hxxps://feathermc[.]com/

Analysis

max time kernel
1523s
max time network
1527s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
22-08-2023 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://feathermc.com/

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
376	Feather Launcher Setup 1.5.5.exe
4288	vcredist_x64.exe
3344	vcredist_x64.exe
2988	VC_redist.x64.exe
4624	VC_redist.x64.exe
112	VC_redist.x64.exe
3944	Feather Launcher.exe
1600	Feather Launcher.exe
936	Feather Launcher.exe
2292	Feather Launcher.exe
4728	Feather Launcher.exe
3840	Feather Launcher.exe
1808	Feather Launcher.exe

Loads dropped DLL 26 IoCs

pid	Process
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
3344	vcredist_x64.exe
4624	VC_redist.x64.exe
2252	VC_redist.x64.exe
3944	Feather Launcher.exe
1600	Feather Launcher.exe
936	Feather Launcher.exe
2292	Feather Launcher.exe
1600	Feather Launcher.exe
1600	Feather Launcher.exe
1600	Feather Launcher.exe
1600	Feather Launcher.exe
2292	Feather Launcher.exe
2292	Feather Launcher.exe
4728	Feather Launcher.exe
3840	Feather Launcher.exe
1808	Feather Launcher.exe
1808	Feather Launcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6} = "\"C:\\ProgramData\\Package Cache\\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d} = "\"C:\\ProgramData\\Package Cache\\{ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Feather Launcher\d3dcompiler_47.dll	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\fi.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\sr.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\ur.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\LICENSE.electron.txt	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\et.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\kn.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\nb.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\th.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\ko.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\lt.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\lv.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\tr.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\Uninstall Feather Launcher.exe	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\af.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\hu.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\ml.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\sk.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\ta.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\resources\elevate.exe	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\snapshot_blob.bin	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\el.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\hr.pak	Feather Launcher Setup 1.5.5.exe
File opened for modification	C:\Program Files\Feather Launcher\resources\app.asar.unpacked\native	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\icudtl.dat	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\pt-PT.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\ro.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\bn.pak	Feather Launcher Setup 1.5.5.exe
File opened for modification	C:\Program Files\Feather Launcher\resources	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\fil.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\hi.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\chrome_200_percent.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\libEGL.dll	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\resources.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\vk_swiftshader.dll	Feather Launcher Setup 1.5.5.exe
File opened for modification	C:\Program Files\Feather Launcher\locales	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\es.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\mr.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\pl.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\zh-CN.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\en-US.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\ms.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\chrome_100_percent.pak	Feather Launcher Setup 1.5.5.exe
File opened for modification	C:\Program Files\Feather Launcher\chrome_100_percent.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\libGLESv2.dll	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\v8_context_snapshot.bin	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\vulkan-1.dll	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\en-GB.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\pt-BR.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\te.pak	Feather Launcher Setup 1.5.5.exe
File opened for modification	C:\Program Files\Feather Launcher\resources\app.asar.unpacked	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\resources\app.asar	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\resources\app.asar.unpacked\native\cleanup.feather	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\am.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\gu.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\he.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\nl.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\ru.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\sl.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\da.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\es-419.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\sv.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\locales\uk.pak	Feather Launcher Setup 1.5.5.exe
File created	C:\Program Files\Feather Launcher\resources\app-update.yml	Feather Launcher Setup 1.5.5.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIEA56.tmp	msiexec.exe
File created	C:\Windows\Installer\e5dd370.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5dd370.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDDA2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE4B7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5dd383.msi	msiexec.exe
File created	C:\Windows\Installer\e5dd398.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8DE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5dd383.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{12A2980B-E47B-491B-92F5-0BC703841ED4}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AE043016-3897-41D4-870B-1DAEE62CF152}	msiexec.exe
File created	C:\Windows\Installer\e5dd382.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133371989046539786"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.30.30708"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0892A21B74EB194295FB07C3048E14D\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	Feather Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\610340EA79834D1478B0D1EA6EC21F25\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Feather Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Feather Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Feather Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\Version = "12.0.40649.5"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\ = "{ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d}"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\610340EA79834D1478B0D1EA6EC21F25\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\610340EA79834D1478B0D1EA6EC21F25\Version = "236877812"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\610340EA79834D1478B0D1EA6EC21F25\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{AE043016-3897-41D4-870B-1DAEE62CF152}v14.30.30708\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Feather Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\ = "{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}"	vcredist_x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Feather Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Feather Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Feather Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Feather Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\610340EA79834D1478B0D1EA6EC21F25\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0892A21B74EB194295FB07C3048E14D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Feather Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616257"	Feather Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "3"	Feather Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Feather Launcher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Feather Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Feather Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents\{ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0892A21B74EB194295FB07C3048E14D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{12A2980B-E47B-491B-92F5-0BC703841ED4}v14.30.30708\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Feather Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	Feather Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode = "6"	Feather Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}	vcredist_x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Feather Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Feather Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1"	Feather Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Feather Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Feather Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\610340EA79834D1478B0D1EA6EC21F25\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\610340EA79834D1478B0D1EA6EC21F25\SourceList	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Feather Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12	vcredist_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0892A21B74EB194295FB07C3048E14D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Feather Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\610340EA79834D1478B0D1EA6EC21F25\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0892A21B74EB194295FB07C3048E14D\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Feather Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Feather Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	Feather Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Feather Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\610340EA79834D1478B0D1EA6EC21F25\PackageCode = "F96055D82F2822E4CA2882E9779EF982"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.30.30708"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Feather Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Feather Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Version = "14.30.30708.0"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12	vcredist_x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295"	Feather Launcher.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Feather Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Feather Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Feather Launcher.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
376	chrome.exe
376	chrome.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
376	Feather Launcher Setup 1.5.5.exe
4340	msiexec.exe
4340	msiexec.exe
4340	msiexec.exe
4340	msiexec.exe
4340	msiexec.exe
4340	msiexec.exe
4340	msiexec.exe
4340	msiexec.exe
4728	Feather Launcher.exe
4728	Feather Launcher.exe
3840	Feather Launcher.exe
3840	Feather Launcher.exe
1808	Feather Launcher.exe
1808	Feather Launcher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3944	Feather Launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
376	Feather Launcher Setup 1.5.5.exe
4288	vcredist_x64.exe
3344	vcredist_x64.exe
2988	VC_redist.x64.exe
4624	VC_redist.x64.exe
112	VC_redist.x64.exe
2668	VC_redist.x64.exe
2252	VC_redist.x64.exe
1164	VC_redist.x64.exe
3944	Feather Launcher.exe
3944	Feather Launcher.exe
3944	Feather Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 3356	3384	chrome.exe	63
PID 3384 wrote to memory of 3356	3384	chrome.exe	63
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 1204	3384	chrome.exe	86
PID 3384 wrote to memory of 3048	3384	chrome.exe	87
PID 3384 wrote to memory of 3048	3384	chrome.exe	87
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90
PID 3384 wrote to memory of 4648	3384	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://feathermc.com/
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe35df9758,0x7ffe35df9768,0x7ffe35df9778
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:2
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:1
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4744 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1140 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1708 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4880 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5468 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4896 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1876,i,427049848650604410,9874393598285098881,131072 /prefetch:8
  2⤵
  PID:3248
- C:\Users\Admin\Downloads\Feather Launcher Setup 1.5.5.exe
  "C:\Users\Admin\Downloads\Feather Launcher Setup 1.5.5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:376
- - C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\vcredist_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\vcredist_x64.exe" /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\vcredist_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\vcredist_x64.exe" /quiet /norestart -burn.unelevated BurnPipe.{AD035646-B2C7-4721-A45B-C16ADB77C176} {F0637F93-2D3C-4A4E-988D-670308CC98AE} 4288
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3344
- - C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\VC_redist.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\VC_redist.x64.exe" /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2988
  - - C:\Windows\Temp\{55031A20-D5F4-43E5-88B5-C22FF9514F83}\.cr\VC_redist.x64.exe
      "C:\Windows\Temp\{55031A20-D5F4-43E5-88B5-C22FF9514F83}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\VC_redist.x64.exe" -burn.filehandle.attached=680 -burn.filehandle.self=692 /quiet /norestart
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:4624
    - - C:\Windows\Temp\{693FA08F-7E17-4956-BBEC-33BAC1A937CB}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{693FA08F-7E17-4956-BBEC-33BAC1A937CB}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2BA869E6-EA9A-4EA2-BDF2-FCD4BA83F19D} {E7645CF1-45D9-4E80-9E98-41EC7B8672B0} 4624
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:112
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d} -burn.filehandle.self=1156 -burn.embedded BurnPipe.{40D53BF8-5536-47D3-A8AD-6E1A6683085D} {520EA504-E5A7-417E-BC5F-8B7BABE9D7C6} 112
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=652 -burn.filehandle.self=672 -uninstall -quiet -burn.related.upgrade -burn.ancestors={ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d} -burn.filehandle.self=1156 -burn.embedded BurnPipe.{40D53BF8-5536-47D3-A8AD-6E1A6683085D} {520EA504-E5A7-417E-BC5F-8B7BABE9D7C6} 112
        7⤵
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0315A505-0151-4D79-8285-FDC45AB3610C} {2EF60D32-EE66-4875-9270-D448DA549FAD} 2252
        8⤵
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1164

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4116

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:4748

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4340

C:\Program Files\Feather Launcher\Feather Launcher.exe
"C:\Program Files\Feather Launcher\Feather Launcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3944
- C:\Program Files\Feather Launcher\Feather Launcher.exe
  "C:\Program Files\Feather Launcher\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1748,i,8643353266462596557,16390199435903755377,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1600
- C:\Program Files\Feather Launcher\Feather Launcher.exe
  "C:\Program Files\Feather Launcher\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-path="C:\Program Files\Feather Launcher\resources\app.asar" --no-sandbox --no-zygote --disable-blink-features=GetDisplayMedia --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2384 --field-trial-handle=1748,i,8643353266462596557,16390199435903755377,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2292
- - C:\Program Files\Feather Launcher\Feather Launcher.exe
    "C:\Program Files\Feather Launcher\Feather Launcher.exe" "C:\Program Files\Feather Launcher\resources\app.asar\preload\preload-mod-watcher-fork.js"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4728
- - C:\Program Files\Feather Launcher\Feather Launcher.exe
    "C:\Program Files\Feather Launcher\Feather Launcher.exe" "C:\Program Files\Feather Launcher\resources\app.asar\preload\preload-skin-watcher-fork.js"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3840
- C:\Program Files\Feather Launcher\Feather Launcher.exe
  "C:\Program Files\Feather Launcher\Feather Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --mojo-platform-channel-handle=1888 --field-trial-handle=1748,i,8643353266462596557,16390199435903755377,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:936
- C:\Program Files\Feather Launcher\Feather Launcher.exe
  "C:\Program Files\Feather Launcher\Feather Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1208 --field-trial-handle=1748,i,8643353266462596557,16390199435903755377,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5dd375.rbs

