1bf

SHA512
190aa19996e72e442c3d03cddd7f9dbfdd8153b5e3310ce45cc19f63a5d114d7b7f3cbf885f43c54a03edf4b178b89a9917b3f07dd6abe772e396ceca3ecc73b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\fi.pak

Filesize
105KB

MD5
d8c3fbeaf04a290eca106384e2d0d02f

SHA1
a0df019725055abb72ba3a7bc917faaf5115224e

SHA256
fcc01915f567263e5609cff7b8c57e790431e062fc172ecffc5df78e801f2506

SHA512
f0e4ed32bc8e946e19a5b46b5c6b487309f46c7cc5db1e41239b32dcd7a0d653434bf13eb51347657a3510c7e253f270473d3f5abb8c0dfccc594f6b12b62357

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\fil.pak

Filesize
117KB

MD5
19122716d06dfbe8bead02aaeef643e6

SHA1
703e9719423e4860ed8d25057b5b04453969f3f6

SHA256
6aac8afd091e6dd4565dea26adcd2f88d7375c2ec6bec15c5c840a531ba1b53b

SHA512
d90cfa64660ad67c462a944708d7d22d929b42caeda4231c790c28f4e165f50603e8fe235ddaf47b89e853903ff7c81401309075f76ec7c9d6a0447cf259378b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\fr.pak

Filesize
123KB

MD5
bb5adaa9f67c11326909072f16386916

SHA1
95b7b7428007c31c5686738b8580a571d75b1248

SHA256
9f0779d4cafca2e01a65b6ed633182379071a758c401ab65e8bc7c6b7f7f2366

SHA512
040a4d7be549f120389ea31a1b05f6b738c45a769ffd3bae2099cf004db897299f9813e66c895751b89c142884ea92fc3e1779715ae857ea15c90439eac0fd88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\gu.pak

Filesize
226KB

MD5
685283e075024e054b6d78ecca07d8dc

SHA1
a40c69c1d05879b500c8b5da2a2ebeba7984d59c

SHA256
fa8568302e82ce1956989bb038a12beb4f1e85365b3e2bdfad4b38aac5658ff2

SHA512
b8a46a8e9eaecf50fb11d8b4bf28db032319c2c874185933edd2b5f356ef9e9ade21de8bfec1efaa58d7ed2d20e390595319b6d487bb6da1e4f8df9b5d140fa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\he.pak

Filesize
142KB

MD5
263cc280b1cc18540152a7f09989d1e7

SHA1
533c50cc500735f88f1b67d81f3f90db45c3cc01

SHA256
6a7b3c4ca714308836cdab39d9edff193c4fdbbc627ec4c0fbe37bdf3aa9eaea

SHA512
84a0ab12fcb265939b188512d3097fc71b400a2e1695eecebc3d458cc4be6ef5dd587872300716cbf8b469065f92d098bbd0bb3ab87c9ef4206ee10427e9adef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\hi.pak

Filesize
234KB

MD5
3e7719993e970a5875c5b4f806c37c9f

SHA1
a74c6f1c9886c0e76760c66b80269d532acc7adc

SHA256
1f2b69f27cb3cac9d0e3b71a513d92e21f1ab5fa8b7cbdc21324c696bd671f35

SHA512
ebb36c27fa117e29e21288851e910297ee3a801db29668312ca8522d88db5d02c342f91aa57019ad80e82b441ddf5ae9231acbbb972c2d2ead01ccbd482c6ecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\hr.pak

Filesize
112KB

MD5
127607c466e9feeb91c6d377b57141cb

SHA1
8b5e4b8a71578710337253f9a6d96792c8227d91

SHA256
f6775b51dedc0e857497bdce004e1e14eb113a170f050d29fc1cb564797ea706

SHA512
709751cd4db70823754259dd300a7a928f98b534fd0f5b4aee51f91ae13e4aee07da69ba81958b180d132aa98cd20367e699db214ec88899548fd2afe38f22e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\hu.pak

Filesize
120KB

MD5
086766328d307018c22007ab7fc4217b

SHA1
22dec7b3aec098c665829dd179511cf415fb7ce3

SHA256
772b0a8604471335f60246b93af29e7faef4ef46e04082b9aff30cef1ca33969

SHA512
7e29b8206dd19c3c243b0806b419214996e35c8c345e95e4b62bd78192426effcf57026f182856a8faefa7a6f1ba7dbebbae29d538b74bf3c1bbc24471fa5595

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\id.pak

Filesize
102KB

MD5
5f0ad5d827844c2b9d970536c9689d77

SHA1
7566b01b28d671d4cad78cb24d24fa8f831859ad

SHA256
72f75b3290891869d201dfca7eb82eb58d22ee61c6d6610646b486d68f928a10

SHA512
1ab719d6bd257ec3b4f1b3779a8c7dee0f8ab5ec9292ff18003e6bf7afef81506e34e40db66663580d1ac95eaa3f10eb0db71273586b647e4d5b0445b66ee60a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\it.pak

Filesize
111KB

MD5
052b2bad3c3260dad219c8fd1a0ee37f

SHA1
97a3ef9e5095eea34aeb693658494a08c1914e83

SHA256
b0fea999ce8800a2c9e06c6d49bede060b6138dca6ce5c31bfc60aed72b529ac

SHA512
170217a234b11534a29e2faf8d9876c3ab0c2c95986955802d84aa8075340a4dd3c5047aa22759d298e571c8f3195fc6543e729f5f2a7e6590deb24356d96964

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\ja.pak

Filesize
135KB

MD5
b19d7e3512c6795757bb51cf21bfd05a

SHA1
6d99513f20701c9c18c1dc34a31cdeff6dd1eb41

SHA256
a4111fd046e8c50231e870f428804250c0738bfc12714720e0907e2213a163c2

SHA512
72c68af157f2c56efeca80f1d65bec50730b390d31a93308975b04b17de890e692a1894de581417f988e459f784c6529c9c24e5ac5b6bc3b5a93601752e5beb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\kn.pak

Filesize
258KB

MD5
c70fb16c67096a02b5d35c16867c2119

SHA1
319f8f9ec99262887047c90bb957772f2458e79a

SHA256
1446663d893d6753ef413a1d2ea016fae76d8fb4780deff2080d82514c4ab6e7

SHA512
66a6572d138b24ddfb9a560c2bcdeafa83596edf445d71378b8d8346f487c04c374f11626b4497c438d55ca0ebd934739af291dacc33e1f3a63a553127db87a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\ko.pak

