c49db5b1163fa88090510df7d4585d2b00d69cd326a10b951cd9ed8189b37ad4

Analysis

max time kernel
302s
max time network
310s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2023, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pdfunk-setup.exe
Size

93.4MB
MD5

f85f36164c051bfcbc2055717c745fe2
SHA1

2108495e59a51a49232b6fcf7d457a0b8f569088
SHA256

c49db5b1163fa88090510df7d4585d2b00d69cd326a10b951cd9ed8189b37ad4
SHA512

628fe88543128994019cf3c04825967c58e1163564ab820c00d6056edfdeb3a7e60fe9f43db70759af1c4761a12048fa31914c8985176a596775c55129b20c46
SSDEEP

1572864:AyhPN8eY9RGb6+2cCHS/lMoMpcNgaE7rn8ZFmnTthXkZE/YQgeSd5XvvPG9eQ/en:Aml8eyGbBaIODpcGDn84Tf0ZqRQX+9JE

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PDFunk.lnk	pdfunk-setup.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	PDFunk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	PDFunk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	PDFunk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	PDFunk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	PDFunk.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 9 IoCs

pid	Process
5064	PDFunk.exe
1408	PDFunk.exe
2408	PDFunk.exe
3308	PDFunk.exe
4820	PDFunk.exe
2068	PDFunk.exe
3540	PDFunk.exe
1948	PDFunk.exe
4520	PDFunk.exe

Loads dropped DLL 23 IoCs

pid	Process
4672	pdfunk-setup.exe
4672	pdfunk-setup.exe
4672	pdfunk-setup.exe
4672	pdfunk-setup.exe
4672	pdfunk-setup.exe
4672	pdfunk-setup.exe
4672	pdfunk-setup.exe
4672	pdfunk-setup.exe
4672	pdfunk-setup.exe
5064	PDFunk.exe
1408	PDFunk.exe
2408	PDFunk.exe
2408	PDFunk.exe
2408	PDFunk.exe
2408	PDFunk.exe
2408	PDFunk.exe
3308	PDFunk.exe
4820	PDFunk.exe
2068	PDFunk.exe
3540	PDFunk.exe
1948	PDFunk.exe
4520	PDFunk.exe
4520	PDFunk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2784	tasklist.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\.pdf	pdfunk-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\.pdf\PDF_backup	pdfunk-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\PDF	pdfunk-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\PDF\shell\open\ = "Open with PDFunk"	pdfunk-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\PDF\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\PDFunk\\PDFunk.exe \"%1\""	pdfunk-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\PDF\shell\open\command	pdfunk-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\PDF\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\PDFunk\\resources\\file_pdf.ico"	pdfunk-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\PDF\shell\ = "open"	pdfunk-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\PDF\shell\open	pdfunk-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\.pdf\ = "PDF"	pdfunk-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\PDF\ = "Portable Document Format"	pdfunk-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\PDF\DefaultIcon	pdfunk-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\PDF\shell	pdfunk-setup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4672	pdfunk-setup.exe
4672	pdfunk-setup.exe
2784	tasklist.exe
2784	tasklist.exe
4520	PDFunk.exe
4520	PDFunk.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	tasklist.exe
Token: SeSecurityPrivilege	4672	pdfunk-setup.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe
Token: SeShutdownPrivilege	5064	PDFunk.exe
Token: SeCreatePagefilePrivilege	5064	PDFunk.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe
5064	PDFunk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4344	4672	pdfunk-setup.exe	109
PID 4672 wrote to memory of 4344	4672	pdfunk-setup.exe	109
PID 4672 wrote to memory of 4344	4672	pdfunk-setup.exe	109
PID 4344 wrote to memory of 2784	4344	cmd.exe	111
PID 4344 wrote to memory of 2784	4344	cmd.exe	111
PID 4344 wrote to memory of 2784	4344	cmd.exe	111
PID 4344 wrote to memory of 4480	4344	cmd.exe	112
PID 4344 wrote to memory of 4480	4344	cmd.exe	112
PID 4344 wrote to memory of 4480	4344	cmd.exe	112
PID 5064 wrote to memory of 1408	5064	PDFunk.exe	117
PID 5064 wrote to memory of 1408	5064	PDFunk.exe	117
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 2408	5064	PDFunk.exe	118
PID 5064 wrote to memory of 3308	5064	PDFunk.exe	121
PID 5064 wrote to memory of 3308	5064	PDFunk.exe	121
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120
PID 5064 wrote to memory of 4820	5064	PDFunk.exe	120

C:\Users\Admin\AppData\Local\Temp\pdfunk-setup.exe
"C:\Users\Admin\AppData\Local\Temp\pdfunk-setup.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq PDFunk.exe" | %SYSTEMROOT%\System32\find.exe "PDFunk.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq PDFunk.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\System32\find.exe "PDFunk.exe"
    3⤵
    PID:4480

C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe
"C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe
  C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\PDFunk /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\PDFunk\Crashpad --url=https://pdfunk.com --annotation=_productName=PDFunk --annotation=_version=1.0.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=26.2.0 --initial-client-data=0x460,0x468,0x46c,0x43c,0x470,0x7ff6c427cdf8,0x7ff6c427ce08,0x7ff6c427ce18
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1408
- C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe
  "C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\PDFunk" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1708 --field-trial-handle=1712,i,7723926821598085644,11949637745681059881,262144 --enable-features=SharedArrayBuffer --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2408
- C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe
  "C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\PDFunk" --standard-schemes --secure-schemes --bypasscsp-schemes=crx --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\PDFunk\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3316 --field-trial-handle=1712,i,7723926821598085644,11949637745681059881,262144 --enable-features=SharedArrayBuffer --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2068
- C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe
  "C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\PDFunk" --standard-schemes --secure-schemes --bypasscsp-schemes=crx --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\PDFunk\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2432 --field-trial-handle=1712,i,7723926821598085644,11949637745681059881,262144 --enable-features=SharedArrayBuffer --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4820
- C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe
  "C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\PDFunk" --standard-schemes --secure-schemes --bypasscsp-schemes=crx --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2276 --field-trial-handle=1712,i,7723926821598085644,11949637745681059881,262144 --enable-features=SharedArrayBuffer --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3308
- C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe
  "C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\PDFunk" --standard-schemes --secure-schemes --bypasscsp-schemes=crx --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\PDFunk\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3328 --field-trial-handle=1712,i,7723926821598085644,11949637745681059881,262144 --enable-features=SharedArrayBuffer --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3540
- C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe
  "C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\PDFunk" --standard-schemes --secure-schemes --bypasscsp-schemes=crx --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\PDFunk\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2548 --field-trial-handle=1712,i,7723926821598085644,11949637745681059881,262144 --enable-features=SharedArrayBuffer --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1948
- C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe
  "C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\PDFunk" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2244 --field-trial-handle=1712,i,7723926821598085644,11949637745681059881,262144 --enable-features=SharedArrayBuffer --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\PDFunk\D3DCompiler_47.dll

Filesize
4.7MB

MD5
dc5738c768c11d42e42b133c3458e7d7

SHA1
13742a7ff8a4a771c5263f9073ccecea454d68fe

SHA256
90ba6f468293ba1906db66101e2981a060fa3e8fa2feed459aa68871395adaf6

SHA512
93719e5975bf4560358e9da0679120ce5686805c5fe38e1ddce0befc13ada013b58dee23e8ecfebf3045ffbf24f381a510d96a14eca9cbcdc702ede12b9d4037

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe

Filesize
158.0MB

MD5
fba33abd3dccedd4a18900304f060368

SHA1
fa87834fc96f938c6747e784d9a7efd9a1fcd23e

SHA256
acea5c63fbe79446d21b023f9ef3a93ede718557001de67c9233db8672b4a808

SHA512
69fcf5760a8d177bd8912a30414c05169a5420fed357d4da00adaf05dcb315b927d1949dc26d92cb95215f78dabfebe04b9b16605cd506876aa67ed612dfbe9d

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe

Filesize
158.0MB

MD5
fba33abd3dccedd4a18900304f060368

SHA1
fa87834fc96f938c6747e784d9a7efd9a1fcd23e

SHA256
acea5c63fbe79446d21b023f9ef3a93ede718557001de67c9233db8672b4a808

SHA512
69fcf5760a8d177bd8912a30414c05169a5420fed357d4da00adaf05dcb315b927d1949dc26d92cb95215f78dabfebe04b9b16605cd506876aa67ed612dfbe9d