Filesize
19KB

MD5
0936b218d6bf9c59b4767dc793981298

SHA1
870c0d20357b9dcf0c6df43b347ff1157741767f

SHA256
217865a0b6f14002ae8790a7bd22948eeffa7d7e959ccf2ffcfb1f9e3c7594bd

SHA512
80a5be1b60063a8773defd472f5777fbd4b594e5556f02e735e46b98a49ba0688651efba73fde402f6211d5d1270e458584d065e7664e31edf026182e04c5d23

Download Submit
C:\Config.Msi\e5dd381.rbs

Filesize
19KB

MD5
e131d79a1da0578c43f42ec85bc12494

SHA1
3cff076c22645c77833bd14fa2b17c5bf009ae6f

SHA256
914239ce0cd8a7ef51890ea91ce602ee27672c4ef06bac669447ea8cd6215be1

SHA512
08e17965df889028ed0f09812a64494e0669e8bf2cc213b58a10799a071123cee685f7ed47713225a1e1fef56e2748c1198e3c3cdf95605e5b7aab52626f97b1

Download Submit
C:\Config.Msi\e5dd388.rbs

Filesize
21KB

MD5
80aed86f2dbfee1b5be6b43a0e469ced

SHA1
48b4c17b6400f6d37916a3aac9bfaefc32c9981b

SHA256
5b672605eb3dd3cf1bd045a067a43c95e72e1810beb4a1c58f3f37872221868b

SHA512
61d2f68bbed123bbf6a9c4fad884a500265d3ca726569d4bca0fae305a2e7790d27e9c34d8cc39ffaf6dbd93a5d0d14a31854901c617d043adfacd86666d508a

Download Submit
C:\Config.Msi\e5dd397.rbs

Filesize
21KB

MD5
4dba1cadc67acdd4545964f2d352f581

SHA1
8af718738284a10fbbc5fd2a6ac78994c1575327

SHA256
ddc69d820d3421bba0c4c648730061429f7052aecac15f7e97760f1aabbaeb99

SHA512
eb37cb019ae1e426dd31044aaba2eef4d75f4fae6620d97a9bcd6991432ed748bfbf0c681701b22437538777bfce1f53d96b515c58301ac4d8c5f57f0339d8e8

Download Submit
C:\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
145.0MB

MD5
fe25f9cfc1df95770eddb8090f7d0b8f

SHA1
001b7ceb9c1bac8fcce45d80fd0dbb96879b8695

SHA256
112abb0dfc8f76ecb80c4bc9c7bfc01ba8e7d6bae2d48cb12b47d32428029bc9

SHA512
257c396c1acf9bb6f964d5f4deda7435a72832f9147a49dc06a1818cf77ea52ae7778248a250695b12e618adfdec3c78ca57568da15973dfffc95ddf7a554b8e

Download Submit
C:\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
145.0MB

MD5
fe25f9cfc1df95770eddb8090f7d0b8f

SHA1
001b7ceb9c1bac8fcce45d80fd0dbb96879b8695

SHA256
112abb0dfc8f76ecb80c4bc9c7bfc01ba8e7d6bae2d48cb12b47d32428029bc9

SHA512
257c396c1acf9bb6f964d5f4deda7435a72832f9147a49dc06a1818cf77ea52ae7778248a250695b12e618adfdec3c78ca57568da15973dfffc95ddf7a554b8e

Download Submit
C:\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
145.0MB

MD5
fe25f9cfc1df95770eddb8090f7d0b8f

SHA1
001b7ceb9c1bac8fcce45d80fd0dbb96879b8695

SHA256
112abb0dfc8f76ecb80c4bc9c7bfc01ba8e7d6bae2d48cb12b47d32428029bc9

SHA512
257c396c1acf9bb6f964d5f4deda7435a72832f9147a49dc06a1818cf77ea52ae7778248a250695b12e618adfdec3c78ca57568da15973dfffc95ddf7a554b8e

Download Submit
C:\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
145.0MB

MD5
fe25f9cfc1df95770eddb8090f7d0b8f

SHA1
001b7ceb9c1bac8fcce45d80fd0dbb96879b8695

SHA256
112abb0dfc8f76ecb80c4bc9c7bfc01ba8e7d6bae2d48cb12b47d32428029bc9

SHA512
257c396c1acf9bb6f964d5f4deda7435a72832f9147a49dc06a1818cf77ea52ae7778248a250695b12e618adfdec3c78ca57568da15973dfffc95ddf7a554b8e

Download Submit
C:\Program Files\Feather Launcher\chrome_100_percent.pak

Filesize
126KB

MD5
a3d4515d3a33a407d313a62818e82a5d

SHA1
967ff9a6774a66f7b3299af4fd5d70961ed54d79

SHA256
662a9db6ef4197cb4b6c50648a2cafceb7fd903015828df3fee605a602370be0

SHA512
0c757e1beccbca1ae0791fa0c51a9e2019696bd0965c73de67b364fba6f317ea2cf20fa65e4fa7dd22519683528e5112dc8c530049170f4e702e0c8d4e065801

Download Submit
C:\Program Files\Feather Launcher\chrome_200_percent.pak

Filesize
175KB

MD5
3bab45c70f22646cf8452c30903810cb

SHA1
40b31d4c79b5a2b8d12f8cf8b6c49c962c31f766

SHA256
d4282ae977f23afe252e19e421c8d09696ea3b83a1e73a6aaebaaa5547c74cbc

SHA512
85eda055494f0233c963e821906cf69d94e664d8396e8b08e7a8f412e1c16af71252fef1bfe3ed43cfad157aa90c0dcbb375626e2ddf0e807c9b23ad27e61d9c

Download Submit
C:\Program Files\Feather Launcher\d3dcompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
C:\Program Files\Feather Launcher\ffmpeg.dll

Filesize
2.7MB

MD5
68ea02ddbfdd0aa3a694789ee6d95bc2

SHA1
326354fda27d5de1a7bf23b440c6eeb889c7c00d

SHA256
0c4e27571b2b7c2f50fb6c6d9746fa978079bfb3834bd69ac2f36123c41a0c99

SHA512
5d517890cfa9782eb5e78ae9bbec54c25b7db1260bc73e39e6b96fc5482b5d7908e25b8b0571eab7129ce78963bea601fecc6be1efda6376addb1c0240e7276e

Download Submit
C:\Program Files\Feather Launcher\ffmpeg.dll

Filesize
2.7MB

MD5
68ea02ddbfdd0aa3a694789ee6d95bc2

SHA1
326354fda27d5de1a7bf23b440c6eeb889c7c00d

SHA256
0c4e27571b2b7c2f50fb6c6d9746fa978079bfb3834bd69ac2f36123c41a0c99

SHA512
5d517890cfa9782eb5e78ae9bbec54c25b7db1260bc73e39e6b96fc5482b5d7908e25b8b0571eab7129ce78963bea601fecc6be1efda6376addb1c0240e7276e

Download Submit
C:\Program Files\Feather Launcher\icudtl.dat

Filesize
10.0MB

MD5
6690f2b2384e1bf8961fda96a4d07691

SHA1
111f6dd9833c653908431621fe8fbc87f1135632

SHA256
cb73d42d36839708013393ad0e4e932fdda9a1acda9275ecdbe74fe89eea8366

SHA512
6a5242fdc0ba09e339151feae1b3f7a9f00a09288b6f4ea9305d1a09d8bc3015c074ee91de35b8d6fc765c2fb55ec37dd91b8e66b7a7bb3148cbc305de19b088

Download Submit
C:\Program Files\Feather Launcher\locales\es-419.pak

Filesize
358KB

MD5
637dcfd56428fe96bb0a778b0cf8a660

SHA1
1bad857d600d00864edc3d31529cf4ef6a49b580

SHA256
45f136986a226b1385189997aad2f660d0f518cc9871862250736237e0b105cf

SHA512
66b5c92687e97326af47258d38ec523184ced00855ca385515c64bfb9a7e3eb8dd1f885c4db5891bad680c670714bf9e5574483e34265c1f7781c8a7e7af9301

Download Submit
C:\Program Files\Feather Launcher\locales\es.pak

Filesize
359KB

MD5
85e0afd9c09f97cecc025f31fdb6269c

SHA1
13b9ec632e465c31fe6e88b1e3c186a2eacf5de6

SHA256
e1a9180677d2989137e8dd381e6c847c47b385a6d3e965a047829479317736ae

SHA512
0371b816522bc43b124ab8dfba3ac55e63c435276031f7035075a0767a11f3d73b5991156ee6ea1770d0115c09cb653c9d3fbda4b2d9f1e00b068c9d7a2f8db4

Download Submit
C:\Program Files\Feather Launcher\resources.pak

Filesize
5.1MB

MD5
2cccd68519bff7f6a45380607940ca9a

SHA1
107ed8e7aaf2ea4d8b290afc023fdede16e47254

SHA256
44387afe96c6d1cc6b24e6e05e42e92eb51d6c520743fc8e2eab06c683ba27e3

SHA512
da3c67f10ff1d741f6c4d5313f8f1887ad3232b33935d5576d321e2d0622f601fde3f3cae24b23f00e8e7f7f48aea49fcf4fde12aef2b396ea5697566f8b7128

Download Submit
C:\Program Files\Feather Launcher\resources\app.asar

Filesize
47.7MB

MD5
8369d9fbfedb113095eb402c4e3a82fb

SHA1
789bdf48d048391ae8d49c903d0f8fa5f5bc78d2

SHA256
e878d22ac49f49c53b939c5a7065f057c73c39674422cb74deaaa039ac31c5aa

SHA512
97828d662a348a10344cfbd83de5260c2e6c6aedb5b99dfc64050611267494d0e1e8e6ed42d3ed3a927cb03122925ca84fa53b4e7f3c3d3d1123163e8f0e555a

Download Submit
C:\Program Files\Feather Launcher\v8_context_snapshot.bin

Filesize
716KB

MD5
b978b7e83b574a43fe766af2b670c1c4

SHA1
ab0d1211740fefe3b8ddc8bcb2400e68cc88ba4d

SHA256
f59fa568139442c7f547fc8a5a0fd090ddc8427cc409e2fcef0518a9dcb47a96

SHA512
ac0f297b128e83d55788aadf5870849781d81cc61461117c5cf22f757e20089acb640b3ebc2f3bb2fbe1659e75da73a63cb884be4a791a90702758e6c52dc706

Download Submit
C:\ProgramData\Package Cache\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\state.rsm

Filesize
710B

MD5
7ae2b82447a325a4e37bc2d682dd2dd4

SHA1
fd0ad507e8a0856a24de168fef4282b97117520e

SHA256
ca47fd8fef9ed1bf84ae6a71224f5c211907aa312bfa1f966330e004b54037f8

SHA512
892247143638399ac59fae9e7964b7291569a0b19483d218d4d31ea4e1c3982d3bb3a50efc81796e82d37a6f6b679d28cd2f527bdf2d78a531d2aca137d1c1e0

