6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7

Analysis

max time kernel
148s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Feather Launcher Setup 1.5.9.exe
Size

104.0MB
MD5

50cf11684fc7dd4030f36f36f2bda97e
SHA1

4795a86361032d110cb22ffb71711dd91f678cd8
SHA256

6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7
SHA512

f79e88c30f058de8e209837b20674867cdc2bf536b2496a50906abd823195f59df5af07beb77526680a6b5064235491b591b1696b5590a0e1dd947382148e6f2
SSDEEP

3145728:7KQEzgzrCBz+GBTRJmgm0IRoFO7Ahhq60XYJMP2ZA:Dw3zlggmtn7Ahh9mxeA

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6} = "\"C:\\ProgramData\\Package Cache\\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Feather Launcher\resources\app.asar.unpacked\native\cleanup.feather	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\icudtl.dat	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\v8_context_snapshot.bin	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\vulkan-1.dll	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\da.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\gu.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\zh-CN.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\LICENSE.electron.txt	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\es-419.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\he.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ru.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\sl.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\sw.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\Uninstall Feather Launcher.exe	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\Feather Launcher.exe	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\libEGL.dll	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\vk_swiftshader.dll	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\lt.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\pt-BR.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ar.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\kn.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\nb.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\sr.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\lv.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\th.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\d3dcompiler_47.dll	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\de.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\el.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\hr.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\hu.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\ffmpeg.dll	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\bn.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ml.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\tr.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\am.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\es.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\hi.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ja.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\nl.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\LICENSES.chromium.html	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\snapshot_blob.bin	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\en-GB.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\fr.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ms.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\vi.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\resources\app.asar	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\chrome_100_percent.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\vk_swiftshader_icd.json	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\bg.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\et.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\mr.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\uk.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\chrome_200_percent.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\libGLESv2.dll	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ca.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\fa.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\id.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\af.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\cs.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\te.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\resources\elevate.exe	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\fil.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\pt-PT.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ro.pak	Feather Launcher Setup 1.5.9.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\WindowsUpdate.log	VC_redist.x64.exe
File opened for modification	C:\Windows\WindowsUpdate.log	vcredist_x64.exe

Executes dropped EXE 5 IoCs

pid	Process
2932	vcredist_x64.exe
2056	vcredist_x64.exe
2628	VC_redist.x64.exe
2848	VC_redist.x64.exe
2260	VC_redist.x64.exe

Loads dropped DLL 29 IoCs

pid	Process
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
2200	Feather Launcher Setup 1.5.9.exe
2932	vcredist_x64.exe
2056	vcredist_x64.exe
2452	WerFault.exe
2452	WerFault.exe
2452	WerFault.exe
2452	WerFault.exe
2452	WerFault.exe
2452	WerFault.exe
2452	WerFault.exe
2200	Feather Launcher Setup 1.5.9.exe
2628	VC_redist.x64.exe
2848	VC_redist.x64.exe
2848	VC_redist.x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	2056	WerFault.exe	30