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe

Filesize
158.0MB

MD5
fba33abd3dccedd4a18900304f060368

SHA1
fa87834fc96f938c6747e784d9a7efd9a1fcd23e

SHA256
acea5c63fbe79446d21b023f9ef3a93ede718557001de67c9233db8672b4a808

SHA512
69fcf5760a8d177bd8912a30414c05169a5420fed357d4da00adaf05dcb315b927d1949dc26d92cb95215f78dabfebe04b9b16605cd506876aa67ed612dfbe9d

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe

Filesize
158.0MB

MD5
fba33abd3dccedd4a18900304f060368

SHA1
fa87834fc96f938c6747e784d9a7efd9a1fcd23e

SHA256
acea5c63fbe79446d21b023f9ef3a93ede718557001de67c9233db8672b4a808

SHA512
69fcf5760a8d177bd8912a30414c05169a5420fed357d4da00adaf05dcb315b927d1949dc26d92cb95215f78dabfebe04b9b16605cd506876aa67ed612dfbe9d

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe

Filesize
158.0MB

MD5
fba33abd3dccedd4a18900304f060368

SHA1
fa87834fc96f938c6747e784d9a7efd9a1fcd23e

SHA256
acea5c63fbe79446d21b023f9ef3a93ede718557001de67c9233db8672b4a808

SHA512
69fcf5760a8d177bd8912a30414c05169a5420fed357d4da00adaf05dcb315b927d1949dc26d92cb95215f78dabfebe04b9b16605cd506876aa67ed612dfbe9d

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe

Filesize
158.0MB

MD5
fba33abd3dccedd4a18900304f060368

SHA1
fa87834fc96f938c6747e784d9a7efd9a1fcd23e

SHA256
acea5c63fbe79446d21b023f9ef3a93ede718557001de67c9233db8672b4a808

SHA512
69fcf5760a8d177bd8912a30414c05169a5420fed357d4da00adaf05dcb315b927d1949dc26d92cb95215f78dabfebe04b9b16605cd506876aa67ed612dfbe9d

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe

Filesize
158.0MB

MD5
fba33abd3dccedd4a18900304f060368

SHA1
fa87834fc96f938c6747e784d9a7efd9a1fcd23e

SHA256
acea5c63fbe79446d21b023f9ef3a93ede718557001de67c9233db8672b4a808

SHA512
69fcf5760a8d177bd8912a30414c05169a5420fed357d4da00adaf05dcb315b927d1949dc26d92cb95215f78dabfebe04b9b16605cd506876aa67ed612dfbe9d

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe

Filesize
158.0MB

MD5
fba33abd3dccedd4a18900304f060368

SHA1
fa87834fc96f938c6747e784d9a7efd9a1fcd23e

SHA256
acea5c63fbe79446d21b023f9ef3a93ede718557001de67c9233db8672b4a808

SHA512
69fcf5760a8d177bd8912a30414c05169a5420fed357d4da00adaf05dcb315b927d1949dc26d92cb95215f78dabfebe04b9b16605cd506876aa67ed612dfbe9d

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe

Filesize
158.0MB

MD5
fba33abd3dccedd4a18900304f060368

SHA1
fa87834fc96f938c6747e784d9a7efd9a1fcd23e

SHA256
acea5c63fbe79446d21b023f9ef3a93ede718557001de67c9233db8672b4a808

SHA512
69fcf5760a8d177bd8912a30414c05169a5420fed357d4da00adaf05dcb315b927d1949dc26d92cb95215f78dabfebe04b9b16605cd506876aa67ed612dfbe9d

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\PDFunk.exe

Filesize
82.3MB

MD5
77a2a73ac8e20d8bf75aec3652b8c93f

SHA1
b047be951c8dce8c8d8895c509b49b299e1dca1f

SHA256
d8a80d9cdbc929a308f37d707a1ae9aa699f0a07ddfb8a23365fae651aa6682c

SHA512
dcc3e9dda72f1cadf4930b75c3a9aae3137c9cfaab178a7e8f817e3cb86a7b23ebdf34ba7235a30b36047ee6b209bfe94fac6ef64504ec2780c53a64b095c8d4

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\chrome_100_percent.pak

Filesize
132KB

MD5
e4cbb48c438622a4298c7bdd75cc04f6

SHA1
6f756d31ef95fd745ba0e9c22aadb506f3a78471

SHA256
24d92bbeb63d06b01010fe230c1e3a31e667a159be7e570a8efe68f83ed9ad40

SHA512
8d3ea1b5ca74c20a336eaa29630fd76ecd32f5a56bb66e8cef2bce0fa19024ea917562fd31365081f7027dde9c8464742b833d08c8f41fdddc5bd1a74b9bc766

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\chrome_100_percent.pak

Filesize
132KB

MD5
e4cbb48c438622a4298c7bdd75cc04f6

SHA1
6f756d31ef95fd745ba0e9c22aadb506f3a78471

SHA256
24d92bbeb63d06b01010fe230c1e3a31e667a159be7e570a8efe68f83ed9ad40

SHA512
8d3ea1b5ca74c20a336eaa29630fd76ecd32f5a56bb66e8cef2bce0fa19024ea917562fd31365081f7027dde9c8464742b833d08c8f41fdddc5bd1a74b9bc766

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\chrome_200_percent.pak

Filesize
191KB

MD5
99b95d59d6817b46e9572e3354c97317

SHA1
6809db4ca8e10edd316261a3490d5fc657372c12

SHA256
55d873a9f3ac69bbf6eb6940443df8331ebd7aa57138681d615f3b89902447e7

SHA512
3071cfeb74d5058c4b7c01bfe3c6717d9bb426f3354c4d8a35bd3e16e15cde2f2c48238cb6382b0703b1cc257d87fcecfb84fbf4f597f58e64463ceede4366dd

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\d3dcompiler_47.dll

Filesize
4.7MB

MD5
dc5738c768c11d42e42b133c3458e7d7

SHA1
13742a7ff8a4a771c5263f9073ccecea454d68fe

SHA256
90ba6f468293ba1906db66101e2981a060fa3e8fa2feed459aa68871395adaf6

SHA512
93719e5975bf4560358e9da0679120ce5686805c5fe38e1ddce0befc13ada013b58dee23e8ecfebf3045ffbf24f381a510d96a14eca9cbcdc702ede12b9d4037

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\ffmpeg.dll

Filesize
2.8MB

MD5
565203da56d5a5702f41d635dec68673

SHA1
e63ebc52bab5ac8ab2cb407c186aee63ebae8b12

SHA256
813c35c817c1f140bacbac2fb83452130429c38900d2a6a5ce5614858a1e53b6

SHA512
23aeb5090271a10c0053079b8c5732f45e698eb0b930deb2d41ec5fc356a7a1168e69c2a98282a0081a897563490ca368e19a3f8b92f1f658c2d5b13b3fc7c20

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\ffmpeg.dll

Filesize
2.8MB

MD5
565203da56d5a5702f41d635dec68673

SHA1
e63ebc52bab5ac8ab2cb407c186aee63ebae8b12

SHA256
813c35c817c1f140bacbac2fb83452130429c38900d2a6a5ce5614858a1e53b6

SHA512
23aeb5090271a10c0053079b8c5732f45e698eb0b930deb2d41ec5fc356a7a1168e69c2a98282a0081a897563490ca368e19a3f8b92f1f658c2d5b13b3fc7c20

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\ffmpeg.dll

Filesize
2.8MB

MD5
565203da56d5a5702f41d635dec68673

SHA1
e63ebc52bab5ac8ab2cb407c186aee63ebae8b12

SHA256
813c35c817c1f140bacbac2fb83452130429c38900d2a6a5ce5614858a1e53b6

SHA512
23aeb5090271a10c0053079b8c5732f45e698eb0b930deb2d41ec5fc356a7a1168e69c2a98282a0081a897563490ca368e19a3f8b92f1f658c2d5b13b3fc7c20

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\ffmpeg.dll

Filesize
2.8MB

MD5
565203da56d5a5702f41d635dec68673

SHA1
e63ebc52bab5ac8ab2cb407c186aee63ebae8b12

SHA256
813c35c817c1f140bacbac2fb83452130429c38900d2a6a5ce5614858a1e53b6

SHA512
23aeb5090271a10c0053079b8c5732f45e698eb0b930deb2d41ec5fc356a7a1168e69c2a98282a0081a897563490ca368e19a3f8b92f1f658c2d5b13b3fc7c20