Download Submit
C:\ProgramData\Package Cache\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\vcredist_x64.exe

Filesize
455KB

MD5
622a95e2fccc1657cb2a760688b40665

SHA1
3feda4e77dcd8faf189371c71a35066b01320873

SHA256
e52469f3bce3768b43615ba44bc891dd2cda1b8e05659debd0cdbdebaaf9b199

SHA512
cd7a4705a8b7543d85b9d45d2832641d9783232494c66570d0a1084dbeb67cbfb5f4143e0deda7840f8f53db890f1029f9faf2a8814c1e885aa618f028a0b6b1

Download Submit
C:\ProgramData\Package Cache\{ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d}\VC_redist.x64.exe

Filesize
634KB

MD5
464799b58f1090430afa4aa6183bedb6

SHA1
f2b3d878516031e4d968fa8d7b160a14e51688e8

SHA256
42305b0bdfc29a9b03bbbf17b0adc12146cdb37031ae51029b440d537f714571

SHA512
7ab70eb7fdcc107bc41c345b8ca7414ea40f7c3b566614d7767d5d9d93b84cb73d14e447b8a885ce71fb1c46a2469b825a56946a1ef7ac0f8ffdd3110f08d97b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a46debb99d74f0b8d9b2f86381ac78e1

SHA1
08a0067fc34ca43862ff4ea2ae38fa95973030f5

SHA256
337ff4ea9b3fc65f7f31763bc37b66201f9fa871a02b24d180cbcc8466d420ad

SHA512
789223d839d070af2de2ac155b06c15721882b97673c6a76a7a1c175e08ccd176ac2a542c5fd89649d21ae9eb8630e2969db176c142440a4d4bcc1395b347d8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
999683f40e005d81e24bd9d548e3af1c

SHA1
eb6ba56cb78ea90ca792d954eb0b66664ee5a407

SHA256
34cea18179c27c0e288172cf8fce644b63ce0b630db5595829e768b82427534a

SHA512
bc03108eaa72fdb86798366830cb3277fee4548ff9c4723d03faf1975cd061f90e8620949530518bd9ed82bfc6adf9539938e2b6949e809e5daaa657c1da713d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d89b7b56ad76fb74dc2df421c9b35550

SHA1
01242472e1843ee0f2d7bfdd67d8791ed584ba2c

SHA256
3d3a13cb5d0f93bc46c16c427dd59cde5e93e2095449ae923446cf8ed8feabae

SHA512
dbdbe5167921de18488580e46931b15928fa10a0b9ffb8b91a1a6f5cb07dfa17454cdaad266847b5d21de60bb072bf0c7263f037a4b3ce9111314e593960d74b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
6c020d8518c2db81271152f563f1de9d

SHA1
d89c60bcd3059a117a54eb049b56b809a7109926

SHA256
f6f39d5a7a08d8b9d7823a6d7a983ba5041ddf2158160c7585ea1a20bd28e99e

SHA512
881c100086a329b595d1345f0e5d0f3a6e3264237f8ddf52eefd7d8d0c1fb25ea7c73a5f0b67ae13d845f000ad7a6f51f66377ac571656f503d98e8a0c3c48dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
5cc799eaab8cf8d9e66a57f43c826e3d

SHA1
ef59075f2726921ac53af4a27d676e2642daf1d2

SHA256
1240da1bbdf0c3df31a8229dde155cddb961d4f8eb075c34c4258fa2879cf5fc

SHA512
0414cbd8580898ab94434f4aa3ec6382bf85839cc4024dafe2d939d17881ec3596afd639edbea52b5c473bb9980ca7f8d3307c2b696d44dc17de20802406c739

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
1b207b3e5b34869e01df98d515e5668f

SHA1
8e5cccbb45ae0ddcf02ea257dc41af8708e357ed

SHA256
276f8516d7f4e3994b35fa53bb539b7c168757a125a635aa9bf753a963a9b70b

SHA512
6b67d32fb8c21c678caa4ad8cc998feec46f5a1cc7d04eadd02a2fb33fd8b5f99a125df67e7e53628f40b8e59b8e25add3a79a670bba5e29af9de54737d72945

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c1577b336b923cd909bfee3f3b9d8d9f

SHA1
33cbe1436a48465a45f5d10cc8127a0461b21685

SHA256
7b0f10f01c12ce1fbc240a3a4a8f0d65326f41dd159bee1886746f01df74309f

SHA512
1bfe730405ab83039e03e9ab8f1ce23145d27974bbdac4471abf05bb7875270d2a001b785115e0bf899a7b49a54616bcf5809ce3130eb1e28a71cc4e275a673f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
65b438f9e4221dc33efa38bb0d413898

SHA1
3f4ca18457d184e200c44e2e63696a9d4a9103b0

SHA256
c41d714a27bf82f9a69a81d027e8cf37570cc3f3bbac1bc955223e6d56d7fd37

SHA512
a4d0cd233a47d6cc6af032dc3db96f356d446e5b76668249054a747993c8ac07f8246cab9c939368f64769d552e33c6ba3c9f3339fbe6fefddef5cd42e0761b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cd9e9489aa245524dd61dd4f16731680

SHA1
d4b7c1f2fbdaeffd86dcb555308379c868c852df

SHA256
f9cfc7d8a05e37040b11a6a3d90992331639c4822b2470a0e9eb6ec897999a46

SHA512
172d5753c23f22d6b6f1d939a86da3a91fdf6a65bcbd4bd8b06498211529ada61f9e037ac5c404e6bcd97f460a323f34a1c87dcdaf45870925f450ffc6bc185f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f3102550750ed5c6a50557c1a238134f

SHA1
2500b6d86679878de2a76021d22ad55a4ca3ee9f

SHA256
70715bc86252c0e0ab4926c35a266405575ded07d6e266b1aa79040ba2844b8e

SHA512
04273fa94166441bca9c133d7fee7eeccf2e3a70c47dca75eda835bdb640eee7d0272c153986484abbb6f78b5f0241b24ce691cd9450a05d63956c7fa426e4e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
86ecbcbf16ba6b0ff4464f194f0055f3

SHA1
e6f9493696c4ec878258a51daf60e6d99ce7dd26

SHA256
c78de134a35c9074047e104f3b496f39fb6307d18add6361383aec4da1232743

SHA512
4b002329f796cb7a7989abf93cf9d81b44c3a8cd0db5da33a8986f33ffff131e8b23065abe95257fc447b12ecf65581931ffd49bb80f0fe6b24e2eee64beffd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
116KB

MD5
059a1181e825d592863fb83b4bfd7d99

SHA1
59bfd152fe11e784b9ae0aa54c5813847e647eaa

SHA256
c809ecd2f94c83aac72d485bc3036b5805c55ace87022b969bda5fceb0505ef7

SHA512
98bf8dafb6a8c8dd891170acccf52936831107a2008d6ebf2b8339a5393aa9c03ecb929a7029e857be3a16dc7a3185f95b9dd965dcf82d0bebb2345c2d9095a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
109KB

MD5
94933929b424e17ef52409a9b9af653b

SHA1
059d2f46b10cf5da179568e5c49b5a3fe57744c9

SHA256
8e9e20c1dc3f0fc6420f2875ac25c518c21950f3bab186c4511a6a26b30947f5

SHA512
90a16efd56b8320c550c3abfb3342b6e837c10ba62940a1b3c1c24fb9341164f8d847f0ca3a3c8c7d1e63ca05fe567e645bfb5b3bda1d2797e0c12ac066ca985

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5c2f35.TMP

Filesize
103KB

MD5
fdc065378442bd2421d7defa3e8ab414

SHA1
c1562b3252221c363de87bda3e797b0c45f93aea

SHA256
6bf87895da323fff004922d32227135e2bf003fe6bd4809c2e98392c4172be14

SHA512
72a5b14cc3e5dbd8ac0fbbb760254e033896ae023a43cc6c73a89bc2a07b2b9c97bc81ac335b8dc85ca4641a68859faa0d68b9dd0abbb6424f736cfcfa10b56b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20230822173455_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
262ffbe56fe0a58627345a23d1446407

SHA1
a3315193dac2be5f1822516ad7577cc27021cc4e

SHA256
07a741e76b8a259d47dd53b8110cfd880b76a23d196199326689e7f8a7f174a9

SHA512
b67bebbc9789af9693ff71e3e2a9e4b4c4557e0ba051b63df38a5ae89adab5fa8b24f49d03068d896d559246c8c4e8734b98cf038511f714abcc3340105860d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20230822173455_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
b0d3be1743bf080f0602e7d1277fe2a3

SHA1
0106bfc508ea737a64609e707b0fccdc3370138c

SHA256
5e0bda5b121435e205d54a510cbe1cf60cf9b20173bc65c15ba00086012dcb22

SHA512
1ef25af6fb1bdf4da3da31ef29ea1ef4d8734353b5707023d42bd963cda5387edb1af3445009586613356306dbc0002097e26763d8b47aa97d49dd5053328089

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\Feather Launcher.exe

Filesize
145.0MB

MD5
fe25f9cfc1df95770eddb8090f7d0b8f

SHA1
001b7ceb9c1bac8fcce45d80fd0dbb96879b8695

SHA256
112abb0dfc8f76ecb80c4bc9c7bfc01ba8e7d6bae2d48cb12b47d32428029bc9

SHA512
257c396c1acf9bb6f964d5f4deda7435a72832f9147a49dc06a1818cf77ea52ae7778248a250695b12e618adfdec3c78ca57568da15973dfffc95ddf7a554b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\LICENSES.chromium.html

Filesize
6.3MB

MD5
997768ae7eb8c036425bed10f766e823

SHA1
2ec99026b977f6603a8a7890bc05594a9a4f13a1

SHA256
ab30ee348b3257ec2f19fb5733e64278438be792f1280ce0f28eae0c9cb8943c

SHA512
f408b817b68861cbad62425e0bb8726f876d36a2212186a8f948d5c825c95ed819dcc41284d8ad8ac11e7ab7ff6141588fededd01c287780f84269846515f639

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\chrome_100_percent.pak

Filesize
126KB

MD5
a3d4515d3a33a407d313a62818e82a5d

SHA1
967ff9a6774a66f7b3299af4fd5d70961ed54d79

SHA256
662a9db6ef4197cb4b6c50648a2cafceb7fd903015828df3fee605a602370be0

SHA512
0c757e1beccbca1ae0791fa0c51a9e2019696bd0965c73de67b364fba6f317ea2cf20fa65e4fa7dd22519683528e5112dc8c530049170f4e702e0c8d4e065801

