Analysis

  • max time kernel
    203s
  • max time network
    200s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-01-2024 14:47

General

  • Target

    nvim-win64.msi

  • Size

    40.5MB

  • MD5

    460beecd80d3207814ae27f57b71bc08

  • SHA1

    f6f2f0c6f86967690b433aa8a5a72636c0e1ffc0

  • SHA256

    006b8578f0b6717bc5a987f12bc0746c61c20e6ba777fde6d4aa53ee54b937cd

  • SHA512

    06548d2fe22d330e32ec0463848d4e9550148565a63656b91fc35fec94ecdfa8631e5c1ff47b9afab20fa7a7bf4c0ffa3f44eadc32b7f251d13fb84234bded7c

  • SSDEEP

    786432:MBEnLMhcai1lT0CY+LdZ4/i9m/X+etaxnlOKuxB6:CSEa1loCBiiM/VvB6

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 26 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\nvim-win64.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:5020
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6A5BB417F8EFCF7A05BD2F81DD6FDDE9 C
      2⤵
      • Loads dropped DLL
      PID:1412
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4684
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4472
    • C:\Program Files\Neovim\bin\nvim-qt.exe
      "C:\Program Files\Neovim\bin\nvim-qt.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Program Files\Neovim\bin\nvim.exe
        nvim --embed --cmd "let &rtp.=',C:/Program Files/Neovim/bin/../share/nvim-qt/runtime'" --cmd "set termguicolors"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4460

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e599a53.rbs

      Filesize

      324KB

      MD5

      dd000432aafc932d55c31d06cb6dd964

      SHA1

      3fe22decaf7a35ef6ac07e9dcf91c897a352c8f9

      SHA256

      d66fff3fc065cac307234719d259b8cfcb6bc9ce2f0867eb88c398edfb62b7f4

      SHA512

      824155f49a5da7871047da2b671a12cc88100817cc558c7817a73dbbf26265cd72f963309705d0196684bc87c238594d70c3ddcae319673a48ca4eda31277329

    • C:\Program Files\Neovim\bin\Qt5Core.dll

      Filesize

      904KB

      MD5

      b3f5a63ddd2239365cb4da6824f486c2

      SHA1

      0489ce105e16550457527de5bc823bd99d00b723

      SHA256

      4394a4affc26cec1290e6808a52a875b7f9488ce5978ddc3e8fb8752610d5f5a

      SHA512

      48095ffd806ed9006dd5534fc50cb46622eb71b5d6393f9a2fcea06c47815b0278716d40def6c06442426849ad83e71a83d4b94aa9ecf9285a38792b3615677d

    • C:\Program Files\Neovim\bin\Qt5Core.dll

      Filesize

      880KB

      MD5

      c4c3d0268088f2ccf4f25378e121aa58

      SHA1

      3560c2180eb3de69c59a7f37f0fddf72ad834916

      SHA256

      32135d8b25b89239dc8a6cb0a9c7e7695178649dde52d9e242d941f5f5d55807

      SHA512

      668a14fc58d8cbba5dc2c263924f265cb0a98ce3d85fdc0044f494b4ad5162675d97ce3b5dbb4ea95ac89d010d1d028c04a040fea2763834e56c71dc19e213ce

    • C:\Program Files\Neovim\bin\Qt5Gui.dll

      Filesize

      675KB

      MD5

      905083b663099443378718781270607d

      SHA1

      7e166335a3a8108bb81675f85775ad94a86bf4f6

      SHA256

      44d9465f12f68b17ffb5bd4f6d1eb736b7b52323500d3c2eb0db825f1a18d99b

      SHA512

      a33819ec527ce30fbde8258b2a69dba655fd10c38cc86fa239a1fb35019f28e3305fd55b02aef700955f481814bf54adf8181a2ae065ba741964d33b6c677f50

    • C:\Program Files\Neovim\bin\Qt5Gui.dll

      Filesize

      881KB

      MD5

      55b2a149f13e69b0e6d53be7c23d9fb0

      SHA1

      d1c9ea788486644a2b48c9316b9e6baf613737d7

      SHA256

      884435d55464575d91673996853967268347a9fe4bd7ae414672de8114a73e51

      SHA512

      c33ec190817806e6333afe939968421495f7934bcf5751906ebc5ca335eb8881f4f7b48b5bca48d5b397e9543a23c5ab052167e305e65070db435d319406579d

    • C:\Program Files\Neovim\bin\Qt5Network.dll

      Filesize

      524KB

      MD5

      60ef446ab8c03062daf5d97347430b68

      SHA1

      6cca6309c76c8d0328595654fb8c3dbe13ace558

      SHA256

      c85e87b97d13d1113c5aebfb83f84b7db7e1ba6781bdc94e4d3966113ea1d311

      SHA512

      71251399e796222d4c475dfeea9be19846e6a30618d6d74a0ea96a8c3e800358533527df60dfa3c5009454851b7fb43c85bc9dd0a1885c09921038fb10abbdcc