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\ = "{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\DisplayName = "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40649"	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\Dependents	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\Version = "12.0.40649.5"	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\Dependents\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Dependents\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12\Dependents\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}	vcredist_x64.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe
2200	Feather Launcher Setup 1.5.9.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2200	Feather Launcher Setup 1.5.9.exe
Token: SeBackupPrivilege	1912	vssvc.exe
Token: SeRestorePrivilege	1912	vssvc.exe
Token: SeAuditPrivilege	1912	vssvc.exe
Token: SeRestorePrivilege	2836	DrvInst.exe
Token: SeRestorePrivilege	2836	DrvInst.exe
Token: SeRestorePrivilege	2836	DrvInst.exe
Token: SeRestorePrivilege	2836	DrvInst.exe
Token: SeRestorePrivilege	2836	DrvInst.exe
Token: SeRestorePrivilege	2836	DrvInst.exe
Token: SeRestorePrivilege	2836	DrvInst.exe
Token: SeLoadDriverPrivilege	2836	DrvInst.exe
Token: SeLoadDriverPrivilege	2836	DrvInst.exe
Token: SeLoadDriverPrivilege	2836	DrvInst.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2932	2200	Feather Launcher Setup 1.5.9.exe	29
PID 2200 wrote to memory of 2932	2200	Feather Launcher Setup 1.5.9.exe	29
PID 2200 wrote to memory of 2932	2200	Feather Launcher Setup 1.5.9.exe	29
PID 2200 wrote to memory of 2932	2200	Feather Launcher Setup 1.5.9.exe	29
PID 2200 wrote to memory of 2932	2200	Feather Launcher Setup 1.5.9.exe	29
PID 2200 wrote to memory of 2932	2200	Feather Launcher Setup 1.5.9.exe	29
PID 2200 wrote to memory of 2932	2200	Feather Launcher Setup 1.5.9.exe	29
PID 2932 wrote to memory of 2056	2932	vcredist_x64.exe	30
PID 2932 wrote to memory of 2056	2932	vcredist_x64.exe	30
PID 2932 wrote to memory of 2056	2932	vcredist_x64.exe	30
PID 2932 wrote to memory of 2056	2932	vcredist_x64.exe	30
PID 2932 wrote to memory of 2056	2932	vcredist_x64.exe	30
PID 2932 wrote to memory of 2056	2932	vcredist_x64.exe	30
PID 2932 wrote to memory of 2056	2932	vcredist_x64.exe	30
PID 2056 wrote to memory of 2452	2056	vcredist_x64.exe	37
PID 2056 wrote to memory of 2452	2056	vcredist_x64.exe	37
PID 2056 wrote to memory of 2452	2056	vcredist_x64.exe	37
PID 2056 wrote to memory of 2452	2056	vcredist_x64.exe	37
PID 2056 wrote to memory of 2452	2056	vcredist_x64.exe	37
PID 2056 wrote to memory of 2452	2056	vcredist_x64.exe	37
PID 2056 wrote to memory of 2452	2056	vcredist_x64.exe	37
PID 2200 wrote to memory of 2628	2200	Feather Launcher Setup 1.5.9.exe	38
PID 2200 wrote to memory of 2628	2200	Feather Launcher Setup 1.5.9.exe	38
PID 2200 wrote to memory of 2628	2200	Feather Launcher Setup 1.5.9.exe	38
PID 2200 wrote to memory of 2628	2200	Feather Launcher Setup 1.5.9.exe	38
PID 2200 wrote to memory of 2628	2200	Feather Launcher Setup 1.5.9.exe	38
PID 2200 wrote to memory of 2628	2200	Feather Launcher Setup 1.5.9.exe	38
PID 2200 wrote to memory of 2628	2200	Feather Launcher Setup 1.5.9.exe	38
PID 2628 wrote to memory of 2848	2628	VC_redist.x64.exe	39
PID 2628 wrote to memory of 2848	2628	VC_redist.x64.exe	39
PID 2628 wrote to memory of 2848	2628	VC_redist.x64.exe	39
PID 2628 wrote to memory of 2848	2628	VC_redist.x64.exe	39
PID 2628 wrote to memory of 2848	2628	VC_redist.x64.exe	39
PID 2628 wrote to memory of 2848	2628	VC_redist.x64.exe	39
PID 2628 wrote to memory of 2848	2628	VC_redist.x64.exe	39
PID 2848 wrote to memory of 2260	2848	VC_redist.x64.exe	40
PID 2848 wrote to memory of 2260	2848	VC_redist.x64.exe	40
PID 2848 wrote to memory of 2260	2848	VC_redist.x64.exe	40
PID 2848 wrote to memory of 2260	2848	VC_redist.x64.exe	40
PID 2848 wrote to memory of 2260	2848	VC_redist.x64.exe	40
PID 2848 wrote to memory of 2260	2848	VC_redist.x64.exe	40
PID 2848 wrote to memory of 2260	2848	VC_redist.x64.exe	40

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Feather Launcher Setup 1.5.9.exe
"C:\Users\Admin\AppData\Local\Temp\Feather Launcher Setup 1.5.9.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe" /quiet /norestart
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe" /quiet /norestart -burn.unelevated BurnPipe.{191A34C4-3D3D-4197-9438-E6E512DA7D50} {9BD776DB-48EB-42CD-8204-19EF55817B6F} 2932
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 392
      4⤵
      Loads dropped DLL
      Program crash
      PID:2452
- C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe
  "C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe" /quiet /norestart
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\Temp\{4DBBA5D8-2716-4A7F-8759-4F758EA75343}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{4DBBA5D8-2716-4A7F-8759-4F758EA75343}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe" -burn.filehandle.attached=224 -burn.filehandle.self=232 /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\Temp\{B78A9612-0D80-422C-82E9-6CB56BE31568}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{B78A9612-0D80-422C-82E9-6CB56BE31568}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1E8DABA8-0345-4097-BBF6-DEB42CADA2C1} {F7B4A2EE-4C0E-4B1F-985B-6670A7875939} 2848
      4⤵
      Drops file in Windows directory
      Executes dropped EXE
      PID:2260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000060" "00000000000005A0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\Feather Launcher.exe