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\chrome_200_percent.pak

Filesize
175KB

MD5
3bab45c70f22646cf8452c30903810cb

SHA1
40b31d4c79b5a2b8d12f8cf8b6c49c962c31f766

SHA256
d4282ae977f23afe252e19e421c8d09696ea3b83a1e73a6aaebaaa5547c74cbc

SHA512
85eda055494f0233c963e821906cf69d94e664d8396e8b08e7a8f412e1c16af71252fef1bfe3ed43cfad157aa90c0dcbb375626e2ddf0e807c9b23ad27e61d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\ffmpeg.dll

Filesize
2.7MB

MD5
68ea02ddbfdd0aa3a694789ee6d95bc2

SHA1
326354fda27d5de1a7bf23b440c6eeb889c7c00d

SHA256
0c4e27571b2b7c2f50fb6c6d9746fa978079bfb3834bd69ac2f36123c41a0c99

SHA512
5d517890cfa9782eb5e78ae9bbec54c25b7db1260bc73e39e6b96fc5482b5d7908e25b8b0571eab7129ce78963bea601fecc6be1efda6376addb1c0240e7276e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\icudtl.dat

Filesize
10.0MB

MD5
6690f2b2384e1bf8961fda96a4d07691

SHA1
111f6dd9833c653908431621fe8fbc87f1135632

SHA256
cb73d42d36839708013393ad0e4e932fdda9a1acda9275ecdbe74fe89eea8366

SHA512
6a5242fdc0ba09e339151feae1b3f7a9f00a09288b6f4ea9305d1a09d8bc3015c074ee91de35b8d6fc765c2fb55ec37dd91b8e66b7a7bb3148cbc305de19b088

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\libEGL.dll

Filesize
458KB

MD5
655672c205e37b079c34a4427118479b

SHA1
e1d595a25e76f2f1be50f0ac3046e82462790d69

SHA256
498fafb59d3d1a91fa24f95a59411dacf3fb373408e8ea5f931e2ed6b2732d36

SHA512
a5ad3ac4e382d28d2d95cfc1b02ffca2ba1b5277567c1db81e14a87891e6ef9e5b8b2b56f4b63f8512c0b527dc3de7a5ebf5bb479dad827dfa17294f5874ab92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\libGLESv2.dll

Filesize
7.1MB

MD5
eb2b911d33f5ba82109a0d5608c28334

SHA1
fbc578fbcfc88a132438b38e97bb87c16a9f698f

SHA256
2404be88c798b43499ab7466e2b04bd58510f0d3fa59049aba6ffb932b65c977

SHA512
19becd2003702813898893f7b1fcd1db179a76fbd201fe34471254b75ba5e98af262922adafe5ef0672302cdf4c0b1e2f8910fd2e51ded0f3c4d6c5a43de489e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\af.pak

Filesize
321KB

MD5
3ab2fcf223a5fefe8a186741b3507e14

SHA1
9e851c09c08415a228fad02ba87a9caeb29e3b9b

SHA256
e6db19247e92d007323f9e0ee776c423a6a8a64ab321c9d5c964cf137e390a4d

SHA512
c1259f7953191b7c89694d826f4e45564d4c7b6be2aa7e85b73c5a6f723894b139ba62d215def008f45a95215fb3da7463e229c8ed014a6db4b03e64133891e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\am.pak

Filesize
519KB

MD5
1ef5cb04c40f553fad6dd74295ff4588

SHA1
9065653dc4ec508b657fb86f45a69114d1ab4be1

SHA256
9aa0bee97cd6957d3fa1dc43e3bc45b7fc4f55df6df9a33faa7aeaf6e2c46a71

SHA512
fe766d0841a1a247442e85b5e4890fd3f83c76686e61c2243ed93a373d7c4b9a79558200583e58fb17cfa64efe053d61c582d83beb078a62ef232376e4741ead

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\ar.pak

Filesize
561KB

MD5
f27d0b588bfb76f541e9a8d83c74fc58

SHA1
23d01bdf7e1a7d9cc34a53b5d0e9a221395d0f67

SHA256
88645be62d0421ace7b2c44df7de67a4a83b04977049bef82b465f60f06d5560

SHA512
9406a3150e40a5c93c9a2ba82030b334161273ec3d66c8812cb7328340cafd0ce549f178cddcd00bfc227a258e8aba64305be203fb6502fd87f76f224d0a7126

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\bg.pak

Filesize
596KB

MD5
d9291d2f1e816471f691f37c5a4635a0

SHA1
201f26fff690b95f559d57866d7db519364ac27e

SHA256
4a7d229dbd7ca53bac0438d5705a8ecad9e33213f6752e58624da1b9e9cd571b

SHA512
074b46011bed5750dd49ec5e021b02850d11b235730c27bc2d0910a69f2f1d03c79dbe692b5dc34b7be28ab071b8af6c639151ebb10364f04b8acf4615c54270

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\bn.pak

Filesize
765KB

MD5
bc688ba7dd2b0f9946ac98a1df15131f

SHA1
b453ec6785191b3dbd5d78e7b25b9481b6522b32

SHA256
6ad844d2b22c8fbf3587ea603140deb1475dab934ac62e402dbf1c6946dc882e

SHA512
3d60102975a6acb39ad5f750128ab4967bdb5a64eeb398c5fc71e5fcca860eb97487df4e85269a5ffdc1f030bae2ff1c03d61b08565792f84696693aef8119ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\ca.pak

Filesize
363KB

MD5
711098caf9322fa49fbe4ee2ba794a7e

SHA1
d567f076ed6b8b1479c566efb155ba491401f140

SHA256
95758e3b0e83067a8eb8f135f1a9f6112db18ab6a21981c5ec32c899c729a159

SHA512
bcbff969d9e3ed54f6072b359f911c0c9ed875b12fc7a29002e9a251331b4d47b7c0d740ef1c596bbc8828d6e32f216f41bdadf0873a0a85ea5b65bc8770158f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\cs.pak

Filesize
370KB

MD5
11a76a16e2f94290a6671b2fa7c782bb

SHA1
ccaecdb49758bcff8fe31ec0907b3a4a0f1ee6d1

SHA256
dee2f88b85753600284bb4acc844be1f0edd5688f98340770bc042aecbd73fb9

SHA512
a19845703cd2af109c085383307eff88e8f2ea4f6446541ba1f0bba89522e714d43cfa355af149a9a12ead96ab389b27c273a53dd15a93b401f6f7eb4d43886c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\da.pak

Filesize
335KB

MD5
528f37f3f0f7b145a979d5c241b4fa0a

SHA1
553184bd357c6493e73c1a1dcc5d142e1a36f0ff

SHA256
19444d709ff0b9343aef93a640c505566572a0f3121012716d2af937c08d6dd1

SHA512
6a58016bd952dd93026e81bd240a5d02b0538c61b3f0422ce4439a719d4c0d76caada1f3177d4c4942c0b573844c7e42d202285758dce8bdd8c44115ea4b068d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\de.pak

Filesize
360KB

MD5
8ae896d9d42d65ae82093eefe5dba356

SHA1
57b6175fcd23ae0dafc7eebbdaf7cc26c1ead0bc

SHA256
6e8983727e035e77652fb453192871e435dbab03ffb3088a86ec918ef01b7f37

SHA512
6271a6e21fca7793964199489d21d1fb8d93eff2cf1979b3da7ca6eb22d4786a28a6e62b6ba0b8907a6be7487d5c9c45d8d372eb34ec16ddddbedfd49dfc475f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\el.pak

Filesize
650KB

MD5
79077480619d88f5d4d0c349e86de169

SHA1
3b05b9de0d79e6cf82ff5e482dd1626f58d1c858

SHA256
b4bdd19191dc4bc22f8a3ecab032f034b0c0c0669e9a5ba1b42717ec0b5b418b

SHA512
1fc5697c798c83f70345700037af7aa22acfac5a3c7e319dd57d587a35b7e907ecfdf175e283df365e31c0f824713743a96cc56b60e9c1f335bda80fcfec38ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\en-GB.pak

Filesize
293KB

MD5
0444defa8f211ac4eabcc760b14a5b8a

SHA1
f143e080ba73f83c77d6c095ab8be1f71f763532

SHA256
e252661d412a068610ac2e2a64609f21f71c64602c579a14d7e6ee59d08fdfc1

SHA512
ef4977e477c3c39c2915e82162bf44370a3e2242a2fe57b43a0c2342171d02278adcec9d602ad4d4021a6554ad85a55d4635ccf3cf97405bda30626379d875b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\en-US.pak

Filesize
296KB

MD5
1e9b12891461eefd9db12e537965329c

SHA1
bf2346e045f79a70218890764b9318fa86886b36

SHA256
bd67fc968d75e77f2bae7ad552c398ccc4dad8635d74814c2046f813010c45e7

SHA512
3f01b9fc7e07bf6f3f8cda357debb83f73bb24179f6926d0b24114ac0078f42941a68842453bd7ee86cb759ef76e240b84278ebe1541cb659fb7caf3cf5b6820

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\es.pak

Filesize
359KB

MD5
85e0afd9c09f97cecc025f31fdb6269c

SHA1
13b9ec632e465c31fe6e88b1e3c186a2eacf5de6

SHA256
e1a9180677d2989137e8dd381e6c847c47b385a6d3e965a047829479317736ae

SHA512
0371b816522bc43b124ab8dfba3ac55e63c435276031f7035075a0767a11f3d73b5991156ee6ea1770d0115c09cb653c9d3fbda4b2d9f1e00b068c9d7a2f8db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\et.pak

Filesize
323KB

MD5
f6b7f59ef4eadb505faf6f939adafecd

SHA1
738f208a717786f23d124201aa16b377b686cf50

SHA256
8e75989893f0d59f6ccae2042231ec8e7dea6fbc78210700d0d1d3a67f6b1d59

SHA512
195bec3a111c498cb4b791bc7d15b459014717fe4270cd82d01e6e4d1b12bac03e267b7699b12e43db5c6cfd8625b6358bcee039aa18edf593f824fb27bcb38e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\fa.pak

Filesize
524KB

MD5
d7051343f1cd16379689a2a28a614bae

SHA1
7dfb720048bcde2282c682d5653fdaf3b55d89cf

SHA256
4c00aed6cd9f9f6d2a98c157cc10a07f4f09fcc18b72c048eb6777a2600181ce

SHA512
3d4284a0c4c528be1b9466582bfaf2cc1acf9a03ce9cdcb27ba2481c31cd841b0a70912ca388dfe1d3cdbc58c82e095baa961707a344d03cb0db777a61b5cdd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\fi.pak