Filesize
113KB

MD5
8ee07cf91bc38d8b6abcdec4e0d4b3ad

SHA1
52addc945a9f097ec1d2b24258efd1e7f1211d7e

SHA256
137dcf11c916aabd48f2543895740c6f359fbcf9bdfd5863ef08d9ba95e39f7f

SHA512
a78e7c6b11521901a57791012efbf116c2fe67b2dabb925f1a744d6a2f842f72224fc9f79d18cc9e86e53afbf6bcd1ac87289451ad05d78a9c1fa71e9fb912dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\lt.pak

Filesize
122KB

MD5
5b1f97690df00c585231c5bbb13c19b4

SHA1
e2d8096b0735f7030420de2321216b6eaa100a0e

SHA256
62e6fbbfd2177ebd87388ff7c57c8d06c8d7bd85fbbd83a00af822e56031c3ea

SHA512
19aff1c238819235cbd2f32d42e4aa70b2f6b571e6caf193af15989aa3d570237fb99f48782024589e300a77f6ae8fc1fd3843e63fbc0d3e3c4a4f577463a457

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\lv.pak

Filesize
122KB

MD5
bb16ceed3a1005f5fd35b8c4d0d1ea28

SHA1
737be1ccf8a6c901daa8ae004d9b89ccd19899d0

SHA256
3ea936a64770f7d288f9723179aff17ac0f15f79c708730b67ab15b1a10c1eaf

SHA512
315a0fb44b490ee68ef6d1a9a2e3e395ce35e83b9d44e7382cc2eb75c8c3686a42eded42bea000ed068a04368154f78ccab8d41868feccd6f91deff2b89eb622

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\ml.pak

Filesize
271KB

MD5
54840f3ffdc38ba464285697d25319d8

SHA1
1d7aba8ec6204f4e4933da74f665c79a882b7832

SHA256
f2207dbc18822fc3e2abacd119fa5553215aa1e4ae8112af014f1707c1873dd4

SHA512
6babe51d4f647f0e70f0f8149f9845f85df040a6abd705f9d9260c9bfec6a5adefba09c1b80e9fc9905a1048a6a8cc813cd4b8daf53a6afb0a9d72c6b2709fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\mr.pak

Filesize
222KB

MD5
af2b1e32c5bdd8b750d569aa5525d4ee

SHA1
dcbdc3230053b69a85567cb5013568ac80b1c8cb

SHA256
d330c8f2719a26c64f32e49ac663b1c12a4e7fd27f6297de2d70189e845b9931

SHA512
ee20c9bbeb42a9f1018400e409f53fe8e1165a4abf7a8b96cefea28711f1fd17593d75baf38ef631c06296befa93367a634f91866c936668926756adcc068cfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\ms.pak

Filesize
105KB

MD5
fb5ed1282cf0e3e23953fb0ee8ca3869

SHA1
e0b6e7301af8e4deb0e566745af6c09d00748fc6

SHA256
2af29c23c1ba3cd2a6de137894d8cbcbeb656c0d2c0c499de45393d6d594a2bd

SHA512
68d8993521a93e9d6514719b0554915774bf942a2e93cc7448c0f32f938c838b2e76d117ab66413aa874dddd2fbf96303899af27d6b82d362e0f7b31ae023ebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\nb.pak

Filesize
104KB

MD5
dd93951abf6974e52bb7e6c9a16dde34

SHA1
5dceee404bdd3901093acf1da054b8f9c9606133

SHA256
0492cdc45637ee3e97a55f86449fc3e85ed809fc598517899acca4a0f54bdb34

SHA512
2e261c2ba1b9a3d73f5ddf9adf7b59eec41a11b44e3d6b42bd6d34b429dfa47214f7c1505629955284cb866234a1f885004971f0ebfaeddcd40af44d6d6c3b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\nl.pak

Filesize
107KB

MD5
d3197711ad54c013258b6c1b3ac0a83c

SHA1
bf934e40884f41ed4f5fc0d6f7767cede374e886

SHA256
e4e7843a26dc01eb55f7b7ae31d279acf11c61dc9ddfb6ee8353b928b6c4982e

SHA512
234449843edd93dc130799212bb7a9bdce81def7f3464d643a1632a10dd0021320c3066cd81cdbb71da1a05212b1543e122cfb412d7ae49b405d687b0c92c13d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\pl.pak

Filesize
118KB

MD5
5a87a89094e57921565d0ce0321d9adf

SHA1
cef9b65386aea4979ba2745c5e51866a7ca507fb

SHA256
90f184568f88f1e10c0b0580dac3b83356033016c7c3e28583635b3e5024306e

SHA512
352f20db67fd4e0dc2fd4495a01f5c954025af952a622fff01fa1ac735344ed1225fb8d9185e056ac61a2f927f5bb14f6d6ddf8ef74dbf638ac3f7d3c99281d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\pt-BR.pak

Filesize
111KB

MD5
7c7df2e7408eaedba853461230e59c83

SHA1
7a76b7a1777a767e2704d60ee3b68dba241307c0

SHA256
5f6d50b7e5d8426f6bea55164102d40965fc530a59eb67e1d8d06a00e33bb08f

SHA512
2ac99ae520438043733fd9484c56626110ae616316b2eafdaa580cf6409f0d82c20838f65f355204ab8dbc8e57f904d77ec8d5ea5e0df77f2e52915bc365bb6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\pt-PT.pak

Filesize
112KB

MD5
0a49be229ecca6772de0a80dc80a2c86

SHA1
75f03921c8f2c592f674b9092e35c400e0297405

SHA256
22c475fc66ceccbf01e0aaa29f0f5c70d0ae94cf7d83c301665781e26dbf8640

SHA512
f4fe391f17b7efe92edbd145279956409517548533ec41b46af25156725e99af0a7dc3de4f7e987bac25c23594fe0d4c744c12f0baade1adcd94df2a4615a2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\ro.pak

Filesize
115KB

MD5
3fef23d7b143d74efb8b4a99dd6dd9e7

SHA1
c2b3f032c7b13f4dc3c69426a73c54a857cb274e

SHA256
5761f94be36903f31b0c3c61e0d81dc15cbe0a6da92178b4f50c227163d8f0bf

SHA512
9e91f10490d3d05e5ed9995b635fb21bb81ef4bdc7e5516d364e50b0831ea85eb450e9de633d335a914eae6c9c85903b73a14e2309f27e763334d9c7d066e0c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\ru.pak