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\ffmpeg.dll

Filesize
2.8MB

MD5
565203da56d5a5702f41d635dec68673

SHA1
e63ebc52bab5ac8ab2cb407c186aee63ebae8b12

SHA256
813c35c817c1f140bacbac2fb83452130429c38900d2a6a5ce5614858a1e53b6

SHA512
23aeb5090271a10c0053079b8c5732f45e698eb0b930deb2d41ec5fc356a7a1168e69c2a98282a0081a897563490ca368e19a3f8b92f1f658c2d5b13b3fc7c20

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\ffmpeg.dll

Filesize
2.8MB

MD5
565203da56d5a5702f41d635dec68673

SHA1
e63ebc52bab5ac8ab2cb407c186aee63ebae8b12

SHA256
813c35c817c1f140bacbac2fb83452130429c38900d2a6a5ce5614858a1e53b6

SHA512
23aeb5090271a10c0053079b8c5732f45e698eb0b930deb2d41ec5fc356a7a1168e69c2a98282a0081a897563490ca368e19a3f8b92f1f658c2d5b13b3fc7c20

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\ffmpeg.dll

Filesize
2.8MB

MD5
565203da56d5a5702f41d635dec68673

SHA1
e63ebc52bab5ac8ab2cb407c186aee63ebae8b12

SHA256
813c35c817c1f140bacbac2fb83452130429c38900d2a6a5ce5614858a1e53b6

SHA512
23aeb5090271a10c0053079b8c5732f45e698eb0b930deb2d41ec5fc356a7a1168e69c2a98282a0081a897563490ca368e19a3f8b92f1f658c2d5b13b3fc7c20

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\ffmpeg.dll

Filesize
2.8MB

MD5
565203da56d5a5702f41d635dec68673

SHA1
e63ebc52bab5ac8ab2cb407c186aee63ebae8b12

SHA256
813c35c817c1f140bacbac2fb83452130429c38900d2a6a5ce5614858a1e53b6

SHA512
23aeb5090271a10c0053079b8c5732f45e698eb0b930deb2d41ec5fc356a7a1168e69c2a98282a0081a897563490ca368e19a3f8b92f1f658c2d5b13b3fc7c20

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\ffmpeg.dll

Filesize
2.8MB

MD5
565203da56d5a5702f41d635dec68673

SHA1
e63ebc52bab5ac8ab2cb407c186aee63ebae8b12

SHA256
813c35c817c1f140bacbac2fb83452130429c38900d2a6a5ce5614858a1e53b6

SHA512
23aeb5090271a10c0053079b8c5732f45e698eb0b930deb2d41ec5fc356a7a1168e69c2a98282a0081a897563490ca368e19a3f8b92f1f658c2d5b13b3fc7c20

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\ffmpeg.dll

Filesize
2.8MB

MD5
565203da56d5a5702f41d635dec68673

SHA1
e63ebc52bab5ac8ab2cb407c186aee63ebae8b12

SHA256
813c35c817c1f140bacbac2fb83452130429c38900d2a6a5ce5614858a1e53b6

SHA512
23aeb5090271a10c0053079b8c5732f45e698eb0b930deb2d41ec5fc356a7a1168e69c2a98282a0081a897563490ca368e19a3f8b92f1f658c2d5b13b3fc7c20

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\icudtl.dat

Filesize
10.1MB

MD5
62880b7d351a9f547b62b8da6c97ce25

SHA1
057f11003013cfb3f1c63e6bdd4f2f9949ff0104

SHA256
7c40c811d30d459dbf04a04c141b60eb4247cd58a008fb836605317df665748f

SHA512
0d6f83175a91d90f4cc3ec4d9071b7acd0cd8ebbcc592322e46fde2adb7198e035af62c45a11a622f2a908e26d4dd8b8d1af023e634a74d0824d02c791ba3c1a

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\libEGL.dll

Filesize
492KB

MD5
29873a84956d281d2f181475d448f774

SHA1
5546e9c6b2b67dbd14eb124e0102b0ea8bd7e0dd

SHA256
fe17e5020df97390bbfbf46f7ec4f6c96d230ef0395780248b470a05d89e3f0f

SHA512
dbc4c802e038bea8d65637b4c33784980d473a7cfa79f4acc91e177e476a4e539734d7546782d66e05014569959273b28e0dfb7b13de8505c8f2e2570366ec27

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\libGLESv2.dll

Filesize
7.2MB

MD5
c246eb7a1cf1db2dc11b7bcc2bbc315f

SHA1
a77aff08ba1e1e2618e1cbce9e4437e2190af038

SHA256
0294ef304b5319e26ed8da9edc8c137859a5713eb8f336d40a5801028d771566

SHA512
dc92cac28fef6bcb9566bfcee310e4424931aed9a184f32e96b71ec357ceb22526421862b85ca10d33643251275061282c20ab770a4b87f55ba62800bd43fba7

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\libegl.dll

Filesize
492KB

MD5
29873a84956d281d2f181475d448f774

SHA1
5546e9c6b2b67dbd14eb124e0102b0ea8bd7e0dd

SHA256
fe17e5020df97390bbfbf46f7ec4f6c96d230ef0395780248b470a05d89e3f0f

SHA512
dbc4c802e038bea8d65637b4c33784980d473a7cfa79f4acc91e177e476a4e539734d7546782d66e05014569959273b28e0dfb7b13de8505c8f2e2570366ec27

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\libglesv2.dll

Filesize
7.2MB

MD5
c246eb7a1cf1db2dc11b7bcc2bbc315f

SHA1
a77aff08ba1e1e2618e1cbce9e4437e2190af038

SHA256
0294ef304b5319e26ed8da9edc8c137859a5713eb8f336d40a5801028d771566

SHA512
dc92cac28fef6bcb9566bfcee310e4424931aed9a184f32e96b71ec357ceb22526421862b85ca10d33643251275061282c20ab770a4b87f55ba62800bd43fba7

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\locales\en-US.pak

Filesize
391KB

MD5
c9c2abcb04e1ad5f1a20244da8d595a8

SHA1
89ca81da21900074a5ccdcdc852768277b2b620b

SHA256
0364c73f320e441b03cb2afcaaca3ffbfac51a3559dcd0ff99a1accf82c7f762

SHA512
96bbf21174f56a111a2fc6ec024ab2f143945306797e77d773367a7fad42b7828ebb7b08d0dab76858d9fa340bf3205be403bc53df9e5e4e390058c94a751ffd

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\resources.pak

Filesize
5.2MB

MD5
7ed62954e54c9107ca736da7a96cb71b

SHA1
f45fe2247522c63f2be16a86490acd6b953cb409

SHA256
9cd900682719567c530bd445d104bd1c35f9d5b49b0c12ff508a480e41014302

SHA512
d0e6f4ca7a9517efee0b6aacf8d4297e6705c3e97f61e77f3a06b97947fba0531a993197a43833979632828572f01163fced834525549e6355463e84fb6ffbf8

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\resources\app.asar

Filesize
103.1MB

MD5
c08fb94d286a8292f3bb0e070897288b

SHA1
6d089d92a308f27870f7053ba6652ebd1bd05f30

SHA256
7b0179a506bb7347f1d5de292e909a3ef0ae3c0eb1a6dae558641e703cb06240

SHA512
26c8cda327117971f42c289c64b91ad8c4ce84c8452f3bfd7f2c8e5fd964f956d52eb6ca7edc8e7a133ac6f2bd9909b42485884f49d6c312ea316a60146e6723

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\v8_context_snapshot.bin

Filesize
570KB

MD5
db31aceddf59ff965d89ba5273f19750

SHA1
1bd4466a97976ea39cc2faf73acd8f4d2ffafbca

SHA256
f1c4b23e81cfa31cadde7e3abd1523d6e0d44c2bbfead1841af2f78aed03bdb9

SHA512
3b383d6b7aaceb9e40d80e6d986a5fa25da75f0d0f4943b7917f4219625dbf070bc73b27ccd6d7c99d4a2b6b3b33edd5df4316a235b6905486303bb778e5c9a9