Filesize
2.5MB

MD5
6aaa10d9227bb5569661c3a34f494638

SHA1
5d7375199aa0800c38c915a5d9fdfca95d6b90ec

SHA256
ffef1c9a3ccccab2b24a4bb32d59b5e4dba01e8604014563df53fc4e6d95496b

SHA512
85421316d724fd298c9fc774851e7fb2cb9d4d5cfee8468a54d2e32a0428bfd8e5842da1accbd1f63e02758d5824ef2067d8895a018ced08484661aefd64a025

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\LICENSES.chromium.html

Filesize
1.8MB

MD5
867cc2377e04fcbae5d3e2e7323c5dac

SHA1
2e444587701f27eb6e65a6dd0b18368da6be9a4d

SHA256
14deb731a9f7bd7b2b535b4d6698c541711d1c0fdff9ce0814623d78418f3eed

SHA512
2e32976d64333f7e9bfd656565f4bb444d21d1ad6d5065a1b335d11f59e1621eda83318ef4e93eddfeb5feec9d8c97fa06c7240830821880d0cc8569b6e59d27

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\chrome_100_percent.pak

Filesize
126KB

MD5
a3d4515d3a33a407d313a62818e82a5d

SHA1
967ff9a6774a66f7b3299af4fd5d70961ed54d79

SHA256
662a9db6ef4197cb4b6c50648a2cafceb7fd903015828df3fee605a602370be0

SHA512
0c757e1beccbca1ae0791fa0c51a9e2019696bd0965c73de67b364fba6f317ea2cf20fa65e4fa7dd22519683528e5112dc8c530049170f4e702e0c8d4e065801

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\chrome_200_percent.pak

Filesize
175KB

MD5
3bab45c70f22646cf8452c30903810cb

SHA1
40b31d4c79b5a2b8d12f8cf8b6c49c962c31f766

SHA256
d4282ae977f23afe252e19e421c8d09696ea3b83a1e73a6aaebaaa5547c74cbc

SHA512
85eda055494f0233c963e821906cf69d94e664d8396e8b08e7a8f412e1c16af71252fef1bfe3ed43cfad157aa90c0dcbb375626e2ddf0e807c9b23ad27e61d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.1MB

MD5
4b1ba2ba07773f0e8465585e35167a81

SHA1
4002d272ecad5935c770570e96aa407c1efc4f92

SHA256
969d1b8c4301fe0e385baaf48c028fca00b1a42a54afd8616aeb7f76af99e571

SHA512
74153969ea5f2472c7c05c9212f9108b6abcccba5c71e2b96ea1d9be7d6de0dfab3019a264b6278eefc9bc51bf88b07cc38086827ea14fb4b17611781523080b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\ffmpeg.dll

Filesize
2.4MB

MD5
903303e8ed4196cddad4d19b984aab19

SHA1
1ab69145557fe062d4a8b6e96fb275a72ebc14f4

SHA256
839892fe2c10b9d32842c0c7b2784a0a453ac76da80dbc175c992a9f343786ca

SHA512
54d858454b224fdeb16948629716a3607a523940b25ffc1bde2766cc427da8f770b3a896614491f0ddeab4bee43dfad7f85b3b30a83f40fbfb5db217abde4045

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\icudtl.dat

Filesize
2.0MB

MD5
42df8fe31dad473ebfd6691075977c41

SHA1
dcdff44a21058fcc6f2e1d09f370925274b26624

SHA256
d33792db61f0bc20c9d8ed4ecfbcf1773ae8c48e2b3abd33e9b4b0e968f8a158

SHA512
42259b945f59ee466676b08f500a7b3c8804e55f9a7ff7c56f0d9f2607826cc83ed0c5233a224a8afacaae6492030fc44bf55224e6bb68b920dc9b3a16228ccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\libEGL.dll

Filesize
458KB

MD5
655672c205e37b079c34a4427118479b

SHA1
e1d595a25e76f2f1be50f0ac3046e82462790d69

SHA256
498fafb59d3d1a91fa24f95a59411dacf3fb373408e8ea5f931e2ed6b2732d36

SHA512
a5ad3ac4e382d28d2d95cfc1b02ffca2ba1b5277567c1db81e14a87891e6ef9e5b8b2b56f4b63f8512c0b527dc3de7a5ebf5bb479dad827dfa17294f5874ab92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\libGLESv2.dll