    • C:\Program Files\Neovim\bin\Qt5Network.dll

      Filesize

      516KB

      MD5

      d4920bde15e886925c6d4675800f0486

      SHA1

      e387585ba16cdb7c4e39077958057abdf04dff88

      SHA256

      b20cb695e8f76a6ff1dd7857556f055ce6f37beba6c111a66fe4894a88419755

      SHA512

      3f1809ecde5d151f946a10b9bfb59c9df4a9d551ac272c6bddc3faff2c4e3c220e87bbee5da25adcb97aa4b8f8ebbee6db485d97d6f0750fffa24fdb188d5d88

    • C:\Program Files\Neovim\bin\Qt5Svg.dll

      Filesize

      452KB

      MD5

      e5691ea5a17202177b0303b4659013a0

      SHA1

      d325feb88163e138c69b96f91377e9c6d227901b

      SHA256

      0d0b9c90983f1f39868db14e7769c8ebdd3ad2b32b0258579a11b4ce40ac7664

      SHA512

      cc06147d8135b170c02cf014aea9cf75091817b7af12b0abb80d478c968769b12cec2a4ba033e9fdba0f648ed08f2e17cb98bac39eade42ab95aaad21f14dec8

    • C:\Program Files\Neovim\bin\Qt5Svg.dll

      Filesize

      566KB

      MD5

      7b80103c5e287dc427a6e9435ab05f35

      SHA1

      272f90165ff6d440e2d4ce21f69eeb44ac8a5c9b

      SHA256

      25ad9cf13bbef3b7f7f99c8effc25aedd20dcf8b2455e4b685ebb27d510f9ecc

      SHA512

      522037c7aa50cbf122d1e11e1b0284afe7b7f77dc6f1fafd89d803816e8ab92a98b8f9a14c2cca45bcc475405f4b6c89ba9da3973572982a903d38fd6bfff2cd

    • C:\Program Files\Neovim\bin\Qt5Widgets.dll

      Filesize

      479KB

      MD5

      e0c18af1e399c7f3330ff54d4d7b4b97

      SHA1

      6325fb49310c6ad377a85f9b6f7eeb972f433ca5

      SHA256

      2b5eff51cf1b9bc8796dc89c1354999c725f36bbd7fab6e56ff6e3343a9189a3

      SHA512

      ab20f81afc7ce07e66651303dc77708710a9fc06ceaec3aede1d178b24a12617defdf0b9df7e3c6e8b6f074d68b0dbd8e3f6299737d2f6249706ea51813f9b9c

    • C:\Program Files\Neovim\bin\Qt5Widgets.dll

      Filesize

      328KB

      MD5

      d4c20d7a78c84ef5945df996d419ac89

      SHA1

      29adcbe1d922ddbe3972bbd6f9668b360472f737

      SHA256

      28cb7b4b4b358081249277f7579f2ecaec4991b562abe667c85d1e9415dfddb5

      SHA512

      5efed3e792e58fc8c9c89ec9cfbf5068eed6d4bee817cf1bec0e0e2692b7aae655602e25e2de411795111286833c8417b21367d3fd93b47f9c6a63638c65da27

    • C:\Program Files\Neovim\bin\Qt5Widgets.dll

      Filesize

      366KB

      MD5

      4223c0c79c6df9eeaf22690724cbbbe3

      SHA1

      7563e2290d8284c720ba404731597d7e98873a69

      SHA256

      5ab2ca557d94760d20da01954228409c00f2911043fe094d39add3b766c31fa4

      SHA512

      367a2069ff583b56e86505472a3a0d5ac350508fa1ab1c873da79dfd4bb0679c0d0d3f8286aadc34dd585c1d23935a35ce6f5404b92eddd8b80ca4604063d296

    • C:\Program Files\Neovim\bin\dbghelp.dll

      Filesize

      269KB

      MD5

      351aa8c90c6258eb6661fb86ffddf4c3

      SHA1

      2122915db8f02afce89ac87ba1f4d927f1df9968

      SHA256

      712f1dc869bf02028df5c4e884ccbe948d4a6f8eebbb7805efeca3111b1ed4fa

      SHA512

      725be457aa2a4dd0ce2b96deb7a897906f10939622b899f5819e1e72280267fe9cd71383481a3fc9d7b9c312e6cacb061ba39fe12786e84842c029aa9aa5d70a