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\vk_swiftshader.dll

Filesize
4.9MB

MD5
cd3dbbffdfa8f81b04dde1a25418506a

SHA1
493f1af39585cbd3578ed3fab79b8db1df4ec410

SHA256
2e2250963c36bb9265c256ae43123cac60e1937b039567be4e102d82bdb797c3

SHA512
05a10c823043661c6a1a91793bbab7a89d570cdc52962e4d2c86b783cecb0a3285aed145d6f49d622a7a069c76d1907f614f3e8b6f4fd003cd770c751f7a0709

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\vk_swiftshader.dll

Filesize
4.9MB

MD5
cd3dbbffdfa8f81b04dde1a25418506a

SHA1
493f1af39585cbd3578ed3fab79b8db1df4ec410

SHA256
2e2250963c36bb9265c256ae43123cac60e1937b039567be4e102d82bdb797c3

SHA512
05a10c823043661c6a1a91793bbab7a89d570cdc52962e4d2c86b783cecb0a3285aed145d6f49d622a7a069c76d1907f614f3e8b6f4fd003cd770c751f7a0709

Download Submit
C:\Users\Admin\AppData\Local\Programs\PDFunk\vk_swiftshader.dll

Filesize
4.9MB

MD5
cd3dbbffdfa8f81b04dde1a25418506a

SHA1
493f1af39585cbd3578ed3fab79b8db1df4ec410

SHA256
2e2250963c36bb9265c256ae43123cac60e1937b039567be4e102d82bdb797c3

SHA512
05a10c823043661c6a1a91793bbab7a89d570cdc52962e4d2c86b783cecb0a3285aed145d6f49d622a7a069c76d1907f614f3e8b6f4fd003cd770c751f7a0709

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\LICENSES.chromium.html

Filesize
8.4MB

MD5
8e263cc42a54ce9a3562008eade01062

SHA1
5053b8d240852729c73282c9d2c2beb3d749d2e7

SHA256
6f95e9ff1f5c55233bcb1520c1296a0c7aff9cb4d864086da191acb77e7a068f

SHA512
d25652d9f8ca416219dcfd742ae330319386d499c1c70bc1830a68f6f4eb5cb01072c7986157e26c4298d4587af06d33d0b8c8ff0cec6069577c418618fb0e4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\PDFunk.exe

Filesize
158.0MB

MD5
fba33abd3dccedd4a18900304f060368

SHA1
fa87834fc96f938c6747e784d9a7efd9a1fcd23e

SHA256
acea5c63fbe79446d21b023f9ef3a93ede718557001de67c9233db8672b4a808

SHA512
69fcf5760a8d177bd8912a30414c05169a5420fed357d4da00adaf05dcb315b927d1949dc26d92cb95215f78dabfebe04b9b16605cd506876aa67ed612dfbe9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\chrome_200_percent.pak

Filesize
191KB

MD5
99b95d59d6817b46e9572e3354c97317

SHA1
6809db4ca8e10edd316261a3490d5fc657372c12

SHA256
55d873a9f3ac69bbf6eb6940443df8331ebd7aa57138681d615f3b89902447e7

SHA512
3071cfeb74d5058c4b7c01bfe3c6717d9bb426f3354c4d8a35bd3e16e15cde2f2c48238cb6382b0703b1cc257d87fcecfb84fbf4f597f58e64463ceede4366dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
dc5738c768c11d42e42b133c3458e7d7

SHA1
13742a7ff8a4a771c5263f9073ccecea454d68fe

SHA256
90ba6f468293ba1906db66101e2981a060fa3e8fa2feed459aa68871395adaf6

SHA512
93719e5975bf4560358e9da0679120ce5686805c5fe38e1ddce0befc13ada013b58dee23e8ecfebf3045ffbf24f381a510d96a14eca9cbcdc702ede12b9d4037

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\ffmpeg.dll

Filesize
2.8MB

MD5
565203da56d5a5702f41d635dec68673

SHA1
e63ebc52bab5ac8ab2cb407c186aee63ebae8b12

SHA256
813c35c817c1f140bacbac2fb83452130429c38900d2a6a5ce5614858a1e53b6

SHA512
23aeb5090271a10c0053079b8c5732f45e698eb0b930deb2d41ec5fc356a7a1168e69c2a98282a0081a897563490ca368e19a3f8b92f1f658c2d5b13b3fc7c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\icudtl.dat

Filesize
10.1MB

MD5
62880b7d351a9f547b62b8da6c97ce25

SHA1
057f11003013cfb3f1c63e6bdd4f2f9949ff0104

SHA256
7c40c811d30d459dbf04a04c141b60eb4247cd58a008fb836605317df665748f

SHA512
0d6f83175a91d90f4cc3ec4d9071b7acd0cd8ebbcc592322e46fde2adb7198e035af62c45a11a622f2a908e26d4dd8b8d1af023e634a74d0824d02c791ba3c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\libEGL.dll

Filesize
492KB

MD5
29873a84956d281d2f181475d448f774

SHA1
5546e9c6b2b67dbd14eb124e0102b0ea8bd7e0dd

SHA256
fe17e5020df97390bbfbf46f7ec4f6c96d230ef0395780248b470a05d89e3f0f

SHA512
dbc4c802e038bea8d65637b4c33784980d473a7cfa79f4acc91e177e476a4e539734d7546782d66e05014569959273b28e0dfb7b13de8505c8f2e2570366ec27

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\libGLESv2.dll

Filesize
7.2MB

MD5
c246eb7a1cf1db2dc11b7bcc2bbc315f

SHA1
a77aff08ba1e1e2618e1cbce9e4437e2190af038

SHA256
0294ef304b5319e26ed8da9edc8c137859a5713eb8f336d40a5801028d771566

SHA512
dc92cac28fef6bcb9566bfcee310e4424931aed9a184f32e96b71ec357ceb22526421862b85ca10d33643251275061282c20ab770a4b87f55ba62800bd43fba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\af.pak

Filesize
425KB

MD5
13f2bba88538437cd59e7cdc6f4fbec2

SHA1
05d94197ccc845cf0fbbdc3858000ff4bdd21288

SHA256
e4c2378f4254e11e3d79a735314a2ec712389ad4d9fae3fb429d364ea0978bf4

SHA512
06a1456454b543eeeb6f3d0ae4218aa14ef89f1620fd4a7f0013e77d10553bb54ed8118faefffb76a4d8e08ceddc76b1929165c7e711a711cfeda52fc78d9ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\am.pak

Filesize
693KB

MD5
39a396fce4d93f744b3c786d62d2686c

SHA1
7ec8176e652b666b6ab9fffb6cb9b7dcfdd1a2a2

SHA256
0b1d326be9dabcda8e37740017383f2d8f1bec7a8fdb1f11ebe538c3632453fd

SHA512
798063b51f745fc2c9e7f852f72ce55939ed41305d070d1844c790755f7ab42a6830406ba2485237d37a0c46b804512e7dc37c65b7f03249c28741a4f706017a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\ar.pak

Filesize
758KB

MD5
37dd1013428a907fc1e6f4794c9f48da

SHA1
0c6fdb7a16882582de95ca54b5449c5543664d21

SHA256
e96ebff226ad97b3a0f8b288d6eb79e3dab624aea13365fa36dce1df81de2cdf

SHA512
79bd98b94bad76231d4a298ecd8e274476733a530d77c727b7ee3e4f01e33ac2e76267c8b906d427c963e4d6d97e67dfd612864ea9c9f3b336820a2788a07bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\bg.pak

Filesize
788KB

MD5
01dfb1a7815613fa0a5411235f45b27b

SHA1
3bf1ea5597ac77b26bd30caa1efea7cb4f7a1b19

SHA256
13d08d2c4972cd18bb8ea8a57587dad29684c2336f73282dd3284b0649377cf8

SHA512
5d8a65e5a17aa163fb679e003e1837ea96e515b105c9977029a5ca4854845289de5d65c0edfd473cb74410c5cacdb5b360f25a69776705fb05f48688d92680da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\bn.pak

Filesize
1019KB

MD5
ff4f966849b4107535e41d037d9144c7

SHA1
3a973857b061914e8905bda7e8f2bdafa384588e

SHA256
2dc26dee345271f4606650912b0b7b5df68f621f2920864e0e36c1d1b22459b1

SHA512
98772f266f9553f77f91b11dc4589ec8a0930554e9e0b381bbacd8d23ce794c04f6fe821388a6e87cb14cb59c7522c18c06b1af11fc177c7e40ef71242adcba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\ca.pak