Filesize
1.6MB

MD5
e09af8a71b7ecd70beff54c0c970648c

SHA1
3163201a693f32daa2ba2097efa349b07604ce7c

SHA256
c6d3104377483ad7276e2b9a447caf81e38a5472f8bc7a2dbe7f49e80a74d6ac

SHA512
6fd4a751ee05ba74ec5be6db87143a3853b9f3f6cd99779f3c80c65ecd1dc432a276c433df7156e5b9a78f3ac1d1fde84a759a55ee1ee77b2198998aa6ef1d66

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\af.pak

Filesize
305KB

MD5
9b0f069953b9d1e45d465293dbc1d409

SHA1
529186ede1f1e8fb0b0f407b0b64e190b3144bc9

SHA256
4407b169bffd8c68a20f06c1256b43ab411e0a2f2f067eeee332e6064598964a

SHA512
d298337e9bece93b3c00ddbe1cea5b65fe46a07997d181544a0b7a571b2fb83e6ec95fb44ae7b0bad604fc5a219b2826c4a6fbcf64ba24e7bbf2cf93e47478bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\am.pak

Filesize
472KB

MD5
fb20323d101e69beb73497c3a116da59

SHA1
468e2981975b79bad8c2ce5ac91977e5b2dd3282

SHA256
13e16e9c30eccc579be94a5208b86c7c541cbee5855683b6d304a53850890fd0

SHA512
ab62a9387d2b76d9b827ea4c22bb2a2eec14f10385d98744cb45fecedbeeeaf797b0d475f595f2890c64e074ac34177825d1bc5ac14aa759389a83916d877783

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ar.pak

Filesize
64KB

MD5
653fd086154b838e88010d77d5d479cb

SHA1
811136598f843a0d2f962f995e55a0948427940b

SHA256
78b7d0e5e5e8ceef9a9e0f2400845ae461f7b8df082edd6b4d6f456d5e52d7b2

SHA512
46fafa6753aa7769817779c3d5cc409dc28511008c2cc004f9bf538edbb77619838247b85c95363f2dca1e27dc7e82296edbc0993bf6b6f53b7ef99fc89bba76

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\bg.pak

Filesize
65KB

MD5
7d72fcf78a06cce552b69d106b5e4815

SHA1
693125b9d7e79d11a7acc90b001ab36875aa61e8

SHA256
62a2a1502442d80c605dfd51aa2abcf623a039d9b6af02ecd47a48c357168b67

SHA512
df328bfc71681e766c599c3da6d627dd1dbf59f3ba70a3375585097a3c9d5b2be131d0685f2ec5b1ee576d8bca8138b9566331b14f1f15476461ce83fee8fe29

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\bn.pak

Filesize
64KB

MD5
fc251ddc8275856d67dbfa2ca9b80734

SHA1
8d443f82cec0a40bc413de6889fe0b12d07b63e1

SHA256
ee9d426c38a429314ee6bd694e5d60839d0c7ab146606b7610821a42ccfc4364

SHA512
f7bd34c774dcd1b0a844a47144d01c14c79b1ca853fbf06ba937474a04ab6a1d377747cdf4b4ff1018e2640c8dc9a36141c86572a1c16223017374e1551a3616

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ca.pak

Filesize
363KB

MD5
711098caf9322fa49fbe4ee2ba794a7e

SHA1
d567f076ed6b8b1479c566efb155ba491401f140

SHA256
95758e3b0e83067a8eb8f135f1a9f6112db18ab6a21981c5ec32c899c729a159

SHA512
bcbff969d9e3ed54f6072b359f911c0c9ed875b12fc7a29002e9a251331b4d47b7c0d740ef1c596bbc8828d6e32f216f41bdadf0873a0a85ea5b65bc8770158f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\cs.pak

Filesize
64KB

MD5
82c143497901b81a3758a65250df1f10

SHA1
9b35d1311d69ad980fefc0228aae07de69d6a13e

SHA256
4777810902c875206ada5a663f89fb6fe12e6a50207bc7f54c9e24aa2c0fa16c

SHA512
e3a96c5b79356fbfb306a9d51e076d33535a4ec3b3dabbdfc92aa160796706ed7b94cc0e9c9a368cd7b2542979e65ade19326b82ea2dd212eeeed7ff87fa5a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\da.pak

Filesize
19KB

MD5
1345f2c53d80ed04051f98510409bc7f

SHA1
a8ed4e343b140f9b228c4957a99b25fca594c2eb

SHA256
b63a3cf7124f41f34e932591d5891fb99c4626d8707e3482eb9cf02dfa981525

SHA512
bb3bccaf15e531b0bab60ae652f88722f815b8d4f630db754255be1a7205c4340c9ae6fc485f7a90db5337cb53db9f8d70cc41875161f7aa33c2fd0e492e7370