Filesize
332KB

MD5
71f7182ad054b5294d1a3c8fb91d1612

SHA1
13a210397d6352912c35ffcfceb0e2ba3910f7b4

SHA256
0b41ce33c0036aee83989ce4ffc2d096b2f6fab77634e4bb500ec70a51b4e0bd

SHA512
157f11807cdf4667efbc93cf2f3134d9d48b6eb08b941eefb7b085dd3e110efc42c78ef554c0faa2b46e0155903342c6b5b6b20f796907138619b880bcb2d2f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\fil.pak

Filesize
372KB

MD5
850333b9705ef8ea07a6a9ded5904040

SHA1
12950aeb4d7f13ff335c5012e1d0af0da50ba541

SHA256
742705b1c87900f6e8f02fa112d2cf13ffaa6c09c62a7dc34a2cd6a29608dd10

SHA512
c464725f7f9702c9e94a7491e963664fbfb2b07507ade4f32fe2372eb9d0313bb229fa8eada511b338d094780341c24cfb59f745471b0b82fbae94ebdc8ef4e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\fr.pak

Filesize
387KB

MD5
0b0722d0c9187ed3bb445e66b9f73668

SHA1
426b41bc9677861b61daf77e235c20ca70b5deb8

SHA256
b7b3e4f04dadde5c228408c32c55f088372181cad5b71df515cdad8dd1ef9e6d

SHA512
4d5e3d6054cef9f903844a0822906c612def3d4c3319a7114a54421ff1a4d3c523d02d457d5a2ef8636d6f4183392f64d821c6ab2e8b79c9930e95f7a36a891b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\gu.pak

Filesize
740KB

MD5
9ad27f9e3aa9356d8398a823a5a90762

SHA1
65a3b8b786a245e307bad3966d9ec02094c06cde

SHA256
984aed687408ebdeb291a57893034490d6acfe9d34546dcc3715f33c8907ca61

SHA512
46fa7165714cd1b7c1e2389c85e2ed73f40125491959cc458ac621f5e156963f0fc141deb1c973996a15bb2b7b835ba36806db762ebe97b02159d64d002a93f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\he.pak

Filesize
458KB

MD5
f7f22a75ba2cc2a2d1094ecdc60a208b

SHA1
a631ebc0d180fa994b3856f706ea75714292a7f6

SHA256
4e972808f0a25619462a0390105e8a869037341a30b3481b3c80d918009efdb2

SHA512
fa7e27d931421fa504c6731e4aebfec0908c98f72c2ec7341195ca907420dfedf30f68e0949e3824b6368d64244de3bba6a7183d3fae424a0e1de69bbfa9d71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\hi.pak

Filesize
771KB

MD5
d0b36880a50bd87dfab2ebaff24c0ea9

SHA1
eb1f30d0092b4900f332cc2162f9f1c52ccf4da8

SHA256
b23dd1037a3d133ef29b73f5fd90765a7af9f0f69b24858343acb084a59b01c8

SHA512
bb80d1ca39707b96601433f9b10d7857950aae2075d173d5650af2e3a6e6fc795ba4a6ab55888933b9f0e62bd03d362af42357ba22c75a1ad599d153582f6bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\hr.pak

Filesize
358KB

MD5
5858fdf0f665ef6dba8a4e68ae175974

SHA1
fc8085083e4b38462c42e6ca5ae67fea408f18a8

SHA256
66e85a46152b7baa26b2fd8d6af3df0ca67f54b75281aa08cf6a0f7e769aee8c

SHA512
6b32b62749b2e1a8921faa425ffe69f1d3bb3d8ebceb74f5215c355a35aac8220ae8a0624c68ec45123430cc731812504fc22bfac1d50e810168f3b3509176cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\hu.pak

Filesize
387KB

MD5
e74277eadf72ef7164e03a0a38d8f6f3

SHA1
0085e77f0a9bf30d290f1eaf24466a12789a1c6f

SHA256
df6c21a38bedd4c6d02ab60650f4c34537e238d4c72b96b2857973027542c3d8

SHA512
27ef60832a863c4ad3ff0816ee03b8bdeb584fc83654f4b1061786014aea92334ed44482321a370836aba7e08cc4b0992a8ece81cf8b98e42cdc76813470ecb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\id.pak

Filesize
318KB

MD5
437540fba9de2809d42dfc66ad78d664

SHA1
0ef84382147c9ec2c1f8f248f7234506d0f3785c

SHA256
788a4e41a8e6b70e714913b4894a48fdf24799f7a20320565c523b233a41a8be

SHA512
e893b418457b2aaef7605e36a61351b43b18b38ba675b2377bbf7744c7ba83fb66db151faf28f9bf0361f874cb4dc93e4bb1066cb7a5fb6a41b1b97f907c1dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\it.pak

Filesize
353KB

MD5
f21eee789d7b89f4c1ac03bcc95b6391

SHA1
754ddc787e22378c3034c78dc126e49d952c1ffb

SHA256
94652279dd554461d91613fd2cf295e0c68a7fa46855c53172781b15a5b2bcb7

SHA512
588640b61bc8ec60d9d6a6110544b0d191cf0d084e17bc79ab19177eaf74899c1eccd7b0f0f6852182b48b19596446e819ef0c1d64fbffbc87552a8d0eddf49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\ja.pak

Filesize
430KB

MD5
d453d6bf0d493cf8a28dcc7e32149cde

SHA1
fe164f188b61c6b0c243262df7fda8fc612d9e82

SHA256
1b3bcb7b6482cd9b005aaf30ccde3b4f3603f0a9e1d0f2209d70ecc74f7353de

SHA512
1588071999065dc93959ac36557e321881e7f244b2166c0af76deb4083d3e9580e6d0dac1fe474a49cb43cebc76a3f0ed400e750c090886c77e85ad0dea86c2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\kn.pak

Filesize
854KB

MD5
be3dcd0f8dd4275662a01a381bf294fc

SHA1
b97dc0e112e1b66ab3b9b7679cd9b2e8d9e40cba

SHA256
c06445ffccb52fca884686db4eda33d315d8340fd653c199c0fd8a07d1872720

SHA512
a9b00474ab5d1ab88bc005ff53c8d7e33a103d87c2794e38bd6819de629969d9dff06bd4bc7c2318ada4de5a61d68462bf5e0464c7f53a4250b4f617f99ad32b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\ko.pak

Filesize
361KB

MD5
2f216c3e58b73f7981d61034d707b53e

SHA1
fd47331e07c8575057aaa58b1068e82721073300

SHA256
7b87b2795f4bee5d4ea37b959ef9d7815b4cc39ba3470d97006370337c3e5997

SHA512
eb07bfc41b76e4ccac9346f9540208d184291cc443028ce74cefdead0b2c63cef6c92862eb5c5479810cbfc98ad2a60d9281a6286d25a78ee12e8dfcb2522288

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\lt.pak

Filesize
387KB

MD5
2a21c3d432c272f81edf923308858802

SHA1
7dad07b28eaa2db09c341a4670a17016702ea1d4

SHA256
da21c47633640002d0eb397d9f2685df542b6f5e53ee3ca655340750de2f3217

SHA512
8f646dbceb6a13568364f194f1ab95055378404e0ac21a3b4e609bfc1ab3b41869fb3ef4700aa0161ef43e4a394666437c17cf49f7bb0bb1d27fcdfb252ac782

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\lv.pak

Filesize
386KB

MD5
f0645d37826c1e2923240b745506b7f6

SHA1
d41a06f30cb4aa187b6f02320db9c743058551da

SHA256
1af1ac2692035d502e772f976c977936d0feb42f65a9096e0af2fcf8b7df03bf

SHA512
29ccd6915aced1680eb0ab6ce4554ccbcfcc196a7e1398ae5da1433205c7b2e77ed2bc7349704d1dffafd108403bffe53c36bd018bacf6faf7363f8e35c32a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\ml.pak

Filesize
897KB

MD5
68ba8ab8cdb6bcab0650324a9b2736c4

SHA1
5cb7dcae00cfaba7e621373273dc80144319f031

SHA256
c990dd02ea8ccad94f5002b2b05e74ad258a9b13ec1168732cde06d0723e2a91

SHA512
7b4b75d2a67b32c0232b05de4085196484bf52cfeb109f2543c4cb184456601afafe3e05ae7ec9c37666499bcb424346114fc9fd08af65a7af853e42cb16f5cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\mr.pak

Filesize
728KB

MD5
a72af6ed3bc9c364cdd096d65e3b5349

SHA1
f652a7d21e8cafebcd72cc38891d4b7b908444c8

SHA256
c20543bde56b4ba78b7efd8a1fd4d6990e751ea7e243c91a2e83ca78dc0d9289

SHA512
3d0523ac8ac9e1d9f2e3e802053a14c8c3ea0b45cac0865b10efb23e869236b8103824777b5efd45eda7d6da128e9ec15bc68963bb60cc46a034ef357fd66b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\ms.pak

Filesize
332KB

MD5
aa1d4538fd06a6663ca213e059592f90

SHA1
4197b4bdd58b09ca8caf76d0c22e3eda358dbeca

SHA256
d51d9f4fd2be492a751db6898b4c2843b2b6cbfe893bb66ffa4eb8e1a66e7e5f

SHA512
718d3ed30f8f8052b2c52e8458188880a050ccf14f2929e953e18a551f6abd4fbc87af525ccd2efa353bbee00529cdeb7146373023d598cb6430e16465bf1cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\nb.pak

Filesize
325KB

MD5
9cd8697bbc2b78dc3fe4c022d1fd5ee2

SHA1
9b0cc62586e391af46899464dc22df60746b53df

SHA256
fee60b6eff88716fd8ad4a9b2da8b16827753c819671831e2d7dc2723aee3bf8

SHA512
30db548a2bc7af38ffe0a1970a52afce2fee04c02b4b61b277d875f068c86fe46fe537303cbbbbb66f3f715268b43cf3b2cdfcd90c2a4157393d6242eca79c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\nl.pak

Filesize
336KB

MD5
abab4a5f1afd809d2e7d5cad3ea17e70

SHA1
d57dd02b63849f7798b1ba11efb889075fed10f3

SHA256
361d54411d890d26fbe6d1f8e8f8258e72afca143783f9f16145b9f4f5f9333d

SHA512
076a061a9278d83c76048696d14120310b64fe41a0300a0e0588e1c7ae933026d8994f9672d85c5c76046a3d7eba5fea6ce70fa7fb4cde0990777e3965fb1d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\pl.pak

Filesize
373KB

MD5
b5fa6aa430ac5ffbaf172627733d0a28

SHA1
22179851889ee0f30097b0ca7417575f91c9b7bf

SHA256
fb1dc5b556f59b6ad642167f1df9e654517ad494559eb3f441ca8f79d56a86e0

SHA512
80dda2de947cf5e2084bcda6623b83ab7cabfbcf5e6fe4d36d3290ee10f18f7be897b29bd3ac9f5be72572e04a7791e008532dee68bdb9647b20532fa38cb386