Filesize
479KB

MD5
5fee8bf10a710988a303f2f1fefabf83

SHA1
3558fe55dc043ae3f2cb90ad8244a19560ad3d0e

SHA256
3d82bd3de5447eb04f205383dce91e812e87820bb1e9b0ab5acfd924db1cf8aa

SHA512
41dc47bdb6dd6de249e2350488de9b4740abc61406461d82e33e3bc41ceb53647f5c5b89129da75f1a6130f3e45027a7e2f616f3a9b0fc6abd2aaaf2f338387b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\cs.pak

Filesize
494KB

MD5
ccb2b08ea1cebd344a25a0eb20ec49a8

SHA1
9da69d50320dc26dd0b411aea5612236d88bd985

SHA256
fa9caadbc982c4d1c9af2c514071906ffbdb270aee1270f27d2edf1dcd1f81ea

SHA512
516bc61874f543be8590cacb5a775c45e6233e898c01248c9b652bfcc87342201ab227c89e87765cccb9136bbd73b8656ffccb79ce8a834440716822b3d0e4bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\da.pak

Filesize
446KB

MD5
5b033c206820ace5eb4c6f82aed34a5d

SHA1
28017cfc13259273022059f02564ffc99dcd75a4

SHA256
1a51de04cb205c708520f1b013447f1a89f0b1330dbce6d1e71cf355319d1108

SHA512
e423069f7a895179ea17be5774284e9e2e27f02c40bac7d7211cab77348800622796f04c3e6618905364e189ca5ec772ed7dbd285872777d163d3ebec08a64d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\de.pak

Filesize
477KB

MD5
7ccdc41a3dbdf89058d71629225664ae

SHA1
e15c35b18685d9573349ff4247733b5f5ada8717

SHA256
163ea4c2cf67edd0526a8e18d3810872e92a1d4e17b5cf4f04107fda5967b0c9

SHA512
13b20b0db02a0a7480c56c79304ef594353507e1a30da0130b73aa8e9ec7636f306315a6f40729b10dc725f936642d2e2b282ed3040a079a6f25a7f9f7f1ae28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\el.pak

Filesize
865KB

MD5
451c678e1af7e79a411057e7d616d02b

SHA1
ec95364cd43436d7f570643897667464d9265953

SHA256
932a3ae4fe40cf79f20991608dcda90e94435d79f9405f5948b8211f8de0c284

SHA512
f15af670831823ddbabd878dfde4e578021af4efd49ef685ae5a77054e21b0a3081a49ca846ade60202ae6e2cc4c851f9384212b6e7fdc7c875134426724f374

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\en-GB.pak

Filesize
389KB

MD5
c27e3b641d2f8533875f5aaba6a7988a

SHA1
05e44a22b705c1e18f11865accfac03e3e515077

SHA256
38d8a09cee11668341781030439729af895ba8ad079775d7552758a9a995f5fe

SHA512
73a61f08447ecf118663ea8629fe81acce86aef11cf3bc965cc407450b6af399df21873bc21240a38eb1cf9d304be219879e280e9cf0dc9ae484fce6ada0cefe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\en-US.pak

Filesize
391KB

MD5
c9c2abcb04e1ad5f1a20244da8d595a8

SHA1
89ca81da21900074a5ccdcdc852768277b2b620b

SHA256
0364c73f320e441b03cb2afcaaca3ffbfac51a3559dcd0ff99a1accf82c7f762

SHA512
96bbf21174f56a111a2fc6ec024ab2f143945306797e77d773367a7fad42b7828ebb7b08d0dab76858d9fa340bf3205be403bc53df9e5e4e390058c94a751ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\es-419.pak

Filesize
473KB

MD5
af687eefaec46e65b8f42b1bb2d01315

SHA1
3eca718dce243ae170823d5509a4711e89b9127d

SHA256
41b96bdecd2f8adb79171b710169683401d5943e86e836280bd26b8100f3537e

SHA512
8a5f8c8b94741036d10e08ac2ee0ac776f69d489a620484b912bdba27645f03d9b4876343eacd33b68b445a27650f5385c45fe8876bed796775da337bf6ec6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\es.pak

Filesize
473KB

MD5
16bb0e206b7ab4b485dc3a1351fd18cd

SHA1
7f8ba0a7b05b5d147b5f625374974baa7bd5f133

SHA256
2e639f1484994063c8dd2b2e8fcb6ab63ddd79da3c179c93b3b33c092f38bea6

SHA512
be64c5d8ed23b3ed3b6ba55a56f05875d44fc80ff29d225267b36bd299d9d93a67aaf1278df2faf02a1ab3c77722aee64753df1011b848035885e15ae91706cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\et.pak

Filesize
428KB

MD5
c535505444973759c65c3a060aadc75f

SHA1
32137ca1188669f1f548a8208a2209e1b9cbd604

SHA256
890429677a648a0489e734fd3856677c083b9ac1a88ea6c7278c0055bf20ad06

SHA512
4d598453fe4a0ec72ab114b2180cb953c53d8c64a780ada0267a461a672aa5e74389134bef9021b13d09fcbd1320f007e207578abe8028a3b78981b3528ccd36

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\fa.pak

Filesize
703KB

MD5
cf18eadbeca3504b1c375840e8d1c1de

SHA1
ab72aa02f47d500f5bea798dea50cc433120fa21

SHA256
7b98811c21db6284626c3c3c97f6b54a4bccc0289d6c80b980a87a092d1573fd

SHA512
7c579c65f54c80d223dd72631bc7dd54b8a4df59f19c7a6cab6df0925be21b625c5f607609751d36c408c1b516cee64bdc87ca29b3cf3ff331ffa016f4a3606d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\fi.pak

Filesize
438KB

MD5
1cbfa553a5b1de642ea4c248dfe1edba

SHA1
5de05b3c11fdd59ff5064a153a6dcbda33350971

SHA256
8f3e8ec0fbb471b45db65a77dc1013e3363f387d3d0c6a458c90f371907d0085

SHA512
ea3b99be7da893be8c3b228d1d3d7b644a1f5425b5380dc3e0ae0ba1bd29cf39dabe73819bcc4fa67f10a488f018e9fa2328995cb78f40ae8fdb66aa514188aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\fil.pak

Filesize
495KB

MD5
8ce446cac9221f07f912be59534d86ec

SHA1
15cd1b902b26abbe665fed518575748483a9c3e4

SHA256
b6ce37b1aeb4ca17a7f78ebc8f97c2807f588dfc4ad3e0639005c626b5c9b939

SHA512
20be2b5c7e8fca897109b1dc8219931eaaa1c8296b1d26dcc7f9058168fef371d7955fb0f6c5693399b83fa81d27369efac8c3742059eea2333bd66d20b8d0d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\fr.pak

Filesize
513KB

MD5
b93a7b830a2cd67b7cd0c09af6ad0df0

SHA1
2d8fed7e69ab1dd17f3cb8d6d953b8718d393f15

SHA256
1caa8884077bf78d610dc26241218fdf659a725c1c1c7dda12e04ac918d9c4bb

SHA512
c1079a8d7d87f4c16ab490c501e3f11091305a63e51e042711ac7785a6a3d1281d318ab7ea468dc25f61d5ef047ecb3025aad9ee2db881413bd19dc0b57fe878

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\gu.pak

Filesize
996KB

MD5
02bfa1114fd5b75261c24d6c0e6441f7

SHA1
d48b80339405cb8c8ec7a19b688e8d544938c4c7

SHA256
bbb17268412fb3e13584ca4dc90a94f984177d3c97ee89af2a57324709f8ed1d

SHA512
751b91d381c882a5dc0c0ee6313cf3e7ef51b4d369330a169cf9625de99e6019233109e815fc474fae44d79235940ba2ce68af7033f4c4c994e2774bbd8105be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\he.pak

Filesize
616KB

MD5
cdd42769598c10cad3c19a563f04ff5a

SHA1
55e1d0364d41c8ca1b09726f4b42e8be93c7bacc

SHA256
dff85c48182320e584466e0f37aa4b17429e9545fb48d1c4c088d612f7b88b8c

SHA512
dff9558e0e39c823cc88b3bd99ee5c640808949f2cb28f3afa64392d7c105c06c7f78af53ef6284943c9fd53e7ac30862fc2a5273a27dac0ac7cd34a266f8b15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\hi.pak