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\de.pak

Filesize
21KB

MD5
425c3539c441dcec6b7458a9c0d04671

SHA1
bee120a3b4052107ce3f9fc92de6a60b1a4e849a

SHA256
297d6a3450c3454d9259b18637ebffb762cb66409c64812f62838dcb43f244e4

SHA512
76ef410943621ba98267976e6f8d57a8f54922fe8c18c71551c779a1c1a380ccad288875fff79a4fd25b495e086db783aa1b713af3abdea58a19c598c0ef8d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\el.pak

Filesize
650KB

MD5
79077480619d88f5d4d0c349e86de169

SHA1
3b05b9de0d79e6cf82ff5e482dd1626f58d1c858

SHA256
b4bdd19191dc4bc22f8a3ecab032f034b0c0c0669e9a5ba1b42717ec0b5b418b

SHA512
1fc5697c798c83f70345700037af7aa22acfac5a3c7e319dd57d587a35b7e907ecfdf175e283df365e31c0f824713743a96cc56b60e9c1f335bda80fcfec38ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\en-GB.pak

Filesize
293KB

MD5
0444defa8f211ac4eabcc760b14a5b8a

SHA1
f143e080ba73f83c77d6c095ab8be1f71f763532

SHA256
e252661d412a068610ac2e2a64609f21f71c64602c579a14d7e6ee59d08fdfc1

SHA512
ef4977e477c3c39c2915e82162bf44370a3e2242a2fe57b43a0c2342171d02278adcec9d602ad4d4021a6554ad85a55d4635ccf3cf97405bda30626379d875b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\en-US.pak

Filesize
296KB

MD5
1e9b12891461eefd9db12e537965329c

SHA1
bf2346e045f79a70218890764b9318fa86886b36

SHA256
bd67fc968d75e77f2bae7ad552c398ccc4dad8635d74814c2046f813010c45e7

SHA512
3f01b9fc7e07bf6f3f8cda357debb83f73bb24179f6926d0b24114ac0078f42941a68842453bd7ee86cb759ef76e240b84278ebe1541cb659fb7caf3cf5b6820

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\es-419.pak

Filesize
358KB

MD5
637dcfd56428fe96bb0a778b0cf8a660

SHA1
1bad857d600d00864edc3d31529cf4ef6a49b580

SHA256
45f136986a226b1385189997aad2f660d0f518cc9871862250736237e0b105cf

SHA512
66b5c92687e97326af47258d38ec523184ced00855ca385515c64bfb9a7e3eb8dd1f885c4db5891bad680c670714bf9e5574483e34265c1f7781c8a7e7af9301

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\es.pak

Filesize
359KB

MD5
85e0afd9c09f97cecc025f31fdb6269c

SHA1
13b9ec632e465c31fe6e88b1e3c186a2eacf5de6

SHA256
e1a9180677d2989137e8dd381e6c847c47b385a6d3e965a047829479317736ae

SHA512
0371b816522bc43b124ab8dfba3ac55e63c435276031f7035075a0767a11f3d73b5991156ee6ea1770d0115c09cb653c9d3fbda4b2d9f1e00b068c9d7a2f8db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\et.pak

Filesize
323KB

MD5
f6b7f59ef4eadb505faf6f939adafecd

SHA1
738f208a717786f23d124201aa16b377b686cf50

SHA256
8e75989893f0d59f6ccae2042231ec8e7dea6fbc78210700d0d1d3a67f6b1d59

SHA512
195bec3a111c498cb4b791bc7d15b459014717fe4270cd82d01e6e4d1b12bac03e267b7699b12e43db5c6cfd8625b6358bcee039aa18edf593f824fb27bcb38e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\fa.pak

Filesize
2KB

MD5
910fbeb1092a22001afa043696e28ec6

SHA1
21c791cf64cffaf18c2ac27d80e487d52f178e29

SHA256
78aeba98b2649b36635d5e28e834c07b60525674b15728db920c3963edfb846f

SHA512
e81e4e72d87a896e346b461b8dcc9743aa6243d24cbc2b1112ee664afcac21b510c8d50ba974426cc2c14e38abeb51b43a35a7deb7f0e8ad90b391215f7ef296