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\pt-BR.pak

Filesize
353KB

MD5
8bef64a4500a00f0e72944a4a4b6556e

SHA1
13724500fabaa1c452a253bd43572d40d74f8e43

SHA256
1054376071aba92b165cf561b7931a18ae0b29c9ca22eda85c5c9c7e6721e49b

SHA512
8590fbb13913342c988a7bfbe7abe1483cefca90b801152ba483752804879a30b5f8aa4f7cd55165978984da68937006b675a65d7c6ca93e770ea2586a35ab02

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\pt-PT.pak

Filesize
356KB

MD5
a0e1ae3d3ee87f7031fffd278cce007b

SHA1
c36d4e8db6913f021a0be1d9b8a3e8a13943359b

SHA256
e5c382258030217591f439a4020069378c3362677258d5129c69ef8e25abd6c2

SHA512
bad63254f3a4fb65a9e7cf00587985cbbc93fb3fc2b48735b59fed3c98ebc1c51fd5e8394209f86c6040d05663b677b6d468cd98920f9b088c6fe1cdfea7b47d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\ro.pak

Filesize
365KB

MD5
3e9f9e59dd4a782ff7b1f1106df6c88c

SHA1
a0694aa9cc39e1aa5ee6b0cccc0de76b14a8f808

SHA256
d56825b2ad81fa419b428855d8b3cff01015a446b7cc989d7b17fe1b3b5f45cd

SHA512
7e03875cc9b5c01838af6b470c541cf7f2402fbbd1b50bf0634a4c26fe417c85d59f53112e1013425d26dd2664c83181591baca502c259e513445a6ea2fdd18c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\ru.pak

Filesize
593KB

MD5
9cbc09a3aad1ed164062db66c31b5031

SHA1
ea8fef1cdaccec36262c65f09b4448128a5ad2bf

SHA256
f6b76bf79ea9f03d6bf8a399778a387029baf9a94ad274788514b2086b612bd8

SHA512
02b7510ae112a28aeabff0833ef997b1fe0d7ea23818221da8df16db392d4b85792fb60bbb3f3157c912269f5abf0db0aa82364e2cdeaedaf8b2d8fdce2537f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\sk.pak

Filesize
376KB

MD5
ff48eea350d1fe820a47c2cd0f9a93ac

SHA1
1a069d1f9b278be78cefd290670dcecc463aa7a3

SHA256
fe43904bfb0072add943ee8d44e9f92a80eb2aa55ce7157de52ea625c277db53

SHA512
507ab138d8b6dbabdeacf3031fe4c63687fd91d04d0eb5e27b12ffe1d84c93ee40f69e48853d6bebe177d614e4a14f034024f93397a0e9fe5779ccd01760caa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\sl.pak

Filesize
362KB

MD5
1dbb16fa2da8c13145420e85cda509c4

SHA1
6bee3ddc96a98c1e658299dabf6457fcf90c67cf

SHA256
5015c0685b66ef38c92ffc4963e144e913b646d8e855f3976e50c8039879cccf

SHA512
a98b086bf9175b7c2b5c25e1208c8f7248c6eed2bc9acc095a52479550b58bd22dfd9a09dd3674f59ce9ef537f27b0dafcdab194158438d0e68d3c120fb97e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\sr.pak

Filesize
560KB

MD5
7b929206486e740b4c9299112186a94a

SHA1
b52a4c8eafa2d9439d525a167cb3482f31d7a6e1

SHA256
a0ef17a572ce510796886b844226b65991bbddcc71b763b91569a07ef23d2070

SHA512
91f4676cc8eeee6f3d643f13c27602ce05639b3707bbd950fb0f745242e92d053b74f575d87522a43f2135662870ca3e3eb6ca894737a5d14900b9e48c837673

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\sv.pak

Filesize
328KB

MD5
c5bd14d64a64ac7f361e49035405852f

SHA1
e2484e58f524464fadf898ee0a3c972db19fa9d0

SHA256
21c7d459c55f255c6da5a6454eafc836a3bcdba9c99c76bad0f0d6fbbe7a33ef

SHA512
74443233e16ec24814ebc4e16aa5108ab447c4b1d095c2e18ae4cd2d25fccb13a182fda1dbcc286b9f8b07e80e19ab19544fe758efd90910a4eb1d05c3ce3393

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\sw.pak

Filesize
344KB

MD5
8e490ee67f6c53f9916715b0d32257d2

SHA1
dbf51ece8c770f38019f497bb10966feffde0ea9

SHA256
a8d904e4871efa01c72ef64bab601e6cb1de216db4a696966e90fe1b733bef17

SHA512
a5774b930e4d5f6d91049fafdb6a743fda32f670e9aad9000740010d1b271a4c3c881d138e40abfcdbc6bf98f37fb3791007a74d38ac507b8bf86ebe0ee00c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\ta.pak

Filesize
880KB

MD5
2204d0005209a5a2fe25bb44b8e5ace3

SHA1
161d7d4e286d7bff25e3f096923a5a7c7a3cd30c

SHA256
fafe173abc2ca773026b0caa24e693a0ac4c9d0ad7c40258bece10e4714dcb15

SHA512
8dc654487702636e28a1fcde05b8b9d2ec71a640c48233dbd5ed0aa174a875e275e310973f7e993908919affb7671282d40a8dd280b24a1c5cd29dc66e4f9abe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\te.pak

Filesize
819KB

MD5
d7f858c12123e975b4a862c3df05c0f4

SHA1
f8d2ffbf76883f5f095e10f3de5694c209c47b12

SHA256
29e4d010c6b951c129633aac0f55b70107fd24dcf1062c20e263611e30ab4b93

SHA512
1d44549e83b0af8d9c1b5826c970eb8dba5e8159c0ccc3586022d65d1e5234b06cc97ee4a9d45d7d944e882f4c5a12947bf810f73c8c064255ac0f46e35799a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\th.pak

Filesize
690KB

MD5
73bc88a210dcdfb14b6f29d8f86f4f4d

SHA1
fb3392a03cc355aae318902122b7245f2fc13d01

SHA256
bb8b656b1d2c4cf5f361f59b44abd4809cd774e664dbd0f90b62b97ea125e3c6

SHA512
671b90bff006b22ce714971bb8ba87acc4d887f9893709a090a85a8dcabb1ecd72edf54775c77378ae22dfd5ad2880df10efb201b1d4c11a1d304086b8ed3c8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\tr.pak

Filesize
350KB

MD5
8faad383bb39fa15ccc8d07beffa5a34

SHA1
5bcd907923c04b310dda718b5eff4115cf42c6fe

SHA256
e31a9cefcbef64d082b77a16a2d5dff11673f74363cf9fc34e36004a62e308d6

SHA512
9a604a1e4cbb23d48203d02950465020c6dd5a3556ac6e5ef7dceb0491b8d5c5722b6b73226642f2234885a36dbdcb1f628503b6cf63c84b4a28408d74e82764

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\uk.pak

Filesize
592KB

MD5
987144e7837f63de1889492166f4330a

SHA1
f9b5055572eb238b357a7c977c4ceb6f7a768232

SHA256
d10af321c33d48f5e97abb1c74b76e43e63390b9022bed58437fa4d271283900

SHA512
32ae4c6d7e90cc0723ca385fddf36ae88fc803bec790d844eac4c7a67493352c3aa85a49b095178fcbfa4485b9167b6f4dbf0034e7784148383d0084d63fb9e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\ur.pak

Filesize
522KB

MD5
77ce70fb50d1de7cfdd6b13161a09809

SHA1
09d08cfaffbf255a013a8b9727d40c776be51d37

SHA256
ae2457b6f347d34fa8ecf524d91154ba9b80ee160196d774546c1b8924049495

SHA512
7fae3a792a2d64ecbf60ba2b694ddf2b40df0e1fb81b602b878ede856912579b7ea78488bbe998151350df814a8d8b0f3f1299882c9b330d214f9db05de86b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\vi.pak

Filesize
415KB

MD5
34f3d7788e213b731c0495b2fe45c78b

SHA1
e7a2ed024e61375077973031e2dc82d924ed75ca

SHA256
2ca9eb9d04ab45f479b392ca9067d353e5472f863d3b784acfcb1361c6da30d7

SHA512
48400842614a31f65278e667b43d188dd44e4e9101c7d3d01ad75569d1182cb603ad07168195364ae53dc598f544f438f846ccfc604db208fb29998b292febdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\zh-CN.pak

Filesize
301KB

MD5
d9be21bde24de1026279aeb67999b1bd

SHA1
0a0e090bebc5e4e7550152bee739f220f8ad9e9f

SHA256
6c364baa231f41c668fb15da586568a985fee2b4bb3e611c07ba97675336c013

SHA512
d376aaa1d38f20e0cf89131452df6d67489711950a3c89aa515570588797c4d83c5dc467773d3af525a551e0f6087fdabbd2ec3d2b48db4b961f2c1e9932f0db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\locales\zh-TW.pak

Filesize
298KB

MD5
31b1d4dc9c0fbabb29c2e32c759e7238

SHA1
45810ead9541adbd12f15eb63bf33f932f7e48d1

SHA256
54469b7be7f1c7cd972e77d9853813d41b515b2ef8a3824e7fad2646b3ebb3a4

SHA512
10e76d0226cda5541a3352c8111b16d59d563e91512be4e0ddcac9b71e0c2f5953ac170d8a23fa1c6d523d3214057950ccb7a67f922921d6c34d475590055856

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\resources.pak

Filesize
5.1MB

MD5
2cccd68519bff7f6a45380607940ca9a

SHA1
107ed8e7aaf2ea4d8b290afc023fdede16e47254

SHA256
44387afe96c6d1cc6b24e6e05e42e92eb51d6c520743fc8e2eab06c683ba27e3

SHA512
da3c67f10ff1d741f6c4d5313f8f1887ad3232b33935d5576d321e2d0622f601fde3f3cae24b23f00e8e7f7f48aea49fcf4fde12aef2b396ea5697566f8b7128

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\resources\app-update.yml

Filesize
144B

MD5
9300d1436965c7c0933f53bd16bd332b

SHA1
96246ceebfd51faa9470f9152d0925f6cc1983cf

SHA256
53c824fd08de03ee221296cb75ad6e8c3cff5b8254a467180197cb308666377b

SHA512
9683ac45be9771e053fa11a0b13b7fe6866c44385046c3f7b67e77e1fd068f5903bdb1987209cf68432ffc021f8366f6fb002c360e3ed6ae030a8fe3996415f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\resources\app.asar