Filesize
1.0MB

MD5
cd91036827739441e4cc849aa30706d6

SHA1
cc8e4c53e18db16876f855c2377f3cf0e2abf95a

SHA256
0936587aa072339f8dc347506e5553159319a686010ca1912bed1d830e107c6e

SHA512
553773bdc11be94f495b88e0587d572455ef68c182d51c9e1ae0e3aa23744f836996a446ed136afc562eb9a110e435b494d5955d2792a364a619111e7b3550e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\hr.pak

Filesize
477KB

MD5
ef62a50cc098afcf3fab69c7502219e9

SHA1
db474cf332c90de660fc575ef897d5389b65784c

SHA256
07effa557c8bc822626c05a4d299296f88d3da0654248c326d796f7c2de3ec64

SHA512
7ae6f40c7bf404532df0bc2ffa449e0d99debc2b9816450ed0d015b1634dd96cd5650ab6af5a6d44d52d0e3c9c81836ee350210c4f8a13be6cc0cb796a630350

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\hu.pak

Filesize
513KB

MD5
51b14b96d1b9fa99ed849347a8954133

SHA1
5259b749576a9612e429a665dfc8bf47651c39ea

SHA256
70d4a0724a2e0e80ec047e7683eec7715c0fb5f88795cc97a63e4c2ee2237800

SHA512
b68d4bc792f29df210602a557d0b3333a95e30cd03a0a4cb5f537c9c51da9937119391f2a359c03fb874c1f540c23f44bef121e45f048f32b1db06d67a0bad1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\id.pak

Filesize
421KB

MD5
f5554948a59090a869d4d170d4419c0f

SHA1
f021d4879898876693489b92c81460b15a725ddf

SHA256
4b8a820da85f62e6956a74e4adc77e4719ca53632996ea91101cf19552412ac1

SHA512
8408f2596a351b476144f907a4d5c902f6ebcb53f4728050702d400992e8bf9a45a838a8478d296bad409e2fbd54accd702e773a4476f3e61bf7d29827e791f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\it.pak

Filesize
466KB

MD5
746d9e85a3ecf3b90d241b6fca725216

SHA1
55612fafcc52e5a57dcdcc6ea33ec0134092373e

SHA256
17eed4b62c1725770887b30aeec34121558f6df734d1707d3ad997683c2f6eae

SHA512
57ba332d38c72f8d50234aa3e632543b76b32158ce47534413e6555aa61e15f20272484bc0c99089f206c1ad0e4fa49aeeec7a84411c82fa55255eee40b5cc32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\ja.pak

Filesize
570KB

MD5
f947519f5558bbb0d860861335a57d20

SHA1
20bb2367c39edcfad9eae3853bfc4dc8ab1b7775

SHA256
2a0f9c4b08b474117b0eae8316a391f77a828d03e32496ed692bdda3c8efb677

SHA512
62c17fe85f88bc8aceb58f09dd501bfdb6170220a4ad84ef79c5a4d0e6c1454695f78374e637a1bc8adc3ed60f6be56886531c0ea0284cd03df31a3e6d847bcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\kn.pak

Filesize
1.1MB

MD5
4a2c21c580185086eb504a7b1c2fa9ee

SHA1
b4e447a4d8bb20c6bad05f6187f988bbd3209008

SHA256
11d8fdf7314686cdc344f02797978b97b8664bb4da75b8a3ae71e14adc7b7da0

SHA512
19e7040cd5694495e947c07ea0708061120374746dcda708d8ab74fa837d2c099c2933e73811aad554139944c43ed749391a734442156065ce42859b421ce216

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\ko.pak

Filesize
481KB

MD5
6fdc6e46e33311a8fc2ac6bc5f079a9b

SHA1
9fed5ffa64899c137389d88e3ff8273c6da2d2ab

SHA256
150c66ff7d0dddb84dcb6bec9bcb5c6d41f6601496c277b7bee627cbd8591ce3

SHA512
938c402d63196c430c67086a731626ff83f535c65417a8540801321d1c7257ed66a9ec92397201b9e7cd0efa643c8d38f9c4ace8b4c5ef98c3e5b66cbaf3eb56

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\lt.pak

Filesize
519KB

MD5
49201fae17b715a15fa03c4d89dd2176

SHA1
7c559c174850de48c4a2837fe32c58f74d8150b3

SHA256
4a80792cb9a401ebfa7ec3212182b5024d651ca6a5ead8fc9809d0d3ad4803cd

SHA512
3016f721d77206e13e275e7eea1adc95d403feaccf595eacf933940485031e9aac0c29b6f47a9ff5f73b08c354b7b82c72193c83e1ff09d84cb5b9b72b708166

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\lv.pak

Filesize
516KB

MD5
335158efe454819a0dc8de0edb0f0e90

SHA1
85871f85f626db1fc597ef24c79c84115a66c17e

SHA256
113073cf60ae3d2bcf8a61df655762e34ba28e4b35b97de33c18e13f959d76ff

SHA512
f81733bca3fa65c789630b55c4f414a8541e71c4e1aba56bdb9d231ce189677b3bff4dc57c92fbe1cbc88f1f2f7fbf1a7e4319a8918c50409fcba958d743ccbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\ml.pak

Filesize
1.2MB

MD5
1030c08ffbbe7366ce5b7d55bc8ecc0f

SHA1
b45b53c1e47a0051560c607874357130c499563d

SHA256
e1f97ce3011d9231f23fe033bdbb0905c173921b18402d362bfc35224ff67db7

SHA512
3b9127a0eec02f75f79c66f5f7845b65c4ebe2e6a33989c7686815ffe0651be47d42f55c2f32a67a221495a8bebf043d853df7b244a68f89390044210e52dd3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\mr.pak

Filesize
976KB

MD5
eafb18d633064d0f02a3eff3eff9aadd

SHA1
a8846e473014be80125630f1c5b51366220ff018

SHA256
fcb7c4aeed28ae4d16fa7b82d9571165aab0fdd46eb65d3ab29007231630ccef

SHA512
d332a4b7f4cb1583a5bf5ce08fdb46661a5bccbf0a66f7f5ab6ce04367e9bc589588dcb32f443695a3ab129dc50d2962ed4c138f97858639d4ea37c117e23495

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\ms.pak

Filesize
442KB

MD5
3d0dc94a638f98d9bf3c0f60f89a0c95

SHA1
a979b04c65832d908305fb0406cb0653271ad744

SHA256
a9f9ae23a3bc2ac919c5b46d16b7e1f3bff73698d2626260196210e101d119c2

SHA512
6d687f1eb9a7fda3791295487063393b8f0a7409b55461b185aaf106c596229de6988114230625d6504b869d25d7a624bc3b90d66a0bdf561cb05a57d5b87c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\nb.pak

Filesize
431KB

MD5
9c18dfa9e69c1d7810132800d084136c

SHA1
bbaa9576e1b012df33d79a5dc7776c00e67295e4

SHA256
4f3babcbec0d138654ec59fd8ab5fd58da2273237a587928b9687928c7ca10ff

SHA512
a82b1e340a25a3858906ded73624bd0be4b3ccd1f5728560480b4a4e3a78529f5a178d20cf7d95fd55ded7ca4fa95a5fff87d89f0520ea08b54e7b99c9057d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\nl.pak

Filesize
444KB

MD5
56206c548e686e58a184d73d09a5ee37

SHA1
b7dd27be500644d5be0b5ba580a36c87ba2c912d

SHA256
5c630183661fb984808b3d85c07d3f180cd46c14f24a4f613992ca903995c51b

SHA512
159d1f9309fe781b2000e0a54ecf7803be661193ba6ce3f51c4853aefc205acee9a9d9b663364322ed72010df796c6ba6facc9c5eccf8c922f1ebe197330e5be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\pl.pak

Filesize
497KB

MD5
b44fcf9fdc4ec7bb5e72cae30aa15c01

SHA1
daaae4aa7987bcce299995feea5c54f2d77b61d4

SHA256
7f1a8392fe3aff4e6bb4bacbc1f4b395f08ecafda9f81e36b41b77fb4ab0bc76

SHA512
52b46d7affac4949fa19841d26d2f4bf877e36cbda4b75f3ff289a7abe9a80c2a014b1ae23d3079f4d31ed5fa76c320103733284a2c13d99a451810407325674