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\fi.pak

Filesize
332KB

MD5
71f7182ad054b5294d1a3c8fb91d1612

SHA1
13a210397d6352912c35ffcfceb0e2ba3910f7b4

SHA256
0b41ce33c0036aee83989ce4ffc2d096b2f6fab77634e4bb500ec70a51b4e0bd

SHA512
157f11807cdf4667efbc93cf2f3134d9d48b6eb08b941eefb7b085dd3e110efc42c78ef554c0faa2b46e0155903342c6b5b6b20f796907138619b880bcb2d2f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\fil.pak

Filesize
372KB

MD5
850333b9705ef8ea07a6a9ded5904040

SHA1
12950aeb4d7f13ff335c5012e1d0af0da50ba541

SHA256
742705b1c87900f6e8f02fa112d2cf13ffaa6c09c62a7dc34a2cd6a29608dd10

SHA512
c464725f7f9702c9e94a7491e963664fbfb2b07507ade4f32fe2372eb9d0313bb229fa8eada511b338d094780341c24cfb59f745471b0b82fbae94ebdc8ef4e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\fr.pak

Filesize
2KB

MD5
f30ffdf51195d118932ec7efd76bff74

SHA1
28fc6b40c2849df050aba7df51c9dd3443295a1e

SHA256
e4088c664ad8763a04273206273babdce94ee98f07a28db55a935ded2b9590b8

SHA512
faa7958ee7b5b686b77088326bc74e24faf7ff2c663ad8481ecd96435e940eac8732bc8b156ad47a571768aa273abe4e2fccccd5c80401bce1923024b8745088

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\gu.pak

Filesize
740KB

MD5
9ad27f9e3aa9356d8398a823a5a90762

SHA1
65a3b8b786a245e307bad3966d9ec02094c06cde

SHA256
984aed687408ebdeb291a57893034490d6acfe9d34546dcc3715f33c8907ca61

SHA512
46fa7165714cd1b7c1e2389c85e2ed73f40125491959cc458ac621f5e156963f0fc141deb1c973996a15bb2b7b835ba36806db762ebe97b02159d64d002a93f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\he.pak

Filesize
458KB

MD5
f7f22a75ba2cc2a2d1094ecdc60a208b

SHA1
a631ebc0d180fa994b3856f706ea75714292a7f6

SHA256
4e972808f0a25619462a0390105e8a869037341a30b3481b3c80d918009efdb2

SHA512
fa7e27d931421fa504c6731e4aebfec0908c98f72c2ec7341195ca907420dfedf30f68e0949e3824b6368d64244de3bba6a7183d3fae424a0e1de69bbfa9d71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\hi.pak

Filesize
771KB

MD5
d0b36880a50bd87dfab2ebaff24c0ea9

SHA1
eb1f30d0092b4900f332cc2162f9f1c52ccf4da8

SHA256
b23dd1037a3d133ef29b73f5fd90765a7af9f0f69b24858343acb084a59b01c8

SHA512
bb80d1ca39707b96601433f9b10d7857950aae2075d173d5650af2e3a6e6fc795ba4a6ab55888933b9f0e62bd03d362af42357ba22c75a1ad599d153582f6bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\hr.pak

Filesize
358KB

MD5
5858fdf0f665ef6dba8a4e68ae175974

SHA1
fc8085083e4b38462c42e6ca5ae67fea408f18a8

SHA256
66e85a46152b7baa26b2fd8d6af3df0ca67f54b75281aa08cf6a0f7e769aee8c

SHA512
6b32b62749b2e1a8921faa425ffe69f1d3bb3d8ebceb74f5215c355a35aac8220ae8a0624c68ec45123430cc731812504fc22bfac1d50e810168f3b3509176cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\hu.pak

Filesize
387KB

MD5
e74277eadf72ef7164e03a0a38d8f6f3

SHA1
0085e77f0a9bf30d290f1eaf24466a12789a1c6f

SHA256
df6c21a38bedd4c6d02ab60650f4c34537e238d4c72b96b2857973027542c3d8

SHA512
27ef60832a863c4ad3ff0816ee03b8bdeb584fc83654f4b1061786014aea92334ed44482321a370836aba7e08cc4b0992a8ece81cf8b98e42cdc76813470ecb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\id.pak

Filesize
318KB

MD5
437540fba9de2809d42dfc66ad78d664

SHA1
0ef84382147c9ec2c1f8f248f7234506d0f3785c

SHA256
788a4e41a8e6b70e714913b4894a48fdf24799f7a20320565c523b233a41a8be

SHA512
e893b418457b2aaef7605e36a61351b43b18b38ba675b2377bbf7744c7ba83fb66db151faf28f9bf0361f874cb4dc93e4bb1066cb7a5fb6a41b1b97f907c1dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\it.pak