    • C:\Program Files\Neovim\bin\iconengines\qsvgicon.dll

      Filesize

      97KB

      MD5

      4f717969032d4cb764a58a88b69c9389

      SHA1

      2125a9b44e5fbd5c30d2a1704e9546dccfb5edb5

      SHA256

      e458a825d98be0c0a60e8fa50ded20d21f36a84141ba78422466611a6f790968

      SHA512

      bd4d40c7d6791ac243c75aa1e529e6264fd8a7b33cbfc7970989d49bb040a8e33b8a0b1f40ea2cea77c6dcc24f155c2a30e4c809aaf7d1e13e931f83fa189eda

    • C:\Program Files\Neovim\bin\imageformats\qgif.dll

      Filesize

      78KB

      MD5

      6643793ba0c0d45dd5cccde0a5b25d33

      SHA1

      92cc3a8febb2178e90da189ba8a1bd2bd7732ea2

      SHA256

      d50521b169a6326aef57437e6e51efd4bfad298f958cf51b778a5990c3311a68

      SHA512

      5dd99c63ed9b915e2678195be7815e7abc2f2b1f71441679810be215b840d28830c230ceb56f67ffc3c1d4a2067971e31e6a861563396990447a5130d841e543

    • C:\Program Files\Neovim\bin\imageformats\qicns.dll

      Filesize

      97KB

      MD5

      6cad5fde4760196bef345ba4aaf8b921

      SHA1

      ed2fd0a2166ade2d7debbf3db9342a471c7f9fc9

      SHA256

      497013b978978761e372779d724232a1874f0c00624e83dd66bc30915c672f4e

      SHA512

      8b30fcbf1b4393ee258716e8c37a4c5b63b4707987664799f3b9d14cb779d7ffece1efdca0fa6cc01d5d8697782a9a6e76b7b8a284c8b4d0cd4e0cc8591f1167

    • C:\Program Files\Neovim\bin\imageformats\qico.dll

      Filesize

      81KB

      MD5

      7da403414b84b57eaee35fef9a907152

      SHA1

      19dab25959851e5c5876131ae6479e2809ac51eb

      SHA256

      a721b24ca1fa0187891ec899a8a0e969e4e2c3a7d1d01edc97ceffea9e379026

      SHA512

      2b1037bff4e07e3f91a52140770f755e03f54204d91d0a81ebad472aaae73ad5b20d450de5a9748434a7d1727046bb1a0342608c578377b02854364a3f2ef1fa

    • C:\Program Files\Neovim\bin\imageformats\qjpeg.dll

      Filesize

      297KB

      MD5

      654ea2a17a378c592f87c6a74895a0cc

      SHA1

      8615912c399820c940af91e18d8ad9991bdfc136

      SHA256

      bb23c5eac5fedef4662e71f842fc0b63acffe175fa5cf6213d07efa7810264b6

      SHA512

      7cd41bff410d2d2e51768856dc6e59f1bf4f8972d7a3e506f7bcee181c6ae4d9c174fe62a2e912739f38da90ff0256ce7c370b60f1b7a0dddfad8ff67b178cdb

    • C:\Program Files\Neovim\bin\imageformats\qjpeg.dll

      Filesize

      177KB

      MD5

      7c48bbcf5280d0827f99fbd40b93f6f7

      SHA1

      aea8675f859a4f931a5d79e05cd9fca6a3c3ff87

      SHA256

      f7e9e43575777a1b047fba890d966e83f4f51fdb08eaf1642ce2e94d781b8308

      SHA512

      a6e4cfc8fe8d18549f1c97f67ba13123d39f450522a92d494fd4a82018e635c9aa626cbda7af566cf11ecd39379b11a4088610eaeefb33b328bca3932dc8d3be

    • C:\Program Files\Neovim\bin\imageformats\qsvg.dll

      Filesize

      74KB

      MD5

      0cf17da428a03ff8825abca5405da38a

      SHA1

      ba397600e84587c4dec0bdcaa4b645dac2bfb42c

      SHA256

      eb6861b1577f7ebc210a8120198c199e24b666f79b67b28f64aaeb77331378ad

      SHA512

      fc04d23e3809808f337790ad62570237f4fc6d87802e6fbce9a49d8bc973165e13b3311feb8803f1c12241d56ca7073928006d70a945024be9d10b5c50bf8575

    • C:\Program Files\Neovim\bin\imageformats\qtga.dll

      Filesize

      72KB

      MD5

      86ee3c496d61bfc93bbad3c1234d8710

      SHA1

      aa355bc436c4aa4a97fd0b5988300580c0269904

      SHA256

      b70dc43d84d08222b7175a2a5e2452db95f3ebecf0dedf4485ae087acaa76f74

      SHA512

      edf2a141f71dd95e728cc4c5c5855779ab20aa1d74e7d29c3d545158fb4c958ba084b2a7755818d119675cd7b482af85480526e3cbdd802715497ade5f975fbc