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\pt-BR.pak

Filesize
468KB

MD5
a0208192044dbfd3fd15e85b235ce7b9

SHA1
070824915f4d093632ed27e50dd5ca913f23b8ae

SHA256
210082d26b3ea228c87e4711324ad61de91ec9479a197ea95e1340d1785b9cb9

SHA512
41202bd38546fe1e5aed4806082c09198d0b77ff88b851959c411f6834caa5a66105402d4de78975330556cf7edbefb8850c24c4a1162f82f2faae6de9de2687

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\pt-PT.pak

Filesize
469KB

MD5
002d5b37e68a0725dd7d89fe3fc7ec48

SHA1
545de8047d3f89150516b95031965adc8f17df68

SHA256
1fadff356a7e89a8ff2af3ddf84f70fd0ce69525c7787f8adae10beed9d76d4e

SHA512
abad6cbb30a958bb84a521a66636af4221a9f63774122d3ac3b552503930ad83d343ec4c8109c8031cab17c546ef7549aa0f87746e39a80f6758fad28ecee129

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\ro.pak

Filesize
486KB

MD5
7056fc61de4a16c7f4f5bf44d2e87f8a

SHA1
99d16dcb3b1aefc472601439f630e1244b1aa277

SHA256
b7ba9435d82f6bedd7005b6e868ee86f0bb6c4d7b312fe5f5d4afbd440ad5b85

SHA512
529152da39f7ade6713206fa9f767b35b9bf03816387579522eea78ac7d0e150bad557fcdbef51e76d52e39f61a0b4e54ff6a3b592eb7e34fafdb98afe460f7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\ru.pak

Filesize
797KB

MD5
05a0abd1229a65bf64e3eeb36419a1d4

SHA1
15211446a070572404ea0e7e3565ab0697f06c5e

SHA256
b25592ef1c37677d5741a28bedfe143f7b2e17fcd711e62febb0562e2d5b5b3b

SHA512
4585c35313b42bd33c2dc95c19dfb7bed90bb37a4af7da809f5a6c563abaffde566e9245173542ffec009dbf5d7750c10da61ce2d975a5a621ca66a7a33a8ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\sk.pak

Filesize
502KB

MD5
78bc785a75ee512391a9cb462a771c09

SHA1
229d39e017174dc0a8cefcfcc72b0feca94d6208

SHA256
ec15c82956ebddb7b246c78045ad414ed34ca97d890a915070e252c8715096b0

SHA512
96556f6072e69351e1bbce06bbf896b1ad53060c7cbaf7928eebbe0f610f5e8778b2b8b97a5a268b7942a1c8d1adc6bea0403383a2a5bb99049437e95d575ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\sl.pak

Filesize
483KB

MD5
e76e473c419c25768b08a95a2822918f

SHA1
0fa7e2fcabb03a8788f50f1d4b4eb383c833e9ba

SHA256
fcd27a9f5cb4b4be373da7076a8232006ebe020999fdf90d20745f16cd7ef223

SHA512
e39ae0acbb7d148d6ade676d92e83fa9fb433230bae4339c31693a538198bf0679adef51883b96f8dfbcc8593a982544c64a2b265897f35a693183b27070ea5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\sr.pak

Filesize
745KB

MD5
b3e33de5613dd1be10e793301a1adef6

SHA1
b005cbd85aab06a71c127f11c8481fb5ead61f48

SHA256
0539dde5722b86f5cafa4bc97c25ff7a0143a4ca92195b9205e92e35bd10d418

SHA512
677a259870ed4bfdfba198a3a7240068db10ccd9c76bf6ea4d37ca5195d88cf253b595e6d9797b182919429c663b0bad31932b629d0acbd46632070df2ee1802

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\sv.pak

Filesize
433KB

MD5
06c878c1538813e5938d087770058b44

SHA1
c8ab9b516b8470bdee86483151ae76368646bffc

SHA256
90dc45426bc1302aa05261f136881ddf038272e9ac315297aa8e5dae2b31109b

SHA512
6ddf615bcf0a8c62221233687bae1eeda5cfd749aa8acc179d6650987289201b405edd453fc181a1d250eba9bbdf61ea28fb7c694539fae3d320bfdea56665cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\sw.pak

Filesize
456KB

MD5
55241312a3aaba14a6b19a9012ca25b8

SHA1
69fadf0817faec3bc6b018f0af5f63378ade0939

SHA256
722c86bd857a93ae06ca0b7cfe2cc04237a7ed5a52586cab7246336c802abe37

SHA512
612f815c25e9f593d1f1c4de8e9016dce048cfe90f21319c4cdbb5772580cb8c71229e9ddba60852cd0bec80a07a783ace24f873d90dc3323e5fdcc44905f2c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\ta.pak

Filesize
1.2MB

MD5
2c0a9cc4a7c775ff13a6888234265cab

SHA1
497bde42737667fc833bbb9d8a9edaf014d99957

SHA256
1dd55659ef21082b9d58bed50f387c0e1fc0f28d0ede52251b9ada25ed2a657f

SHA512
b862221cf17d3f2ca0495a8a3e1f630ab915fd9b2a46ac16c71deffee9a6f71264a8550233781474d60cc6001a48c7c658c77d4e0dbd5b543e768928119d2f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\te.pak

Filesize
1.1MB

MD5
cc9c500352ac2719fb1db1f6d5b10a17

SHA1
6186e5a9908d12468d9b40321975bc72b295f726

SHA256
4317451f07d3d668bbbbb642076e58c42c978e688bac865a04ac90b3981204d5

SHA512
29d31ad26efb591ad73a421a41f86a820a1b944d964da61af7c87708a02436863448e6f297e057cfa8dbe5de1a42119e37df21e0e8478ad8343af3d546019397

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\th.pak

Filesize
918KB

MD5
6e18856a34a98f71f4566d991b113fb9

SHA1
fc993bf63f55eece6bd9504b667f43188e381dc9

SHA256
e5dd778ad3cdef1bae293192bf7cde1423f37aa6c9529c3d6308a16799158414

SHA512
7ba1e0a9c4daa7211c2b60601d0db72ce740986d6f92649b3b99c7b516c6799eafb0dd93a96dfa1271f49f64899dd156711a65f91ff1dbba04723986974f2a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\tr.pak

Filesize
465KB

MD5
f47e92a8f9c35eb5884bdec4362bd86f

SHA1
2ced463ff400ae7b8d63097cc121e6dd04678391

SHA256
be5a3224592a4ae0b5e80277486e3bb7ffcd1f5e5552a706b449622e31f85577

SHA512
843d3999de123a3337c9c63ea5169e1965783108da66966217297eda7f57586b977668186f3d76ee256d5ce4aafcffe8b4cb1eaea20ea842a778cc6d93e6accd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\uk.pak

Filesize
798KB

MD5
294716cc45bcef706df86b63528d8bb2

SHA1
04c79310b68cf51f3eeb126a1d585065d3434ecf

SHA256
af9f638e8ca464f0b2e706200e90ebd6d70f08e378ff4004693606c91aa15d7a

SHA512
cd382e3abadf1266debc8c828ad792d7a1fce1227a405f3c8a68c27b0c689a825d2f4be75f53d9b50f670b6807bb30aa64e1d551764e7fb36233c1c20a1aee22

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\ur.pak

Filesize
696KB

MD5
88eef2798dee8a361c3ea9bafaa02a35

SHA1
6f8d4ce422336ca5048ef35d6ece360a9b416d8a

SHA256
91318006c880e427417a2b2fff81fd451769a5536fa16d1dc185972137bc2d6a

SHA512
db36b58186f165ff3f746ac483f75b6fed596fad9b3f335e86b374b359e563407acf58ac7cded9420e4fcb91f31eebc8a91c7777ea59bafced8cff2f1c0e9a53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\vi.pak

Filesize
551KB

MD5
65e0407c26140b0c19efa105dc99384e

SHA1
94e8d9ac6d24cd829fe8ff25bedaa51582e50fe0

SHA256
0c2593a21f021128f7882869014f3b6959322531d91af7322c3ea9177c79c90f

SHA512
5802cb5e159d0f427ba738aea93ec192fbe5d2f7a2299ecccdf25e6b41bcfe38656cdc63137119b556a2b00eb021249dc0440344f9174ddeba34c8cc0603ea03