Filesize
183KB

MD5
de335564e6b1f9eeedda733f09e6ceb6

SHA1
0d4ad4c48a351087cdfd100ae61cdacb4edc9df2

SHA256
b95753057ccd4555c2d9633c3f737c2ccaa1499e9dcb9567c745d8f6fe81f45d

SHA512
3f551c858cb329935e99778471b67662052893c859bb534cbfae1bb0569b04f495edda7d26b65d3e88657f432d6fd0ed9dc21cefa4406c05e7eae9531e92c509

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\sk.pak

Filesize
119KB

MD5
6a968970a5b249237d6d2fd775397d73

SHA1
598886fcd52809099d6c2efd916b73c5aa2d6b5b

SHA256
3884365ae6fbdd2c00d2dec2cab66f0816ff3ef7a5a4d8f91ea13fce372e877c

SHA512
6d9c4b493ed4ca1051a4833d24aa39ab8064329e05a102137a4b089d10dccd04cde4fcd0a6e878cec90e663596788b7249640ca3a029e9ea6c5c4c42f493859e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\sl.pak

Filesize
113KB

MD5
09932a71b9fd2dac7aa87bd42dcc99be

SHA1
dfaed169dcf15bce6a5e1c3e7a3e77a17f9e66ec

SHA256
70ddcb1c405ee48f85b671284e0f16df6baf73c1f41487c5cf6d065c2e06d2cd

SHA512
344a4b8cea89e3688d165dfd5bab8702c0022833dea9ce7bb436ecef8fb2a8761f48fb7359cfd5a259225fb482ea1fb044cc890eb6a51b0105801c32f7d44c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\sr.pak

Filesize
172KB

MD5
7221286bddd593fc43366cad65ac3c90

SHA1
13c428fcda5145502dbc71543220216042a5e42f

SHA256
00906957c1a4a33d6b5f24c32494d1ddeb56f98877c957232d06a879d56d7182

SHA512
fd2119ff64ec4296578ca4e9887a4f9206e495811807c503632beeb9fc78200099756692c8beb1032d75606047ee1daa25073081e5f3f5755cba7e4f2079ddac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\sv.pak

Filesize
104KB

MD5
cc693a8d0a18e77c60ad0ccc0f35e2c5

SHA1
4b27117597bc471cc93ae7406af480e5faefd14d

SHA256
8d6f9eb64e6700e0c5daf07b6945ee20368535ef6e3c71bd5ff49c827b64bd7c

SHA512
87a5da69b42d6395c998d12eaa614fab9242fa10545246e05e7accdceb35ae6d0ced1b15ef4a73bfd5d1308ca0fc586165f917309dda5060d08de55a4ae3dccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\sw.pak

Filesize
106KB

MD5
4e33675799c16aaec75a31804571ba2a

SHA1
dfc709362bc81911018e1282abeec0a51d0ff757

SHA256
d35fd90c735dd6318aa81bc548284e51b522514288a701ab69277e2347db1a55

SHA512
a731d8bcb6274be9079261d5a200217670974d57e618e561195dc45ad244c4c6ff7f3dc5a3126a51d0815afe4f56e2f3ab9d2d2e878e29e34f9eb3bcb438396d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\ta.pak

Filesize
268KB

MD5
881c4814ab067734a89d02ed6855c2dd

SHA1
6ce805c7352d2b7fd3b6b23e8c3f4d8d6886635f

SHA256
0572f88a09ae99bb1f7ab3f9360b2037578459b8dbfb1adb6f1d966a74a7fa94

SHA512
33a303c39c7893d043ccce370f9ab39832c18d421372b3b8372c4e90c2ad1d0d0939fbe181ec8644f150c7632a02de8fd9400a5b3ec74371ef3a3e230726e38b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\te.pak

Filesize
249KB

MD5
61088f80b570fdce22100164e39841fb

SHA1
15c7efb5692d262165c55adf6dc70c5050c42ccf

SHA256
77bd7c08f91862534c9ba750d61c4d157c241d6bd719c2bbb0d862f65c4f9bc6

SHA512
5425d46f8602ab0d6246874d1caf7576bb1a27a5d2c489cce464a106186d99f0e2264fda1b5d2d1c10feb9165b8947ce7f45b1ea1835cf7674426fee6382e5c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\th.pak

Filesize
212KB

MD5
ed1a9bca30ca103975e0a9242841f1f7

SHA1
721fb1a7988ad6c045b663f99ae47525e0227320

SHA256
83387bc53e4610f91379a1f6b4183dc8998de8f5e2b1a64214b1904830dca83c

SHA512
5e3fb081b1fa90f86230e0e36815ae9a7e7576b4e6736f024bbd1924dabf8ad801738a12cbcaac890fc6e572a33fef9e430a641d4dbe94d783414a0f80223cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\tr.pak

Filesize
109KB

MD5
c045af6cecde150d100851b8e187ae28

SHA1
c1078bca00be65ed0355d014817241bb5f467a88

SHA256
c51004587c5df0729c5ef1c0c36e2e38136081fb3f70a93e032635daba6c51bf

SHA512
ab82626e4ba45b0b56ec628a406e35bfad4876f4264366db0166a039bd178ae9d2422fe40458ff0bfd87dcf5e37c8402d989a207ccd8d2f8ea065dffa2e81081

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\uk.pak

Filesize
183KB

MD5
e6f21cf0eb41bb5f8d6d3b4ab265d2c7

SHA1
8f45622f7686d398f0374b4fa91adb3d6bc17832

SHA256
538922ca9ddbfa49a98b2d09706d7b62bd5283ca831fe6bea0edde838262cf55

SHA512
003b5174fdeb46e9f6f8cdb5261fb7563dbf438a1377a6c659d07619a6ca1eb8937564cf55fd7afe422b9cd9721c2dd43c40d5f74c87f3f461c82ca250dc4d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\vi.pak

Filesize
130KB

MD5
bf46a32597fc185b69d1109ae9596d6a

SHA1
2890b119abdffeb9e4618101cbe8996bfd9a1d6e

SHA256
81d090373b8a9a2988b9ac9ec05c8ef1af1cac88b19504191f601873a7cccde7

SHA512
23e25b865aed4345735585f5fc6c4f6f6573082d57ecba31315162f2f9bfcbec99213b15c643f2ddef5f72cc074ce1e875b28050bd28cd4fde31bbe1538f065d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\zh-CN.pak