    • C:\Program Files\Neovim\bin\imageformats\qtiff.dll

      Filesize

      300KB

      MD5

      393a44a8b9fd63c614ed5c85f5680e49

      SHA1

      2f10d75e28d5c01d17c960ad8c4ecfff3e3594c1

      SHA256

      3d150b9092a922758fdbe8a04ebc734c2c8c8b16666b5b3cc37ebc886c02aee4

      SHA512

      866743792f58c34c0bdcc97c43a92422ea712266143479007a915502ac1d50a52d84f5f0da4da57a46c75fd37b2ed7f6877f9b57e461ef9a15928e91de5a23c7

    • C:\Program Files\Neovim\bin\imageformats\qtiff.dll

      Filesize

      229KB

      MD5

      2a8f469f3de2b0cb60873590363d74d6

      SHA1

      7b750912a7e0f075107a71712135b5c125170902

      SHA256

      d1bbbac2e719dc09ae2009e7da5cfe0ded0d5e73b0e67ff4c8b72c276e435819

      SHA512

      97d5a0c91b11fc8f11d1fa8e310fc76d10826df7cbb94e48d01d8bc510d0a9250242301b449841312d0b6f7e597ad3984ec68169a4a8b1fd8cc275d24b88902b

    • C:\Program Files\Neovim\bin\imageformats\qwbmp.dll

      Filesize

      69KB

      MD5

      226ac86d3401242f3ef518adbaacb4e7

      SHA1

      1a02cdec82469b96edbd3569668cee41b5c7bb00

      SHA256

      de00e10787fcab379b14eccaa1dddf508a93dc05b94a35bacc71e6a3781f686d

      SHA512

      8cd7b1975bab9bfe0e0bc37c85d8422940717df8be4009c883d6b66e7f7fa541191445d88873505cc6004eddbb2598ab61de5a635a30306a1ecf71bd4c9dec53

    • C:\Program Files\Neovim\bin\imageformats\qwebp.dll

      Filesize

      334KB

      MD5

      a2332f55f07ad32cc8a1fc75dafdaf86

      SHA1

      840cd769cd899bc1bfd6a545c716b8c6a798b66e

      SHA256

      bd766bd540556669de959494aafc79b846d84cdef79e6be6c8aeaf480b54ee4a

      SHA512

      7f883d9b451ab547534711d8bd7de4a28dd92dd882addc4438c6b10f31059e798f66f9be7c2bedeae1b229fa2fc9365efe8ba6aa36e9d4d563abe4682a8028b2

    • C:\Program Files\Neovim\bin\imageformats\qwebp.dll

      Filesize

      213KB

      MD5

      913892b1584a1d51d6c4b5930077cf43

      SHA1

      101ffd39683002fa5b0672f3dd14c07e3303df73

      SHA256

      a32a8876aa46a333e089fc0c3c3dc77cc5ddad5db734213bbc5947d21978cce5

      SHA512

      d839daac0d8491b8c42c2e4c48d6a95306af7b5b593b021c311cf6cebc8b967f4b42dbf2a4a1bbe5dd45aa87dd8b46b0041cb716907e2d222e86412754c94d14

    • C:\Program Files\Neovim\bin\libgcc_s_seh-1.dll

      Filesize

      74KB

      MD5

      534b365361004828059600f05b34006d

      SHA1

      d8ff411b0939a021f47c845c6a90f1240bab5268

      SHA256

      438ae82ffd621a2413199155574cc85681f8986f05420b1485aa4be936c3bc0b

      SHA512

      1ccb3732a82f2fedca85c27afdd48e65dde70d5b1620e436d457624a2cb796887c5e7dc2983a0794ebbbcade3e5b9f9fc9320b390894471993c7b1e85268592d

    • C:\Program Files\Neovim\bin\libstdc++-6.dll

      Filesize

      284KB

      MD5

      6232423fe3802eaa87c58fdf951cf763

      SHA1

      2ff4ebc26f38d1e8a22c5d2784d6da0e3c88de8c

      SHA256

      f986c31a28103f989cef4b2b943dbe360066fef026b0e3b12a9a10379496c716

      SHA512

      4542d8c8daccce4615c726856d816d3b3f44cff02358214ed780e7dab461e28d53ae08ba57fb27567631fefb1d782d5690fea8486679667467fda10ddbfa3329

    • C:\Program Files\Neovim\bin\libstdc++-6.dll

      Filesize

      340KB

      MD5

      126be5c57d3f6141774f0dcdb6ed4e8f

      SHA1

      fc4f8a56da892453352abe8e2f9299b6119080d7

      SHA256

      7e7893e7e0b564e4fcf90c09bb2e54df029f19d8c80da5a3af8d04c3e4bb4906

      SHA512

      2e3490ce234fb837464579698264f821ac3a55a3e77885ea336cc3c839de63d4c7efc7f0844f01e939a1d58b82243a9da5053e33d535bf510abe51457b9b1963