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\zh-CN.pak

Filesize
398KB

MD5
9c63b6c013bb23b775fabe566b37ba99

SHA1
f624c7a16b1ece6bf84cac751a1b47d8dd719df7

SHA256
2d8e543fcf93127f6cbf38f93c15734c47073e9cd118982bc4de1fdc6751b3b2

SHA512
39f564e19747050974a174333f6ab082900680526c66b57f4fe9a71ed110c16f4c8457f2e30b05d6698cb72e6dd1685bf62528676d720a3dd37724a38c98f129

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\locales\zh-TW.pak

Filesize
394KB

MD5
af1a09d373265b5e0c703a39c6f77969

SHA1
47fc3d3fe9d574f34e1559083732868bb799bcf0

SHA256
1f73e98ee70a660250cfb138a30b5a263ee0de756c7e35f054a50a5745e16d84

SHA512
f144819055b46288d9827d1b29780135e8a54e94b4736e79db4967898656b8c505e992e7d37bd3c718855651186c78677076498f22862df32ea3fa57fb3f985f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\resources.pak

Filesize
5.2MB

MD5
7ed62954e54c9107ca736da7a96cb71b

SHA1
f45fe2247522c63f2be16a86490acd6b953cb409

SHA256
9cd900682719567c530bd445d104bd1c35f9d5b49b0c12ff508a480e41014302

SHA512
d0e6f4ca7a9517efee0b6aacf8d4297e6705c3e97f61e77f3a06b97947fba0531a993197a43833979632828572f01163fced834525549e6355463e84fb6ffbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\resources\app.asar

Filesize
103.1MB

MD5
c08fb94d286a8292f3bb0e070897288b

SHA1
6d089d92a308f27870f7053ba6652ebd1bd05f30

SHA256
7b0179a506bb7347f1d5de292e909a3ef0ae3c0eb1a6dae558641e703cb06240

SHA512
26c8cda327117971f42c289c64b91ad8c4ce84c8452f3bfd7f2c8e5fd964f956d52eb6ca7edc8e7a133ac6f2bd9909b42485884f49d6c312ea316a60146e6723

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\snapshot_blob.bin

Filesize
262KB

MD5
f5728714ef38de4cae18073fa7cebfa1

SHA1
d7b2dfd265b7a8cfb5bda52dc9c82e47d175c6ea

SHA256
0edad7da3563fa7d88a3e852f8b69e0187355afb1092a85b67014386a944fbda

SHA512
d35c41d3b6eba6646b29991d5fa4570e6bfb1a3235fb88e0a6d640ddb6d393e4b9d36df2759adafb539c644ab9c90aa392f70bb151435331a6bac5060f10ae08

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\v8_context_snapshot.bin

Filesize
570KB

MD5
db31aceddf59ff965d89ba5273f19750

SHA1
1bd4466a97976ea39cc2faf73acd8f4d2ffafbca

SHA256
f1c4b23e81cfa31cadde7e3abd1523d6e0d44c2bbfead1841af2f78aed03bdb9

SHA512
3b383d6b7aaceb9e40d80e6d986a5fa25da75f0d0f4943b7917f4219625dbf070bc73b27ccd6d7c99d4a2b6b3b33edd5df4316a235b6905486303bb778e5c9a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\vk_swiftshader.dll

Filesize
4.9MB

MD5
cd3dbbffdfa8f81b04dde1a25418506a

SHA1
493f1af39585cbd3578ed3fab79b8db1df4ec410

SHA256
2e2250963c36bb9265c256ae43123cac60e1937b039567be4e102d82bdb797c3

SHA512
05a10c823043661c6a1a91793bbab7a89d570cdc52962e4d2c86b783cecb0a3285aed145d6f49d622a7a069c76d1907f614f3e8b6f4fd003cd770c751f7a0709

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\7z-out\vulkan-1.dll

Filesize
939KB

MD5
dc4f707ade914fd29870a699afb8fe6f

SHA1
3fde7243baa39b7b4ac3fa17af0042154e7d405e

SHA256
29884f85084a7b9470c9db1e3f894d28b90407a8ee45bd05bbe54df78ddab303

SHA512
1caa6b4ea73120d6a66bd6f5bb9bc537060630a6f66f0096922d62a7932e1b4ff7a4b73bf3e7f0a3a0e38ca43c4e1a720f5a8c526088d06dfd9b155fb1017d3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz906A.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\PDFunk\Cache\Cache_Data\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\PDFunk\Cache\Cache_Data\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Roaming\PDFunk\Cache\Cache_Data\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\PDFunk\Cache\Cache_Data\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\PDFunk\Network\Network Persistent State

Filesize
300B

MD5
cc1e7b47ca6c3d4abafc53eed690b1af

SHA1
09ea3035fc97c3d857c7a3e3aeb54a83420da21b

SHA256
de2d8ae6555168c45c991b82a1076804f83cd400a7d5035fe011d2be6cb5a5e7

SHA512
83bb2b00d1651c0af09824ef719dd250536977677879643e56966e2701692a74e07abdc1c79ece35406ec3d4153475360d47214b83482ef01ea05378baf5f13c

Download Submit
C:\Users\Admin\AppData\Roaming\PDFunk\Network\Network Persistent State~RFe5b7730.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\PDFunk\Network\TransportSecurity

Filesize
188B

MD5
e7d17d8d4f0e60cc33fedb65feeb012b

SHA1
edc712e89f5032825478e0b129c024fe16b2d3c5

SHA256
8f8972c34d23bfe8a50dc328c349a68822ccc439b407056936e91409563d044c

SHA512
9c8670d860b785b517464f9dd5351c025e8769ab516bd8ccd763a96fb727189cf20a72dcfccb61844196a861222c66e03a752ee279853c3922ac440218abda93

Download Submit
C:\Users\Admin\AppData\Roaming\PDFunk\Network\TransportSecurity~RFe5b8fc9.TMP

Filesize
188B

MD5
872b8ba8dc2c24601ad1bee2c7bfedf0

SHA1
6d08b03c79585604e4b27f29f3b11a4b1f94a1cd

SHA256
a7f3928d7603015443136ade99e1414d49306bd1acba8b7e767680cf8cddbd4a

SHA512
552181e032df0f97bbc06f7d962ee722ac08c6ffe4b7cf9df463c2d04bb405fd8fe28b3a25ad8cfbc948b77f37291c890ebbd307a80b0b9c635a31d19e0e5f2a

Download Submit
C:\Users\Admin\AppData\Roaming\PDFunk\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
memory/3540-844-0x000001FDDF090000-0x000001FDDF13D000-memory.dmp

Filesize
692KB

Download
memory/3540-843-0x000001FDDF820000-0x000001FDDFF5F000-memory.dmp

Filesize
7.2MB

Download
memory/4520-900-0x000002CF24E10000-0x000002CF24E11000-memory.dmp

Filesize
4KB

Download
memory/4520-901-0x000002CF24E10000-0x000002CF24E11000-memory.dmp

Filesize
4KB

Download
memory/4520-906-0x000002CF24E10000-0x000002CF24E11000-memory.dmp

Filesize
4KB

Download
memory/4520-904-0x000002CF24E10000-0x000002CF24E11000-memory.dmp

Filesize
4KB

Download
memory/4520-894-0x000002CF24E10000-0x000002CF24E11000-memory.dmp

Filesize
4KB

Download
memory/4520-895-0x000002CF24E10000-0x000002CF24E11000-memory.dmp

Filesize
4KB

Download
memory/4520-896-0x000002CF24E10000-0x000002CF24E11000-memory.dmp

Filesize
4KB

Download
memory/4520-905-0x000002CF24E10000-0x000002CF24E11000-memory.dmp

Filesize
4KB

Download
memory/4520-902-0x000002CF24E10000-0x000002CF24E11000-memory.dmp

Filesize
4KB

Download
memory/4520-903-0x000002CF24E10000-0x000002CF24E11000-memory.dmp

Filesize
4KB

Download
memory/4820-839-0x0000026FEE2C0000-0x0000026FEE36D000-memory.dmp

Filesize
692KB

Download
memory/4820-838-0x0000026FEDB80000-0x0000026FEE2BF000-memory.dmp

Filesize
7.2MB

Download
memory/4820-796-0x00007FF9BB1A0000-0x00007FF9BB1A1000-memory.dmp

Filesize
4KB

Download
memory/4820-795-0x00007FF9BAA20000-0x00007FF9BAA21000-memory.dmp

Filesize
4KB

Download