Filesize
47.7MB

MD5
8369d9fbfedb113095eb402c4e3a82fb

SHA1
789bdf48d048391ae8d49c903d0f8fa5f5bc78d2

SHA256
e878d22ac49f49c53b939c5a7065f057c73c39674422cb74deaaa039ac31c5aa

SHA512
97828d662a348a10344cfbd83de5260c2e6c6aedb5b99dfc64050611267494d0e1e8e6ed42d3ed3a927cb03122925ca84fa53b4e7f3c3d3d1123163e8f0e555a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\resources\app.asar.unpacked\native\cleanup.feather

Filesize
978KB

MD5
e249fba7f4de1b7113e1d04d9101ff99

SHA1
953165b75b9f6d26a9a309fe68c7415f004a35da

SHA256
82319ef7ae02d653342df75c099b00d96c83db831fd0b22a462f5f1c52ccf2e5

SHA512
ea53592726bcf437692abe1490509acc9560c49e9352f3ca9e6d3c60a79ab0361e53fce47f0d758d8d872866499df3a8f5417bc4ccf0b6856e775566b56c2904

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\resources\elevate.exe

Filesize
127KB

MD5
24961e3eacf61323cf8717924f4c2314

SHA1
74196223e4dd6f0a08eafeb6af1781a11fe49697

SHA256
7817a3f2c665eea26f1f16715a00dbe7810d9955ac041a05921b285c507df54a

SHA512
8b3303f22c1183541a4dd7a4d23e62ca05021a07f4a674e4aebd1123b564b452294237f383b4678f141bd8e1534e490a13283e3bb0f1d9537144b4e3d462caef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\snapshot_blob.bin

Filesize
401KB

MD5
17b5a28e6aa7ef49bea7555843937313

SHA1
8c740e68f009c3d03db74edc347cc5d1fac7b1b8

SHA256
2590aa136bc101f1075e42cd8939c7679ceb35b773c989be2ada49acaffd01a5

SHA512
af7efffed22246389d6a834cc8d8467e965849ffb8fbecd4d192c0596d1a026c6ddbe49cd2029163fd77bad22906e80446512bdb918875a7fa96c6ffef65cfc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\v8_context_snapshot.bin

Filesize
716KB

MD5
b978b7e83b574a43fe766af2b670c1c4

SHA1
ab0d1211740fefe3b8ddc8bcb2400e68cc88ba4d

SHA256
f59fa568139442c7f547fc8a5a0fd090ddc8427cc409e2fcef0518a9dcb47a96

SHA512
ac0f297b128e83d55788aadf5870849781d81cc61461117c5cf22f757e20089acb640b3ebc2f3bb2fbe1659e75da73a63cb884be4a791a90702758e6c52dc706

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\vk_swiftshader.dll

Filesize
4.6MB

MD5
17bb7a2a7cd8ccd96ed19753cfc75bec

SHA1
7c996eaa179fd472a572a0efb3e243a81b283977

SHA256
070c9bb970f13a47e3246fbeadd4d2d3916273e1ae3db2059d806691bfeaf6d8

SHA512
80ff7ba1b32e3de374e8637852b96c12882a5f7d32651ff0e1c2cb97898a44aee46a569a42b073a4e368f364f0daae2e86eca36068fe6794eb5ba55cd3ca5ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\7z-out\vulkan-1.dll

Filesize
849KB

MD5
58871cf606db440509b56a3f764e72e3

SHA1
312e810cfcfb663b0da00eac3b87294c0b035cfa

SHA256
ea1f3a66f9322d20da4542c42595eb789e532a224a0338dc488e998ae00e59ea

SHA512
07279c40721414f6ab345f83d9189c3c7012a54fc839359cb33cf4793ea771507535518554be99bac339463b7bee89e263e7a5cdd3f443a550ca6476c350a2a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\VC_redist.x64.exe

Filesize
24.1MB

MD5
0c86174ca06d892881301203cdf2c32d

SHA1
2b7462bb7732725f011a085349d6d206eed40048

SHA256
5d3d8c6779750f92f3726c70e92f0f8bf92d3ae2abd43ba28c6306466de8a144

SHA512
16c1b043c81394bab65b40c5a9c5b742300cb605d9780226af725bf4d6e38c701f604549b2a3b2138ae951aadfc53faea66c97268c8c61c6c4f0771426ecca62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\VC_redist.x64.exe

Filesize
24.1MB

MD5
0c86174ca06d892881301203cdf2c32d

SHA1
2b7462bb7732725f011a085349d6d206eed40048

SHA256
5d3d8c6779750f92f3726c70e92f0f8bf92d3ae2abd43ba28c6306466de8a144

SHA512
16c1b043c81394bab65b40c5a9c5b742300cb605d9780226af725bf4d6e38c701f604549b2a3b2138ae951aadfc53faea66c97268c8c61c6c4f0771426ecca62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\vcredist_x64.exe

Filesize
6.9MB

MD5
b364dd867258dfc79342e00d57c81bb5

SHA1
c990b86c2f8064c53f1de8c0bffe2d1c463aaa88

SHA256
8588eb697eb2049344e6206d2b66ff63104f1c55e553621ab8ecc504d6b9e9d4

SHA512
d5d5408d7a0bd7731761c601232df77a972592bf027f29771d17fa7b62103b43d98b55516bbf7d45611658a2e477a60ce4cf89a349a85c4abe33186278f4c44f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\vcredist_x64.exe

Filesize
6.9MB

MD5
b364dd867258dfc79342e00d57c81bb5

SHA1
c990b86c2f8064c53f1de8c0bffe2d1c463aaa88

SHA256
8588eb697eb2049344e6206d2b66ff63104f1c55e553621ab8ecc504d6b9e9d4

SHA512
d5d5408d7a0bd7731761c601232df77a972592bf027f29771d17fa7b62103b43d98b55516bbf7d45611658a2e477a60ce4cf89a349a85c4abe33186278f4c44f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1A9.tmp\vcredist_x64.exe

Filesize
6.9MB

MD5
b364dd867258dfc79342e00d57c81bb5

SHA1
c990b86c2f8064c53f1de8c0bffe2d1c463aaa88

SHA256
8588eb697eb2049344e6206d2b66ff63104f1c55e553621ab8ecc504d6b9e9d4

SHA512
d5d5408d7a0bd7731761c601232df77a972592bf027f29771d17fa7b62103b43d98b55516bbf7d45611658a2e477a60ce4cf89a349a85c4abe33186278f4c44f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.be\vcredist_x64.exe

Filesize
455KB

MD5
622a95e2fccc1657cb2a760688b40665

SHA1
3feda4e77dcd8faf189371c71a35066b01320873

SHA256
e52469f3bce3768b43615ba44bc891dd2cda1b8e05659debd0cdbdebaaf9b199

SHA512
cd7a4705a8b7543d85b9d45d2832641d9783232494c66570d0a1084dbeb67cbfb5f4143e0deda7840f8f53db890f1029f9faf2a8814c1e885aa618f028a0b6b1

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Dictionaries\es-ES-3-0.bdic

Filesize
766KB

MD5
471061756215fd1f387f076ac014303c

SHA1
d8397cb5900f52a5cad2416ed8ebf53caa1a3adc

SHA256
e6334dcf080aaeca679db70565762a2c296ff5780c1af263530ac7345736bfa9

SHA512
ba9d0f2deb2fcd77e75bfe8a9c6241da25c7eb9012d0374ccca8e9cd9cd1c9615efd5f3980166b0b3431c7e3e55ef013cbc37f0d53bd1e2411afb9363ceccb05

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\23189f03-737b-4b06-bc64-68ad6a065a4a.tmp

Filesize
370B

MD5
4bd4f8c933c3fbdba0089f8d362329fb

SHA1
45d701651d2547cfe698eb4fba47edb48cb927b9

SHA256
c84c85bace002a5ed3e6faaed7dee068b0f115052c92311bf24c3cd11d14c7d2

SHA512
bcfc4fd1c00282aef6aef2819bb6e4fd689b90f0cfb560b252fea8a12cdc146488b03a845015e3fe209eeee8815873a2b41c0387fb335b84cf73c852a9da0867

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\89901f03-e607-4d73-9672-8fa2107ddb6b.tmp

Filesize
915B

MD5
77b96e78dea25093470dbb90e10d5a0d

SHA1
c2366911cfad19696a44ed65eed58b57e5b38e59

SHA256
81c55d8a3ec08d18d6677e606e4655e124fddb6b1db940154ab2a9fb5adb11ff

SHA512
9b2db7b3e892254eb877592cf01ae5c9a5abe136c40249167d9fe16ecf367bbfc2a54726c07bb2c4a5e6455bb3082602af2b8c397ec030bdacfa8d4c63fdd301

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\Network Persistent State

Filesize
1KB

MD5
0027970d7a104e576c220849cb643412

SHA1
dd301665abe9361d53be2ae0cb58e85e853fa5e6

SHA256
e114f880b747dab5e4394d98fd3bbf05941affff74d0044edd06432bedfe1426

SHA512
50620c091b182ed9f15c86a0564b47fd3286623f5b5a7662c84e658d436f531e8bf6d874b66efb65d7367b695ab1d143128a3dc1ba01c658cd966761bca3aef3

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\Network Persistent State

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\TransportSecurity

Filesize
370B

MD5
9b5adae89b7393bf22a910875130e869

SHA1
d6cde86730c88352294e1480d6a3136fae64f55a

SHA256
45d5b7e8730f1f66a5e4f610319d8f45373ac7974ed8429e420fb114a4934520

SHA512
ed61e2e9bf32d77f2b19182410dcf897bd4c1e0eefdf301c7bfa79ad522cdf2b0c82504f7220c72ebf994e12027642ca5438b3040699fd55630346acc47c879a

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\TransportSecurity

Filesize
537B

MD5
5ca5e02f748978aafa3313f0da89d1df

SHA1
97533dd0de0475fefbb7038627895939aa16cccb

SHA256
86776749a9c3472b86e52f746e82d6bcfd57292f03732ccadbefe0f73cc21b6b

SHA512
b137ad58d55cfd216b0adc01e1764e666a1345fcd5a36096716ebf4125025734f9381655dd05a6d5936e0bf1cfcdfeeffba3a92d60724f4b6d0a8ccde6b93178

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\dad0d6f2-0292-4ae7-831b-f25254d002cf.tmp

Filesize
370B

MD5
816de8d40fb77f73ff9593ef978fce6f

SHA1
57a7f41111f0340271f5ed8c329a484d73bfd3a4

SHA256
9e4da910f34f2ed90b0a9c6981fe9e72f4fa7984040537724053a5370fc92288

SHA512
09ca70dfb0d9d2fe95637d277354bbc5f47923f51b3beef4fec3dc7ffa38c3f1b39b325e96fb2c8710bd5fe9c48f4841a8a5245cc9ee65bf65be6fc0aa20fba4

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\f04b62f6-a18f-41e8-ab4c-2922ff9d2591.tmp