Filesize
96KB

MD5
f766b1d7d70e9db14fbffce63d2b2f30

SHA1
2fa1bae675b623f46ffbeabb6f19cf9ca7223b13

SHA256
7983e51f68cc1ef5a41e44858e49014474dc529e04cbc5dce9f5c822dcf60266

SHA512
fb235712a9d3fa3556b514c1b86c0ba91145d8d4e370c7c16e2fd8b0baef1444dea6d8cfb25a79161a6da7c63684d613a85136408d4d9bdf6176049441852202

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\locales\zh-TW.pak

Filesize
96KB

MD5
cfe66f10e3f78106c1b82404dff6df64

SHA1
783f664ad5a4ec45938c518c99e6b761745e8640

SHA256
f5ca17ae66aa3883e4a69e3d4106933bcf600ebd9b0ba39402af074cfea74b9a

SHA512
c4c110488d84eb8f96d709752cd92259187bc43da37a5620a047c9771cd217592dca74885e0d0e4aa64d6a14aff494533eecb9a9efa60658386df0f87b90a3a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources.pak

Filesize
4.6MB

MD5
d98298d188d7ebed9b3e89a822f95df7

SHA1
a50523cc15f47abb6f1b50982db454e4e956ebc8

SHA256
0acd9cafd7c4fac398e85a6e008bad6d7ad34f90b0bfd207df330d3e69bcfa75

SHA512
24cd58294f12f0541d49d180c23b89796596a599d1fc4346d8155b552d765bad0e759c85dded98cf4f3c74ec150b98baf27528f0e864fd37f71dd41c90345791

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app-update.yml

Filesize
143B

MD5
3c09e535c70d421d5296f74f9a3e29ae

SHA1
eeaa4c4a65bee8832cfc098705f021211a7a41cd

SHA256
c6e42d57ad147836733506c70a2808f1aed51d75a4133e40f59c1efd8d350e03

SHA512
48f4ab0bca805fe52457a84cd319e608a24f7b06b194b7331094b961592d7ec33ea6a953686a0562bd06c93e9c3bcd3985ffb3e6917317cae04b46b073064e9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar

Filesize
79.7MB

MD5
7bc9de663e59799c0df9876c981b868f

SHA1
970b65d36540dc509c380729816d37cdc0c23926

SHA256
ec94b3ce5ba41c568f68e3238abfaf20405bd83019d898a65bcc1b9d4ebafeed

SHA512
f1ed5a269c20ea912b80b702f95216986be8a6a8c38585848cfa639794733450972f593cbcd1e3d47e12c7a5d59dc466397718568465cb488d32ebcd2884e706

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\LICENSE.md

Filesize
11KB

MD5
d229da563da18fe5d58cd95a6467d584

SHA1
b314c7ebb7d599944981908b7f3ed33a30e78f3a

SHA256
1eb85fc97224598dad1852b5d6483bbcf0aa8608790dcc657a5a2a761ae9c8c6

SHA512
e2f81cb44129e1bc58941e7b3db1ffba40357889bace4fd65fd254d0be1bb757625bdf36bf46d555eb3ca4b130dcd1c05225caec28d8472dccf52a63dbd6e185

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
28579ca40c9e19cc6dc23dfb8b6871cd

SHA1
804cdccdb65ad15e016072b5d6f9843096140864

SHA256
a57d8275c34c1094f6a4535e23c7bee4759532e08776ff84c5fe487c0f925eb4

SHA512
9489cdc3d5df75dd2686ea82dd689aae0a4fd503d2831091c10bc53820320b4947cd9f321501448d258b219516e5d9aaf6790f13189248835ba20b2f86674b9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
21KB

MD5
f576fd38085005b4ab2ff1dacd293c48

SHA1
75074cfc7543b34f0bcace916370413055dee2ae

SHA256
6e794d0fad29cc5bdd5d0511fd923d3434ed122cff0ed697903900c93c807582

SHA512
3887ba832965e3bbe248002e926b0ea8374b4755e6b736c25850088287790e20052d3334000eb7afc2c86fd2a14ba05d5e564c1bd811d8baa8e524f4f7fcfc25

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
e730cd977ac7f60f0824775e39c8fd2c

SHA1
fdfaf759a360293687bd2838b7d9feb628edaf5b

SHA256
63de06332e8ff15a5bff699e70ed2537a9d273ba62463fa16265d261f3c5bb31

SHA512
d6a30e82a061f7e5f27aaa928819ebefff2bb5963ab7d4be33d41e0099576b1e7d0c671082fa08ce0e1bd8e89c4dc8ae427a22f0162ac05b8a0259392bb50fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\libnut.exp

Filesize
724B

MD5
ef9709f8baf6c7e96bdd021b19171c00

SHA1
d0d324b96e4dc04175da30f088f2ef9e19c9071d

SHA256
965c4978757d34c013c82428f6984be5821c95391077768e9ad03f4d85f0f12d

SHA512
e4a3f7c5c2c0c1dce77ba0f9bf2990cee6a97db10e0494d48f834bfd851df90a1b1dc159ec2723d7d4fd5d1af78efef885e7e0b58a48960e8db82f86eddabd23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\libnut.lib

Filesize
1KB

MD5
6a4549597f118b03715fced8e8d08db4

SHA1
167019cfc39cd9f5e77b358d7f269e7dda74293a

SHA256
fc2bde66379c03ce27f9a57af542696da2ec89f6cd26ee187b130b539e87865d

SHA512
38b9196783546607406f7e857c4012f10df1aacf9e2c44953f8212cd2d2e2677a31bfe03be1316973dcf0a2664f4057275d70f380b36f2c25a8a3f9f04a40628

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\libnut.node

Filesize
56KB

MD5
cf11a982c7fd2562bced2628b2406286

SHA1
2d8eba20c91c916fb1502720952e49fb1b2b3f05

SHA256
751bd9e33880fdd08e55364476356944661ae0a2b1ae41c0bfbf08976f48f122

SHA512
8c1d37fac6de83c3287887e47ce84e16e050b56bfb15bbd56f2194fe44a7f5c3a8f3d0c947370a0a97c3878f7f3eaf50289ee07589e2a56b3015876a921a21c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\msvcp140.dll