    • C:\Program Files\Neovim\bin\libstdc++-6.dll

      Filesize

      320KB

      MD5

      b4d69ced454d995ec8b875e24d6e3d21

      SHA1

      63ed022b415d20a6f219a2252e91df49612912b0

      SHA256

      c631d4e86487eb94a599d5c3ad6a3131ac32b3a43845a2aa74b9e0ff09d3153e

      SHA512

      2050df04f24ee22a919d32644d93929bac515ca281e41a7dcf99c1744ed5a26abf94bf3a1c615d3a47d59d6f6a50de1b71613d2ac99cc130b70aefbcf6e9cfeb

    • C:\Program Files\Neovim\bin\libwinpthread-1.dll

      Filesize

      51KB

      MD5

      db18b7ec5f93127e6099744ea9568c1b

      SHA1

      e9143c76e308a816837e2f1a19dd0c5e2306ed08

      SHA256

      5bbef249a0d00e2d32c699d0bbe89f714ebeb872b3990a5cbeccb1d89f63e5e8

      SHA512

      ee1e645bed0bc3ad9e959d6342153e608ad21a7f5aef60b4cd8cc96fde7aeec4bbbb7474b59cab8ced8f28dc9f66cab32f4825333c891524901dcc40e70a1580

    • C:\Program Files\Neovim\bin\lua51.dll

      Filesize

      169KB

      MD5

      5c38466e4aa1c038c4397b3fbe6d78a3

      SHA1

      2064ff400d686f16b1f583c7527cb771018b0834

      SHA256

      c02f328f510d62883ff59165262d64953142a12b3dd48febdf12f6a68a9708b6

      SHA512

      322144950e7e14990277265a04a310620938830c05b72dba0b042df08d12b0d1d47805033b7e52d42e74ab55fd46c4e8054832fb06a9dda5f276f4e15758a214

    • C:\Program Files\Neovim\bin\lua51.dll

      Filesize

      107KB

      MD5

      762da1a21eb03a1964535a1066dcb2f0

      SHA1

      2e3f3dae771ed31b5834de8657a12cb216977965

      SHA256

      3d69a5f190d892210bdffd6519b41b62110830a59b2e4f0534eec13a7f28d7ee

      SHA512

      151f7e5920f0f91637ee68db5f2f725426b8b096f192062a0efaccb9b7e6e3165559476d5f6ff134c2c18921217d8d58fd26b0ca5bd44c3c9f7ce8203bee6c01

    • C:\Program Files\Neovim\bin\nvim-qt.exe

      Filesize

      2.2MB

      MD5

      0f39e0aa57a4d1abf58a0c7b57548d88

      SHA1

      08ed23b5f46f5126f97417f598edebb3a854360a

      SHA256

      ce1e586850b422e4b32658afabdd9c92bad2a181365cf863b42df0934153ecac

      SHA512

      02e3ec203e6c35365f17fe2018aa67e586e0bfca30adc9aa62c686c8e214190fa5e9f5e53425562d4c5ea6d3f82c812597bc73af17e29567dc0b8f61637851b3

    • C:\Program Files\Neovim\bin\nvim-qt.exe

      Filesize

      597KB

      MD5

      77a625452c531675fa74586fca2bf696

      SHA1

      bf8b91e6fc58d078601d6684c2e0e0a606b5940a

      SHA256

      d33c256629433f1da623065bb239fdc13ac1fc96d1929355468b4de7646044a2

      SHA512

      89510ed93e9a0f80449ad15929e861dd1396e10f152bbbe17b98d63664cd5e7ca63b6b9e228f4789cc2fc2c838ad133ceb1fc46c7695b8bee93a7becbfa296d9

    • C:\Program Files\Neovim\bin\nvim-qt.exe

      Filesize

      568KB

      MD5

      c9f19d2ac04b3d662580fa976a8eb5e0

      SHA1

      7e777440f5b5439325c3045e648c95a8f1e403aa

      SHA256

      b2395121f2b0bdf78e36afec98746b4251bbce2586886cfc5e4b305819a55641

      SHA512

      25938fd7693d140275d7ebedaccfe89cb7c964c26efe5a71f9a1bf1a038273e4be5a8cd56f2ec08560af1c9870c050a910db3e8f4f7bf0c0500e4b86687cc4f8

    • C:\Program Files\Neovim\bin\nvim.exe

      Filesize

      325KB

      MD5

      daaf206b149e7660e92db8154ef2b995

      SHA1

      51301d39aa7abe9620b620593a83478ebc5ea67c

      SHA256

      36a035bf55f4fef9955b4d73a8d63ad80b63de748801b611dec48bf2556ac8dd

      SHA512

      48b0b00344a229e448d29061ba4ecf9b9d84232ce27f48125d3539616bf3c60c7bf3338fae53a6ff76fad8fc6f1f3981f498e3e7ae1f7a2d4fe596d204fcf619