Filesize
370B

MD5
951fe5425b14ab6fb31eb98b25c1368e

SHA1
5e85427276ea3ece47f86913e25773b49ec2b9bc

SHA256
9a416236d2c4e0054357a40e412c119614f607a65b6076a3abb7c72c431dd8b8

SHA512
6f9ed39d169615a104fe4dc2d9a019f391a4ee50cca720dde4eee0d7cfbe2146f412dee631a7628db9390c433eb79d5773ff315f8062b4b2a54217053f0f9804

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Preferences

Filesize
86B

MD5
8a9bbc2f833ed90104d3e81732369d1c

SHA1
488256a8361ef1496ad01a67dbf5eb4149aef667

SHA256
eccd0ffbf81c7646a3a23e4727206b08596cbc0c36597ddb13a8c6906ed89115

SHA512
ee423d4ceb3bfbd8a6d61cc48077e92c2f764d0135d58d07f2c742de9e936a86059d60c08998918fadb0e3e66eb25b3bdd49e4bb95e7a67dada71fc487a345ef

Download Submit
C:\Users\Admin\Downloads\Feather Launcher Setup 1.5.5.exe

Filesize
106.8MB

MD5
a8130d85ef43e42a33fe1064a4f135ed

SHA1
1ba835089ac121f3141663ca4a253f86adc64b3a

SHA256
327c129fa0d9b80666eaef565d13709a82d8558f9e9d525e4eb2b6b1ded512be

SHA512
73afb6ae38f6087dbbb3014c3d4e3f759643dfbbb5d8960ce1521925ec172504af78ce3c7afcc51478c258ef792e4755c094c0845e20a221596863706a2afb0a

Download Submit
C:\Users\Admin\Downloads\Feather Launcher Setup 1.5.5.exe

Filesize
106.8MB

MD5
a8130d85ef43e42a33fe1064a4f135ed

SHA1
1ba835089ac121f3141663ca4a253f86adc64b3a

SHA256
327c129fa0d9b80666eaef565d13709a82d8558f9e9d525e4eb2b6b1ded512be

SHA512
73afb6ae38f6087dbbb3014c3d4e3f759643dfbbb5d8960ce1521925ec172504af78ce3c7afcc51478c258ef792e4755c094c0845e20a221596863706a2afb0a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 44360.crdownload

Filesize
106.8MB

MD5
a8130d85ef43e42a33fe1064a4f135ed

SHA1
1ba835089ac121f3141663ca4a253f86adc64b3a

SHA256
327c129fa0d9b80666eaef565d13709a82d8558f9e9d525e4eb2b6b1ded512be

SHA512
73afb6ae38f6087dbbb3014c3d4e3f759643dfbbb5d8960ce1521925ec172504af78ce3c7afcc51478c258ef792e4755c094c0845e20a221596863706a2afb0a

Download Submit
C:\Windows\Installer\e5dd382.msi

Filesize
180KB

MD5
a074f9ba7166e1f8ad9db84ce76d843a

SHA1
2a36a3d8707f8b4fec94e26ec6e2a5df721591eb

SHA256
a3ba9b962f0e5ecdcfa3f9ff7b25bf7b61d78abe5f393ee45f71ef7ce0d9d497

SHA512
8ef81f2680f2b2de0453f2f2e8f209257c38f0e243a55d478a0085415af1483771741b09009eee3b1b78530016ca53c38b00918c5a6a91d947576d3b061bd31f

Download Submit
C:\Windows\Temp\{2EE7DB02-C1D8-4687-A5F6-404A00C2AB80}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{2EE7DB02-C1D8-4687-A5F6-404A00C2AB80}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{55031A20-D5F4-43E5-88B5-C22FF9514F83}\.cr\VC_redist.x64.exe

Filesize
634KB

MD5
464799b58f1090430afa4aa6183bedb6

SHA1
f2b3d878516031e4d968fa8d7b160a14e51688e8

SHA256
42305b0bdfc29a9b03bbbf17b0adc12146cdb37031ae51029b440d537f714571

SHA512
7ab70eb7fdcc107bc41c345b8ca7414ea40f7c3b566614d7767d5d9d93b84cb73d14e447b8a885ce71fb1c46a2469b825a56946a1ef7ac0f8ffdd3110f08d97b

Download Submit
C:\Windows\Temp\{55031A20-D5F4-43E5-88B5-C22FF9514F83}\.cr\VC_redist.x64.exe

Filesize
634KB

MD5
464799b58f1090430afa4aa6183bedb6

SHA1
f2b3d878516031e4d968fa8d7b160a14e51688e8

SHA256
42305b0bdfc29a9b03bbbf17b0adc12146cdb37031ae51029b440d537f714571

SHA512
7ab70eb7fdcc107bc41c345b8ca7414ea40f7c3b566614d7767d5d9d93b84cb73d14e447b8a885ce71fb1c46a2469b825a56946a1ef7ac0f8ffdd3110f08d97b

Download Submit
C:\Windows\Temp\{693FA08F-7E17-4956-BBEC-33BAC1A937CB}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{693FA08F-7E17-4956-BBEC-33BAC1A937CB}\.be\VC_redist.x64.exe

Filesize
634KB

MD5
464799b58f1090430afa4aa6183bedb6

SHA1
f2b3d878516031e4d968fa8d7b160a14e51688e8

SHA256
42305b0bdfc29a9b03bbbf17b0adc12146cdb37031ae51029b440d537f714571

SHA512
7ab70eb7fdcc107bc41c345b8ca7414ea40f7c3b566614d7767d5d9d93b84cb73d14e447b8a885ce71fb1c46a2469b825a56946a1ef7ac0f8ffdd3110f08d97b

Download Submit
C:\Windows\Temp\{693FA08F-7E17-4956-BBEC-33BAC1A937CB}\.be\VC_redist.x64.exe

Filesize
634KB

MD5
464799b58f1090430afa4aa6183bedb6

SHA1
f2b3d878516031e4d968fa8d7b160a14e51688e8

SHA256
42305b0bdfc29a9b03bbbf17b0adc12146cdb37031ae51029b440d537f714571

SHA512
7ab70eb7fdcc107bc41c345b8ca7414ea40f7c3b566614d7767d5d9d93b84cb73d14e447b8a885ce71fb1c46a2469b825a56946a1ef7ac0f8ffdd3110f08d97b

Download Submit
C:\Windows\Temp\{693FA08F-7E17-4956-BBEC-33BAC1A937CB}\.be\VC_redist.x64.exe

Filesize
634KB

MD5
464799b58f1090430afa4aa6183bedb6

SHA1
f2b3d878516031e4d968fa8d7b160a14e51688e8

SHA256
42305b0bdfc29a9b03bbbf17b0adc12146cdb37031ae51029b440d537f714571

SHA512
7ab70eb7fdcc107bc41c345b8ca7414ea40f7c3b566614d7767d5d9d93b84cb73d14e447b8a885ce71fb1c46a2469b825a56946a1ef7ac0f8ffdd3110f08d97b

Download Submit
C:\Windows\Temp\{693FA08F-7E17-4956-BBEC-33BAC1A937CB}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
1a7fda01018e33117041e2b5725916ea

SHA1
513deae0ed56c851c3a877a03b49489b595c621c

SHA256
de8136207a6ad76ab507e7c35f44fbf6ab9692d119453ae5af7f025d24ac138f

SHA512
b672c1e1b5a90299f0b05de15b18f49aab5f8d2a3cec07d4e4290def476ea7e0b643105848d3e814cd82abe68c6663aebe7c4d72ee846cb8bbefc71e9286612d

Download Submit
C:\Windows\Temp\{693FA08F-7E17-4956-BBEC-33BAC1A937CB}\cab5046A8AB272BF37297BB7928664C9503

Filesize
869KB

MD5
13f098f4d6afca8049843ad230c32902

SHA1
dae3ad20a6966b267469e21d6a55706f762a4afe

SHA256
4f2b1de049338f791dab6d5d8be6edac556a33b5b4abd8b06662a25ed7c17a37

SHA512
cd0d37f5e027792ac6660af9d1b93cfef1ea367415f949f822379781b079cbd2a15d48b29b3c868f70154e9672f5616d19092b321028cd07d5d8e326d482993a

Download Submit
C:\Windows\Temp\{693FA08F-7E17-4956-BBEC-33BAC1A937CB}\vcRuntimeAdditional_x64

Filesize
180KB

MD5
4963ff6455aad7d1f9d9d47e0ae3fa89

SHA1
bd44672354dc55d828b39bfc1d49543a8f8dce79

SHA256
39699ef0144e0b375091fd1824e940f8c91e4dbb7eb5b568903d4baf70e6d2cf

SHA512
ca419a5ab17533d3c1263c5e9c5334a13290495b87a86b41bf04058872874376114b4d62ca66cee9863c673862d513899dd80dafd4dece6a999702e2ad8c3bff

Download Submit
C:\Windows\Temp\{693FA08F-7E17-4956-BBEC-33BAC1A937CB}\vcRuntimeMinimum_x64

Filesize
180KB

MD5
a074f9ba7166e1f8ad9db84ce76d843a

SHA1
2a36a3d8707f8b4fec94e26ec6e2a5df721591eb

SHA256
a3ba9b962f0e5ecdcfa3f9ff7b25bf7b61d78abe5f393ee45f71ef7ce0d9d497

SHA512
8ef81f2680f2b2de0453f2f2e8f209257c38f0e243a55d478a0085415af1483771741b09009eee3b1b78530016ca53c38b00918c5a6a91d947576d3b061bd31f

Download Submit
memory/1600-1420-0x00007FFE444A0000-0x00007FFE444A1000-memory.dmp

Filesize
4KB

Download
memory/1600-1465-0x000001CAC04E0000-0x000001CAC050B000-memory.dmp

Filesize
172KB

Download
memory/1808-1536-0x000001597F470000-0x000001597F471000-memory.dmp

Filesize
4KB

Download
memory/1808-1542-0x000001597F470000-0x000001597F471000-memory.dmp

Filesize
4KB

Download
memory/1808-1543-0x000001597F470000-0x000001597F471000-memory.dmp

Filesize
4KB

Download
memory/1808-1544-0x000001597F470000-0x000001597F471000-memory.dmp

Filesize
4KB

Download
memory/1808-1546-0x000001597F470000-0x000001597F471000-memory.dmp

Filesize
4KB

Download
memory/1808-1545-0x000001597F470000-0x000001597F471000-memory.dmp

Filesize
4KB

Download
memory/1808-1547-0x000001597F470000-0x000001597F471000-memory.dmp

Filesize
4KB

Download
memory/1808-1548-0x000001597F470000-0x000001597F471000-memory.dmp

Filesize
4KB

Download
memory/1808-1538-0x000001597F470000-0x000001597F471000-memory.dmp

Filesize
4KB

Download
memory/1808-1535-0x000001597F470000-0x000001597F471000-memory.dmp

Filesize
4KB

Download