Filesize
618KB

MD5
9ff712c25312821b8aec84c4f8782a34

SHA1
1a7a250d92a59c3af72a9573cffec2fcfa525f33

SHA256
517cd3aac2177a357cca6032f07ad7360ee8ca212a02dd6e1301bf6cfade2094

SHA512
5a65da337e64ea42bcc461b411ae622ce4dec1036638b1e5de4757b366875d7f13c1290f2ee345f358994f648c5941db35aa5d2313f547605508fd2bcc047e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\vcruntime140.dll

Filesize
85KB

MD5
edf9d5c18111d82cf10ec99f6afa6b47

SHA1
d247f5b9d4d3061e3d421e0e623595aa40d9493c

SHA256
d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb

SHA512
bf017aa8275c5b6d064984a606c5d40852aa70047759468395fe520f7f68b5452befc3145efaa7c51f8ec3bf71d9e32dbd5633637f040d58ff9a4b6953bf1cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\vcruntime140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\index.js

Filesize
1KB

MD5
e5774fb9c70c64bebc8c4df8c012debb

SHA1
3c9cbb02757dd516b798236df6b521d36887e911

SHA256
1fdb0751af296c5a3a4bf9f55b26817be7aea140d1a239acec379558e3f25ae7

SHA512
7dd321fcc5e4934d22074a6511028d3a66837f6c90150255ee1992d05289d4a9f941c851e15c5cc6544514b582bfc7ff4d46f4b8f27b2ab3784b8f8eb19b4a3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\package.json

Filesize
692B

MD5
f849d3dd7194af3995ec9e8b8fe94f64

SHA1
8e21664270fa9db06207ace6abff175ad0cf3b0a

SHA256
6d8de962f076d5d9773205870b0540bd0bb50e12db225007a021126cae207c72

SHA512
b1a6096dcc792987e2ff897307ca90447163638dbc829a7040277bfa646628ecc4cee9b589e9721cca0cd2ac5807f575ac4eb94e1218589d93c684b4abf0a718

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\patch-packagename.js

Filesize
524B

MD5
37abb39cae59eacf820ceadcb0ab5ede

SHA1
1e649998edf6a4b217cc2a75fca7ae4754f4f694

SHA256
734d468d4a8949d6ad38000dc44c27e0b8841b973762e1217d618d668c878edf

SHA512
cc0783f38cc92897e7e3abbb1058770db4209581baaeecb2f37c6dc2a3a56d0d0b3b15bfd6d5bd31eb27cfe82f1b7be2ab278b460cdfbf5e7a9520277df4500a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\clipboardy\browser.js

Filesize
393B

MD5
a63d5f869a1791828dd0c9d02e06a12b

SHA1
3c04f6e935f935c83fb301b7184b8d2b11844540

SHA256
52d2d37ec6200d3d44e6eece937d19d09ec60b3525ae90155390171621597dbf

SHA512
5cd182aab1f5c7eee82c1e7476ad1cad574f570a31e6a274ad4f20fa245236c67987c33c4f69cac71cc224d7ca4b72e922a31b74efb955a2761140a7f2aff332

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\clipboardy\fallbacks\linux\xsel

Filesize
126KB

MD5
5275ac35c8b2ff59b14f3616f397532f

SHA1
33d13cb10f0aa9504442493354d2916ae2d4821f

SHA256
6ee2c0e4736d4e7c21fa7082e1edc1591b00c1ce947df3be49e63c76418668bd

SHA512
515a9aa3e926c8685d605128ac226dd8934a99502369f38ab191aab4f60bfd0f514063f608fd86951a19cdec8f26b5fe3dfb771b18f522d304cf6b865b80e562

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\clipboardy\fallbacks\windows\clipboard_i686.exe

Filesize
455KB

MD5
c97682abc3304e23df592ebe19e640c5

SHA1
a333b7d529be233a5658db4645fd81309b7842a3

SHA256
a277b0026c76fe560919f6ce3a8e216cf5682efb6f854c1781ce28d897c25146

SHA512
b4448f31cf2ffcd27f7584bc9685f2f08b45c9430c381f57ef7d9efb768070a32a0c461e5bc395d36ad6a42a8da8e35f57fe696626cd3cf46f7ed1feb86e3f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\clipboardy\fallbacks\windows\clipboard_x86_64.exe

Filesize
345KB

MD5
48373fcf1345da103fcb67949a47c24f

SHA1
9633e646c507e62f12bd0c90023e0f7f5f6f187b

SHA256
0ec54a0486b6377c32b9909d5ea9d6a225f140efe9b77423444790f9655c2ea3

SHA512
8f8147671d7808d15bc080ffa4cada519d83ea7023a4d3dbac47fc66a4c860cc35eb3f911235ecfdcb86f4c502c42b742e725f9696a7fc3486a5a94f03957dee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\clipboardy\index.js

Filesize
1KB

MD5
76ddee29be6d109fb8bfd6c0f387ada6

SHA1
99d6f7e30c631c246e63f0bd48cf7faaf078a02b

SHA256
66880b0d3ec39ba64b224a34a5ef0352032ee95862e1f4e6b2951df85cbc9399

SHA512
555b1d9dbae2b39a0d06b1f8f2ca73ee5faee759deb6e76064047b82aa63e7ea16f69b18856660e9811110a2590696fb8f967182878dfce1e342c391e0d0541a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\clipboardy\lib\linux.js

Filesize
1KB

MD5
56d77986c00c7c8bc6000f4068578295

SHA1
657e0769181d7d0f1c36036117763b41c342566d

SHA256
0b364961d2374291c79cf8556f065b7bc272f117fcef6b9b67aefa2b9d762109

SHA512
16f2b7c4fe77d38df07c0b05a72329d5c820b5d727390dc9780b2f9962a766d3cc65decea01a6d7caad32f6127bd280c55e38a07bccd5dba6307e6b8f8728777

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\clipboardy\lib\macos.js

Filesize
379B

MD5
4814022b2ae67df02bc84afd6e218ef3

SHA1
a4a6a3280110acd5f8c15f51fb98030a7d9e1f03

SHA256
e50f203ab3894301fd7e3ec2d2581739d5f39f395df34b754964927cfca6aeda

SHA512
415d98b8825d8b95c3c6931a0e42bacc3a7ab4b67fe2dd4f09b2319cf52fb516696229dc7c5ccdf5218ac4effe76b361dc455e1f58eea5a87b2a52704ea3a597