    • C:\Program Files\Neovim\bin\nvim.exe

      Filesize

      265KB

      MD5

      ecc808fe6e8730d01f8689298a8f73ee

      SHA1

      0f98958561e0a1900dbfd288f529c0eebb2fd6e2

      SHA256

      e262b4241c0646227639f0d187b49b4d95cb24c33680d68405ca88be291a7911

      SHA512

      d06ff670b301bf4dd562e4e1085152822c2beea2ed6d5abf1e3dba39774ddbe36ac0c1f014786b685224845a4d63944e61211ba60ce175effaf9582e088ba511

    • C:\Program Files\Neovim\bin\platforms\qwindows.dll

      Filesize

      471KB

      MD5

      acefced3e6196a849e7e84d122e80723

      SHA1

      b5241c34a7dd617aefee397da210793c1f5ab8d9

      SHA256

      10ecd00b242623da996aed9e391f1efed717596b246d0dd3d16a6d9a8883e6b9

      SHA512

      d0baecf666cc091e90e2a42f6c3172eb982c12926084d40797734477e1f21243e770d0714d50b3821a0073adf756ccdfc5489d1d63e518397f80f22bea5bbf76

    • C:\Program Files\Neovim\bin\platforms\qwindows.dll

      Filesize

      389KB

      MD5

      efdce4969462bad9ea814a1e3525531c

      SHA1

      a679109d6613a5475450683106afbab728010297

      SHA256

      9952bf69ff4cb8ea1270a88a85aa5866a8f0f9c3e5502edb22f940bd658e532a

      SHA512

      d84aeb0aed645f4d45fbea0f674da42736c6f26bc98b143cec55cc1be9df2821a50399d5d403bc095f24b53092d9cae77a76380e4e893ebb839f1e22a201f33a

    • C:\Program Files\Neovim\bin\styles\qwindowsvistastyle.dll

      Filesize

      307KB

      MD5

      feb4726f427184278dc3f5cf001429df

      SHA1

      d0a94a60a0c2b0c9db468aa491930b207a62f5b8

      SHA256

      1622ebfa4b5430ced830fd447b20e1618059507b642babb4aa55f02550eafae2

      SHA512

      11f56bb75830ec1fc2dad42103a25aebe29dc61fdc137e17e6e81147b2feb7556278fa1146ffa987ece669261576dc1a78bec26edb9202172168cfbccccc50e2

    • C:\Program Files\Neovim\share\nvim\runtime\filetype.lua

      Filesize

      1KB

      MD5

      a085c2e8fa74457c5ced7d5a5bf821ad

      SHA1

      8d746fe4731b00918ce7673cad1b74471bea5b57

      SHA256

      9978caec98b4f72ffd5d48a9c21b4e4bbd1f68e159077186d5e39eb566fd35b0

      SHA512

      9db64b3c38bc4011464d0fa0a574bddf808ecd45bf6eb83569589d5acbdf40400da64f9ee9a249eb0e33dbe4e5c851dacbdd2e1d448d00982dbb6a0a87cb0d2f

    • C:\Program Files\Neovim\share\nvim\runtime\ftplugin.vim

      Filesize

      1KB

      MD5

      0ae7beb1c8e74b02403e620db221ebd3

      SHA1

      e63fa421492f9a1d821313c928f78812ff559727

      SHA256

      1566d175dad524601032259bc3cf6b4a309ad70efc7a7cb2a22cadb4331eb44f

      SHA512

      3a7409ce10e13c7abb2a6987a88760c6dfceb6a1c13dfd9ab08a47d0ecd0e196c81c83a8e0088eebd2c781c5511005719ac2393ac793bb642a206daef6b60e54

    • C:\Program Files\Neovim\share\nvim\runtime\ftplugin\d.lua

      Filesize

      33B

      MD5

      8352b5a6f13d67ad2c73f072796a1a39

      SHA1

      d0e47d775fc6606c71416c4daa0adbb15189f453

      SHA256

      2eff59bce8ddee7f0a539f1d31e20db6d3d07bd03215df2f661bf02c5499d345

      SHA512

      276c8eab9aa94a4658a4c900f5f6feee56a5c80663a9332f22484dcf1af28cc497ad59042ab88b06e27f6e8725d0fd6ae448fe8e015358be7ede5e5f3496fa83