Filesize
353KB

MD5
f21eee789d7b89f4c1ac03bcc95b6391

SHA1
754ddc787e22378c3034c78dc126e49d952c1ffb

SHA256
94652279dd554461d91613fd2cf295e0c68a7fa46855c53172781b15a5b2bcb7

SHA512
588640b61bc8ec60d9d6a6110544b0d191cf0d084e17bc79ab19177eaf74899c1eccd7b0f0f6852182b48b19596446e819ef0c1d64fbffbc87552a8d0eddf49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ja.pak

Filesize
430KB

MD5
d453d6bf0d493cf8a28dcc7e32149cde

SHA1
fe164f188b61c6b0c243262df7fda8fc612d9e82

SHA256
1b3bcb7b6482cd9b005aaf30ccde3b4f3603f0a9e1d0f2209d70ecc74f7353de

SHA512
1588071999065dc93959ac36557e321881e7f244b2166c0af76deb4083d3e9580e6d0dac1fe474a49cb43cebc76a3f0ed400e750c090886c77e85ad0dea86c2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\kn.pak

Filesize
854KB

MD5
be3dcd0f8dd4275662a01a381bf294fc

SHA1
b97dc0e112e1b66ab3b9b7679cd9b2e8d9e40cba

SHA256
c06445ffccb52fca884686db4eda33d315d8340fd653c199c0fd8a07d1872720

SHA512
a9b00474ab5d1ab88bc005ff53c8d7e33a103d87c2794e38bd6819de629969d9dff06bd4bc7c2318ada4de5a61d68462bf5e0464c7f53a4250b4f617f99ad32b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ko.pak

Filesize
321KB

MD5
43632e3089f1880a62b1ce41d7834532

SHA1
e677c4571fa8dcc947b1e2bc4f41ab85d48bdaa3

SHA256
801d080c613f96debfc0a8831d830de45edb566f35e1355bdb5e6d5de47cf8b8

SHA512
f05686dec785eaf58529fc889e381a8968bd979bb2b7f549d4b755dcdcc6d4fc8c573578ac8a22ffb5433693811d777e29bb9356987626ddbe7adac7de6dd3ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\lt.pak

Filesize
387KB

MD5
2a21c3d432c272f81edf923308858802

SHA1
7dad07b28eaa2db09c341a4670a17016702ea1d4

SHA256
da21c47633640002d0eb397d9f2685df542b6f5e53ee3ca655340750de2f3217

SHA512
8f646dbceb6a13568364f194f1ab95055378404e0ac21a3b4e609bfc1ab3b41869fb3ef4700aa0161ef43e4a394666437c17cf49f7bb0bb1d27fcdfb252ac782

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\lv.pak

Filesize
386KB

MD5
f0645d37826c1e2923240b745506b7f6

SHA1
d41a06f30cb4aa187b6f02320db9c743058551da

SHA256
1af1ac2692035d502e772f976c977936d0feb42f65a9096e0af2fcf8b7df03bf

SHA512
29ccd6915aced1680eb0ab6ce4554ccbcfcc196a7e1398ae5da1433205c7b2e77ed2bc7349704d1dffafd108403bffe53c36bd018bacf6faf7363f8e35c32a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ml.pak

Filesize
897KB

MD5
68ba8ab8cdb6bcab0650324a9b2736c4

SHA1
5cb7dcae00cfaba7e621373273dc80144319f031

SHA256
c990dd02ea8ccad94f5002b2b05e74ad258a9b13ec1168732cde06d0723e2a91

SHA512
7b4b75d2a67b32c0232b05de4085196484bf52cfeb109f2543c4cb184456601afafe3e05ae7ec9c37666499bcb424346114fc9fd08af65a7af853e42cb16f5cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\mr.pak

Filesize
728KB

MD5
a72af6ed3bc9c364cdd096d65e3b5349

SHA1
f652a7d21e8cafebcd72cc38891d4b7b908444c8

SHA256
c20543bde56b4ba78b7efd8a1fd4d6990e751ea7e243c91a2e83ca78dc0d9289

SHA512
3d0523ac8ac9e1d9f2e3e802053a14c8c3ea0b45cac0865b10efb23e869236b8103824777b5efd45eda7d6da128e9ec15bc68963bb60cc46a034ef357fd66b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ms.pak