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\clipboardy\lib\termux.js

Filesize
797B

MD5
42964227cd4d18db36d54abb31751ad3

SHA1
3194be24a98f6a8493eb1cf96081c592c5986320

SHA256
20177609ef84109cbd8e76f554d622ec14587297c1d2a98100a42cfb0f181535

SHA512
e523b1a1edad998294f7a3c4feb10bb8946bd8284f09457ac56dd721970c792d3dc8d58bdbf3dca8e24d8a109b13aac461019d6c47a5acbe0b2db013af2deaa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\clipboardy\lib\windows.js

Filesize
669B

MD5
f912cda66cb6fc434824a5aa3ffcb717

SHA1
95a9e0e407db544a16745af494aaefe3e8693231

SHA256
a56136479ba0522e8138839c4453571bb28fa9e1ac009f103e251cc75e8066d6

SHA512
5466dfca3b5ce776cb34fec8ff48e82ac22ef759f2d62ac2462c184b5e629487e10a07d7fc1b7babee2abbda97f0250103b65c307acdd516ad5c713b70c19e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\clipboardy\license

Filesize
1KB

MD5
915042b5df33c31a6db2b37eadaa00e3

SHA1
5aaf48196ddd4d007a3067aa7f30303ca8e4b29c

SHA256
48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0

SHA512
9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\app.asar.unpacked\node_modules\clipboardy\package.json

Filesize
844B

MD5
e6126ff0e260010b514f84d2494e3c63

SHA1
5f4ac94548efcea60fd8305fe44b7699f235d76e

SHA256
befe70211bc2cc9f4ef41b239918da01de990ad5a6324f02a6b49cac5df6a49c

SHA512
92320b5a19b8e7de01d9341ad9589f7a8b998a7c1016d65767360c1215516f82de23d5579c7dee3e1adcb24c61c34a601850e39abaa44eb0faf605910173cca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\resources\elevate.exe

Filesize
126KB

MD5
ba173ff2d96303d226358136a42dbfb1

SHA1
7ae7690d584342786c47a37d60861f82f94e2cd7

SHA256
f1c17642a07dfbf0d203b29290a527c1be69ed9a93f2b2f9301a228634109c91

SHA512
28d31a4210f6045e4733a8b72214612367389b8e0e5411c4c5c53a6bbe3629d825f288466b904a5cba3eaa188694f1802ba1ede9480ea2fc2dae2e97115a21f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\snapshot_blob.bin

Filesize
48KB

MD5
5ef782f3013e6162d5aaafa0b038f5e9

SHA1
c4df867b71552806883b4a58c61d8116e0c6dae3

SHA256
c49c6d99c2d5066c8c372b8836c83d793260f91a732c526f80ede106ad5e3419

SHA512
a562bc2887b613e0fc8766749173bdf1dd76159e7cb4187bd5cd607a95a829eb9b4cba42780397f89ccb47c1065c2c1827982ca785eb4bb43870da506f26f370

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\swiftshader\libEGL.dll

Filesize
446KB

MD5
f78d6b4c854ef32a8cfac938ab27a160

SHA1
872a311deeaf30148702c87479604fa2ec5e62d3

SHA256
4417d76076ea8ee9efc5eccd2ea419042b9282dfa8da3e19cc6fb7ba5bdec175

SHA512
2d0f9bd730b229bd357c33749e87e4bccd1052e84030e99467950540df3cc11bbb5c9022faa7f24015c436ac11ed2f00e5556c7c32e8ba3a9793c110efb861ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\swiftshader\libGLESv2.dll

Filesize
3.0MB

MD5
dbaffabfac5c1c166fe69dfc7e84ff95

SHA1
c8e6d05e7a63e94b41d2d4c6314de0eed4fd3796

SHA256
2d1d296c22b465295d2d3de75f344ad8b0be5e616e96327ca6c57ab62fa74cb9

SHA512
09b39ad163a7c04fbbe471193f51d1195b8b4935abd401d8c4808867656e1c3546854af2b797dc5bd06f2d26dbafe1f71825310327c08ff16533a722bf29b0a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\v8_context_snapshot.bin

Filesize
160KB

MD5
1c153a96607d3e2c38f11a396533fc80

SHA1
42d11efbaa549ade29c341e6b8ad5a0545047c62

SHA256
18ad1a1abeec0230f2a3e38a80c00d4e298bb55d2bb76a2c8e8b113814023815

SHA512
c3ed01af43532d75c845152f35e844f730f6c7ee14f59ef77222a9b62c52354b4c995fc32b95369d888353da56c308dd32cdec97d34d2aab968e426018416248

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\vk_swiftshader.dll

Filesize
4.4MB

MD5
af9636acb7fe99994c1403a904ae79c8

SHA1
e4840fc30a210979a9c63c0fe53046d801c1191c

SHA256
eabcc510d82df12fa2ee565945df3fe0709d59800fee5abc6d9bc1938d05b6bf

SHA512
a0656e8323ad3f081136d64d84d917527ef768f20e6817ad2463e08147784fe37f8d629914ba90d1cd76c6d5417ce4e6be965df7765b1afa8e182364d6a92803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\7z-out\vulkan-1.dll

Filesize
711KB

MD5
5c63bee5cbfc5a7c76260685ab9abdce

SHA1
ffb039219381201fd1815465e1e4d5316827b45d

SHA256
1ca6139fc08d14c720a3b538f971d3555c4bd6409ccd88095beb037f8cf34640

SHA512
d1692e7b773d11dcaffa778657f39f0321e140878cc6ef23aba27353c8fd11e210d62783315fd945f21a51be4d03825a8f24fd60f1b715a9ca127bfc394400b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\Bonjour64.msi

Filesize
2.6MB

MD5
8dcf5c9eaacdaf4568220d103f393dea

SHA1
27f68596398b68ba048f95752b4eeb4aa013c23f

SHA256
53be81cc6e2dc95a1041e8f3d8f500fad4259ab20a1aac151b5fc7a64d354a93

SHA512
10f8ffb6fa5e7163f0a83190ddf211479f12e16635389b49ac041eceafd7f04c040d830065adc89b1003f38d8381851c09150a5bc8edced6ecae8ee5ae801088

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\package.7z

Filesize
66.9MB

MD5
fc9ae1e6d555ff0f22e368a16a5355fc

SHA1
a4dc343054bfd84575de7265cfe935e0fc71fe05

SHA256
55413518d718ca27c591154d4fdd4a36bd743e76b7e86f83caa0336068df11f2

SHA512
b487bc96fab5f65474b275a849daf238c41987f38caa4151e98a81951106bcb45c04f67807090312ceb1eceeb4455b29d3dbe4b471606dd3afcc89d120286bf8