    • C:\Program Files\Neovim\share\nvim\runtime\indent.vim

      Filesize

      853B

      MD5

      a7b06de83d52dd6c655d16e5fb8d62e9

      SHA1

      e3704557d2ae36c59f5db41c78f5b4b59c7afb73

      SHA256

      fb877d8ba1018ba3d12bacad93c8b5dfe86ecfd5d05b7cf479c24e59a2c497db

      SHA512

      e0f185a1480d7812e6da4a608026a1ed2eb7c8878b179c6587856d9fec3308c61467fa4ba791a5be0449f56b9be358b026cb9dc8788bb5e732d90d3e8f6b35c1

    • C:\Program Files\Neovim\share\nvim\runtime\plugin\gzip.vim

      Filesize

      3KB

      MD5

      b31c928331e0a8a713a8c72704452431

      SHA1

      2343b2cb054f14a93e544fb44d772b8d861cf1f5

      SHA256

      4a781f53c9ae5378789d3ba6feddca1d453f2b9ac40ccf9e030eecc083285986

      SHA512

      80a81d1f7106f62951e01fca1d83497dad3b6c89d85d5ae82b4f2ce773e41d413c7b487c05f5971c09b4dcf917d061fdf024580fc8d4210c709beda9807dd02c

    • C:\Program Files\Neovim\share\nvim\runtime\plugin\health.vim

      Filesize

      46B

      MD5

      d77e555eb0f5bd70e92a7a7784f41288

      SHA1

      c8ba6d54b76a2c074071def89971c883ad9ddd19

      SHA256

      9a7f978f9c0dfb41b3f768db19a1aed1f8c61d46d898450ef3b68c3240533bd5

      SHA512

      6697a2af7f607d24bc0b9a8cdafdb7f3b2faa57344aa8e9b46c7c36acafea9ff51803f470850661583df8379096839a95ac7b7e28da40f365fd5a3f231872dfa

    • C:\Program Files\Neovim\share\nvim\runtime\plugin\matchit.vim

      Filesize

      142B

      MD5

      10098e16b3e15b74ea5b67786ab479ff

      SHA1

      0d17dc130d1d2d18bebaf486455180b8a75f303c

      SHA256

      731967ae8a887dde3a870a65ba34ef3659e6de836cede6aad01e68c7644a2219

      SHA512

      41b7d6ab2b03e8a2e68fba86a74b44056e7e1beae45396b03357dfbd745357eb39fde89730698d4f068ec37607d6e0313b7b52ee8f5010b2d168282037d4c0f8

    • C:\Program Files\Neovim\share\nvim\runtime\syntax\synload.vim

      Filesize

      1KB

      MD5

      ecc8807dfb4c616ac1823a31f767d247

      SHA1

      13d5cacc4854d01e3d5655417b00f98540a1da85

      SHA256

      46f97f4070fc190018ae064a9067551fecc59ce6009f97178b5a18c673f6607e

      SHA512

      64235de663313db2fa76710a4c9cb09007cb6a6b1106101de5836fd449c61ed7ff1865b46f6a39863e49841d32c1acbd2d6c82e6c019e07d2ff507d0052e2490

    • C:\Program Files\Neovim\share\nvim\runtime\syntax\syntax.vim

      Filesize

      1KB

      MD5

      40aca0e11e506bf5942e0ec68967fb5f

      SHA1

      29de293cbf5d679a20cbb0da7e6b4530ac83cf36

      SHA256

      ec8547cc62d41f82564f9e4253f692d4f44134a40ee718f31ba28b3b9bb650ad

      SHA512

      f8357db0f5ec8de5db307c46d18861759bbb5e43751340f9c2f695c4546ee7c5c0bc84e70b9fecb07938caa02e4499d60d0a584f57c86b3a4e28349bf927e572

    • C:\Users\Admin\AppData\Local\Temp\MSI6D85.tmp

      Filesize

      113KB

      MD5

      4fdd16752561cf585fed1506914d73e0

      SHA1

      f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

      SHA256

      aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

      SHA512

      3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

    • C:\Windows\Installer\e599a52.msi

      Filesize

      33.0MB

      MD5

      c633402bc07d4455a88db18f4a95108c

      SHA1

      025de228c5450504b5a500975538bf3193aacd95

      SHA256

      f80f40bc04bd2b31284a898809d8b83ae3b45c16638beac6504b78adfe5cfe14

      SHA512

      99734df497cc37c7b2785f3d94caecba52e183223a559740052e42bac5b8332cb56baaae555c120ac8162b9d9a6617b6e54d60a678dfab85c427977ca0c719e1

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

      Filesize

      17.3MB

      MD5

      fe8902b4f89e7b51cd827fc78a038208

      SHA1

      4474eedfd58f5efcd364beb9fcc8fb3e632a09f8

      SHA256

      8dd027d66a107bd93b47eb4b272f58dda428e0a64e8ff38b74b4f113e9d20bd6

      SHA512

      faf160546b2054156036c555aaee61c8acc8b0a74c4f1f1e5aadb89e6af737a4053ff4582c9bb82761f0836936f7e1632780b2edbdff7f18f9db2de0af2cb3d3