Download Submit
C:\Users\Admin\AppData\Roaming\barcode-to-pc-server\Preferences

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\barcode-to-pc-server\Preferences~RFe594ced.TMP

Filesize
86B

MD5
d11dedf80b85d8d9be3fec6bb292f64b

SHA1
aab8783454819cd66ddf7871e887abdba138aef3

SHA256
8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

SHA512
6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

Download Submit
C:\Users\Admin\AppData\Roaming\barcode-to-pc-server\config.json

Filesize
36B

MD5
40c195a6520032912431b9229e170430

SHA1
097b985f4a4dcd51ff6674d43a0c4976c74e9415

SHA256
48f5914b9792dca140c7a1b0552c3952f26693bb1b7d84962c1c3986d93f7423

SHA512
59b0fd321391cd2312fc15b0f0ed142783054d86ee88238286ba968bd4a61bcd32a8fb216a38b02d0c8ad464f8ceac384303fb97b9ef464df01ea3bd07432e24

Download Submit
C:\Windows\Installer\MSIAB10.tmp

Filesize
75KB

MD5
08c031fa82a09aae1079378669678fe6

SHA1
b109251d2fef08bd446be0c92369e6f11eb67093

SHA256
8764d060558a9d4ef24adb43201d5178033171a649ad497f79ce3b6cc8eda98a

SHA512
d133a7c02ee8e6e4a971ed4a6537c11cb58516a5ac0501672169805f7b97591d7cffd3a72133bd1df4b8d8a4f4965ddf324a83cd9be0d8af15e646a121e2ea4c

Download Submit
C:\Windows\Installer\MSIADE0.tmp

Filesize
75KB

MD5
08c031fa82a09aae1079378669678fe6

SHA1
b109251d2fef08bd446be0c92369e6f11eb67093

SHA256
8764d060558a9d4ef24adb43201d5178033171a649ad497f79ce3b6cc8eda98a

SHA512
d133a7c02ee8e6e4a971ed4a6537c11cb58516a5ac0501672169805f7b97591d7cffd3a72133bd1df4b8d8a4f4965ddf324a83cd9be0d8af15e646a121e2ea4c

Download Submit
C:\Windows\Installer\MSIB17C.tmp

Filesize
75KB

MD5
08c031fa82a09aae1079378669678fe6

SHA1
b109251d2fef08bd446be0c92369e6f11eb67093

SHA256
8764d060558a9d4ef24adb43201d5178033171a649ad497f79ce3b6cc8eda98a

SHA512
d133a7c02ee8e6e4a971ed4a6537c11cb58516a5ac0501672169805f7b97591d7cffd3a72133bd1df4b8d8a4f4965ddf324a83cd9be0d8af15e646a121e2ea4c

Download Submit
C:\Windows\Installer\MSIB17C.tmp

Filesize
75KB

MD5
08c031fa82a09aae1079378669678fe6

SHA1
b109251d2fef08bd446be0c92369e6f11eb67093

SHA256
8764d060558a9d4ef24adb43201d5178033171a649ad497f79ce3b6cc8eda98a

SHA512
d133a7c02ee8e6e4a971ed4a6537c11cb58516a5ac0501672169805f7b97591d7cffd3a72133bd1df4b8d8a4f4965ddf324a83cd9be0d8af15e646a121e2ea4c

Download Submit
C:\Windows\Installer\MSIB228.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
C:\Windows\Installer\MSIB41D.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
C:\Windows\Installer\MSIB95F.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
C:\Windows\Installer\MSIB95F.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
C:\Windows\Installer\e58a3fb.msi

Filesize
2.6MB

MD5
8dcf5c9eaacdaf4568220d103f393dea

SHA1
27f68596398b68ba048f95752b4eeb4aa013c23f

SHA256
53be81cc6e2dc95a1041e8f3d8f500fad4259ab20a1aac151b5fc7a64d354a93

SHA512
10f8ffb6fa5e7163f0a83190ddf211479f12e16635389b49ac041eceafd7f04c040d830065adc89b1003f38d8381851c09150a5bc8edced6ecae8ee5ae801088

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
25.0MB

MD5
34e3a353cea27f0a015f5b546b192922

SHA1
d8f05a586ea64fca066fffe01a21e548469d2bf3

SHA256
c9663f79e616277a67054f2590b6ba9a665cb0b4b9b0d0e669fcd38e893ccfd2

SHA512
bd492720b66f30650925bac902f54061088b9315de5140133ead86e93e03ecd140c79e50dc256d4cae3bc871d13a75e88e6f64b7876de114b475ebf43eee173d

Download Submit
\??\Volume{96ff0cd0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a4bb43b8-51ac-4760-9188-e79c3a33fb2c}_OnDiskSnapshotProp

Filesize
5KB

MD5
b0c7d59f96c52a1af7dbf6f05e172c49

SHA1
857fd185bfb3ce3291d0eeeedc7bebdb76a04122

SHA256
7581f989ff0ef26b20d10c209245ceb6463bbb463c88f47f1910a1e0aa0b8b2b

SHA512
455d84df278b59673ccc0b46438f5a513807388eef4837a404fc64de18c141281c1018d423be319733bba63eb97de1505d1e40bb6607a219ecf77df9a695d1a4

Download Submit
\Program Files (x86)\Bonjour\mdnsNSP.dll

Filesize
118KB

MD5
40947436a70e0034e41123df5a0a7702

SHA1
6c27e1dd1c1533feb6435190a5074300ac2a9822

SHA256
5d40fd92da5ca59c1badb58ad509db6a6d613f18660a9a270a53eca85d34c3a9

SHA512
ba5634cc82f306245f9f0350bfa0b91e2f5ffc6c355b1452a95483f47e6acdb42c4e063f6c15115faf0f0630005df4fe8ef0e01539c270031cbd07a34a929704

Download Submit
\Program Files\Barcode to PC server\ffmpeg.dll

Filesize
2.6MB

MD5
615fefdaf9e42deb3857fd03b0f4ae92

SHA1
89cdf69ef75e8202de78fcfd49463045bcd43a49

SHA256
cdc10a7bd09c80d479407d9577648e4b9b30fd4b5493ac7875543dcc2981d05c

SHA512
930ff64aa2f0b7a79d8c035aa6e9ee6ef59617bb19a30fc9ca59d50138db8b3bd148606c1311aba7c9af4272ac127d664621ce401c42ca8b008b1e7245211359

Download Submit
\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\libnut.node

Filesize
56KB

MD5
cf11a982c7fd2562bced2628b2406286

SHA1
2d8eba20c91c916fb1502720952e49fb1b2b3f05

SHA256
751bd9e33880fdd08e55364476356944661ae0a2b1ae41c0bfbf08976f48f122

SHA512
8c1d37fac6de83c3287887e47ce84e16e050b56bfb15bbd56f2194fe44a7f5c3a8f3d0c947370a0a97c3878f7f3eaf50289ee07589e2a56b3015876a921a21c6

Download Submit
\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\msvcp140.dll

Filesize
618KB

MD5
9ff712c25312821b8aec84c4f8782a34

SHA1
1a7a250d92a59c3af72a9573cffec2fcfa525f33

SHA256
517cd3aac2177a357cca6032f07ad7360ee8ca212a02dd6e1301bf6cfade2094

SHA512
5a65da337e64ea42bcc461b411ae622ce4dec1036638b1e5de4757b366875d7f13c1290f2ee345f358994f648c5941db35aa5d2313f547605508fd2bcc047e33

Download Submit
\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\vcruntime140.dll

Filesize
85KB

MD5
edf9d5c18111d82cf10ec99f6afa6b47

SHA1
d247f5b9d4d3061e3d421e0e623595aa40d9493c

SHA256
d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb

SHA512
bf017aa8275c5b6d064984a606c5d40852aa70047759468395fe520f7f68b5452befc3145efaa7c51f8ec3bf71d9e32dbd5633637f040d58ff9a4b6953bf1cbf

Download Submit
\Program Files\Barcode to PC server\resources\app.asar.unpacked\node_modules\@nut-tree\libnut-win32\build\Release\vcruntime140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
\Program Files\Bonjour\mdnsNSP.dll

Filesize
129KB

MD5
f9d908de6b166dac9b89bf62fa291ce8

SHA1
938b53238291fc41ae852fdde51eed7a2bff0604

SHA256
d0a918ad60221623bb0278ea94cd6938744617fdbb2054968afafc2940648f02

SHA512
6643a7066974abfd5904df73ed225fd5eed4a84341b12199b6eb9a8a2ad234dba865d50f8ccff8a88002ce4c6ae2131745cf43aac88a3a0a66b596fb0d93e56e

Download Submit
\Program Files\Bonjour\mdnsNSP.dll

Filesize
129KB

MD5
f9d908de6b166dac9b89bf62fa291ce8

SHA1
938b53238291fc41ae852fdde51eed7a2bff0604

SHA256
d0a918ad60221623bb0278ea94cd6938744617fdbb2054968afafc2940648f02

SHA512
6643a7066974abfd5904df73ed225fd5eed4a84341b12199b6eb9a8a2ad234dba865d50f8ccff8a88002ce4c6ae2131745cf43aac88a3a0a66b596fb0d93e56e

Download Submit
\Program Files\Bonjour\mdnsNSP.dll

Filesize
129KB

MD5
f9d908de6b166dac9b89bf62fa291ce8

SHA1
938b53238291fc41ae852fdde51eed7a2bff0604

SHA256
d0a918ad60221623bb0278ea94cd6938744617fdbb2054968afafc2940648f02

SHA512
6643a7066974abfd5904df73ed225fd5eed4a84341b12199b6eb9a8a2ad234dba865d50f8ccff8a88002ce4c6ae2131745cf43aac88a3a0a66b596fb0d93e56e

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\INetC.dll

Filesize
238KB

MD5
38caa11a462b16538e0a3daeb2fc0eaf

SHA1
c22a190b83f4b6dc0d6a44b98eac1a89a78de55c

SHA256
ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a

SHA512
777135e05e908ac26bfce0a9c425b57f7132c1cdb0969bbb6ef625748c868860602bacc633c61cab36d0375b94b6bcfbd8bd8c7fa781495ef7332e362f8d44d1

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\nsDialogs.dll

Filesize
9KB

MD5
466179e1c8ee8a1ff5e4427dbb6c4a01

SHA1
eb607467009074278e4bd50c7eab400e95ae48f7

SHA256
1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172

SHA512
7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsh8C14.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
\Windows\Installer\MSIAB10.tmp

Filesize
75KB

MD5
08c031fa82a09aae1079378669678fe6

SHA1
b109251d2fef08bd446be0c92369e6f11eb67093

SHA256
8764d060558a9d4ef24adb43201d5178033171a649ad497f79ce3b6cc8eda98a

SHA512
d133a7c02ee8e6e4a971ed4a6537c11cb58516a5ac0501672169805f7b97591d7cffd3a72133bd1df4b8d8a4f4965ddf324a83cd9be0d8af15e646a121e2ea4c

Download Submit
\Windows\Installer\MSIADE0.tmp

Filesize
75KB

MD5
08c031fa82a09aae1079378669678fe6

SHA1
b109251d2fef08bd446be0c92369e6f11eb67093

SHA256
8764d060558a9d4ef24adb43201d5178033171a649ad497f79ce3b6cc8eda98a

SHA512
d133a7c02ee8e6e4a971ed4a6537c11cb58516a5ac0501672169805f7b97591d7cffd3a72133bd1df4b8d8a4f4965ddf324a83cd9be0d8af15e646a121e2ea4c

Download Submit
\Windows\Installer\MSIB17C.tmp

Filesize
75KB

MD5
08c031fa82a09aae1079378669678fe6

SHA1
b109251d2fef08bd446be0c92369e6f11eb67093

SHA256
8764d060558a9d4ef24adb43201d5178033171a649ad497f79ce3b6cc8eda98a

SHA512
d133a7c02ee8e6e4a971ed4a6537c11cb58516a5ac0501672169805f7b97591d7cffd3a72133bd1df4b8d8a4f4965ddf324a83cd9be0d8af15e646a121e2ea4c

Download Submit
\Windows\Installer\MSIB228.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
\Windows\Installer\MSIB41D.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
\Windows\Installer\MSIB95F.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
memory/4948-1386-0x00000215186F0000-0x0000021518815000-memory.dmp

Filesize
1.1MB

Download
memory/5072-1309-0x00007FFD4B350000-0x00007FFD4B351000-memory.dmp

Filesize
4KB

Download
memory/5072-1408-0x000001CA136D0000-0x000001CA137F5000-memory.dmp

Filesize
1.1MB

Download