    • \??\Volume{14f6f45c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f55ae8d6-69f4-428b-aa6b-0625a941b632}_OnDiskSnapshotProp

      Filesize

      6KB

      MD5

      642c888de3cac24cbd8f95592094e47e

      SHA1

      d65064c79d85090271ae7fa8fcf967a8f2d0e4b5

      SHA256

      4548b38a4b3111e96d5d4dfb401517879145d489fcb5e9b3eef8b7287612d0ec

      SHA512

      740fa83624d113d3485942bedffc5194bac0a7bfa9641c113d62521478c24ea0dff5413fb7cfd6c4a3e93f597bc83d9832547fc786963dd79d3e466458982b5c

    • memory/2044-1915-0x0000000061940000-0x0000000062012000-memory.dmp

      Filesize

      6.8MB

    • memory/2044-1929-0x0000000002D80000-0x0000000002D92000-memory.dmp

      Filesize

      72KB

    • memory/2044-1914-0x0000000068880000-0x0000000068EB9000-memory.dmp

      Filesize

      6.2MB

    • memory/2044-1913-0x0000000000400000-0x00000000006F1000-memory.dmp

      Filesize

      2.9MB

    • memory/2044-1888-0x00000000001F0000-0x0000000000200000-memory.dmp

      Filesize

      64KB

    • memory/2044-1916-0x0000000069700000-0x00000000698B2000-memory.dmp

      Filesize

      1.7MB

    • memory/2044-1920-0x000000006FC40000-0x000000006FDA3000-memory.dmp

      Filesize

      1.4MB

    • memory/2044-1921-0x0000000000F60000-0x00000000014E5000-memory.dmp

      Filesize

      5.5MB

    • memory/2044-1919-0x0000000064940000-0x0000000064955000-memory.dmp

      Filesize

      84KB

    • memory/2044-1925-0x0000000000A30000-0x0000000000A44000-memory.dmp

      Filesize

      80KB

    • memory/2044-1928-0x00000000626C0000-0x000000006272A000-memory.dmp

      Filesize

      424KB

    • memory/2044-1933-0x00000000675C0000-0x0000000067651000-memory.dmp

      Filesize

      580KB

    • memory/2044-1932-0x0000000066AC0000-0x0000000066AD2000-memory.dmp

      Filesize

      72KB

    • memory/2044-1931-0x000000006CF00000-0x000000006CF73000-memory.dmp

      Filesize

      460KB

    • memory/2044-1930-0x000000006B640000-0x000000006B652000-memory.dmp

      Filesize

      72KB

    • memory/2044-1871-0x0000000061940000-0x0000000062012000-memory.dmp

      Filesize

      6.8MB

    • memory/2044-1927-0x000000006E840000-0x000000006E854000-memory.dmp

      Filesize

      80KB

    • memory/2044-1926-0x000000006C600000-0x000000006C616000-memory.dmp

      Filesize

      88KB

    • memory/2044-1923-0x000000006CC40000-0x000000006CC75000-memory.dmp

      Filesize

      212KB

    • memory/2044-1924-0x0000000070700000-0x0000000070715000-memory.dmp

      Filesize

      84KB

    • memory/2044-1922-0x000000006A880000-0x000000006AA45000-memory.dmp

      Filesize

      1.8MB

    • memory/2044-1918-0x0000000061440000-0x000000006145A000-memory.dmp

      Filesize

      104KB

    • memory/2044-1917-0x0000000067740000-0x0000000067795000-memory.dmp

      Filesize

      340KB

    • memory/2044-1935-0x0000000068880000-0x0000000068EB9000-memory.dmp

      Filesize

      6.2MB

    • memory/2044-1936-0x0000000061940000-0x0000000062012000-memory.dmp

      Filesize

      6.8MB

    • memory/2044-1942-0x0000000000F60000-0x00000000014E5000-memory.dmp

      Filesize

      5.5MB

    • memory/2044-1943-0x000000006A880000-0x000000006AA45000-memory.dmp

      Filesize

      1.8MB

    • memory/2044-1958-0x0000000000400000-0x00000000006F1000-memory.dmp

      Filesize

      2.9MB

    • memory/2044-1959-0x0000000068880000-0x0000000068EB9000-memory.dmp

      Filesize

      6.2MB

    • memory/2044-1960-0x0000000061940000-0x0000000062012000-memory.dmp

      Filesize

      6.8MB

    • memory/2044-1966-0x0000000000F60000-0x00000000014E5000-memory.dmp

      Filesize

      5.5MB

    • memory/2044-1967-0x000000006A880000-0x000000006AA45000-memory.dmp

      Filesize

      1.8MB