Filesize
332KB

MD5
aa1d4538fd06a6663ca213e059592f90

SHA1
4197b4bdd58b09ca8caf76d0c22e3eda358dbeca

SHA256
d51d9f4fd2be492a751db6898b4c2843b2b6cbfe893bb66ffa4eb8e1a66e7e5f

SHA512
718d3ed30f8f8052b2c52e8458188880a050ccf14f2929e953e18a551f6abd4fbc87af525ccd2efa353bbee00529cdeb7146373023d598cb6430e16465bf1cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\nb.pak

Filesize
325KB

MD5
9cd8697bbc2b78dc3fe4c022d1fd5ee2

SHA1
9b0cc62586e391af46899464dc22df60746b53df

SHA256
fee60b6eff88716fd8ad4a9b2da8b16827753c819671831e2d7dc2723aee3bf8

SHA512
30db548a2bc7af38ffe0a1970a52afce2fee04c02b4b61b277d875f068c86fe46fe537303cbbbbb66f3f715268b43cf3b2cdfcd90c2a4157393d6242eca79c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\nl.pak

Filesize
336KB

MD5
abab4a5f1afd809d2e7d5cad3ea17e70

SHA1
d57dd02b63849f7798b1ba11efb889075fed10f3

SHA256
361d54411d890d26fbe6d1f8e8f8258e72afca143783f9f16145b9f4f5f9333d

SHA512
076a061a9278d83c76048696d14120310b64fe41a0300a0e0588e1c7ae933026d8994f9672d85c5c76046a3d7eba5fea6ce70fa7fb4cde0990777e3965fb1d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\pl.pak

Filesize
373KB

MD5
b5fa6aa430ac5ffbaf172627733d0a28

SHA1
22179851889ee0f30097b0ca7417575f91c9b7bf

SHA256
fb1dc5b556f59b6ad642167f1df9e654517ad494559eb3f441ca8f79d56a86e0

SHA512
80dda2de947cf5e2084bcda6623b83ab7cabfbcf5e6fe4d36d3290ee10f18f7be897b29bd3ac9f5be72572e04a7791e008532dee68bdb9647b20532fa38cb386

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\pt-BR.pak

Filesize
353KB

MD5
8bef64a4500a00f0e72944a4a4b6556e

SHA1
13724500fabaa1c452a253bd43572d40d74f8e43

SHA256
1054376071aba92b165cf561b7931a18ae0b29c9ca22eda85c5c9c7e6721e49b

SHA512
8590fbb13913342c988a7bfbe7abe1483cefca90b801152ba483752804879a30b5f8aa4f7cd55165978984da68937006b675a65d7c6ca93e770ea2586a35ab02

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\pt-PT.pak

Filesize
356KB

MD5
a0e1ae3d3ee87f7031fffd278cce007b

SHA1
c36d4e8db6913f021a0be1d9b8a3e8a13943359b

SHA256
e5c382258030217591f439a4020069378c3362677258d5129c69ef8e25abd6c2

SHA512
bad63254f3a4fb65a9e7cf00587985cbbc93fb3fc2b48735b59fed3c98ebc1c51fd5e8394209f86c6040d05663b677b6d468cd98920f9b088c6fe1cdfea7b47d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ro.pak

Filesize
365KB

MD5
3e9f9e59dd4a782ff7b1f1106df6c88c

SHA1
a0694aa9cc39e1aa5ee6b0cccc0de76b14a8f808

SHA256
d56825b2ad81fa419b428855d8b3cff01015a446b7cc989d7b17fe1b3b5f45cd

SHA512
7e03875cc9b5c01838af6b470c541cf7f2402fbbd1b50bf0634a4c26fe417c85d59f53112e1013425d26dd2664c83181591baca502c259e513445a6ea2fdd18c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ru.pak

Filesize
271KB

MD5
80ef5c1f19e4edda9f3f407b377802ea

SHA1
88ffbc59ba2e980dc406559305900abc6ce0e076

SHA256
21a12ab5d80f7bd18d68723b9123e4376894534f4aeccac638d3189bb7cb450d

SHA512
5e77ecea2b3d3dd36712e15c8008d58d25b4da32993bde9b4e418ff2fb37c7f0d1d35fe152fb12f2bbe18503eac4d2ed8c541927c611d58c9f09a0a48a4787ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\sk.pak

Filesize
376KB

MD5
ff48eea350d1fe820a47c2cd0f9a93ac

SHA1
1a069d1f9b278be78cefd290670dcecc463aa7a3

SHA256
fe43904bfb0072add943ee8d44e9f92a80eb2aa55ce7157de52ea625c277db53

SHA512
507ab138d8b6dbabdeacf3031fe4c63687fd91d04d0eb5e27b12ffe1d84c93ee40f69e48853d6bebe177d614e4a14f034024f93397a0e9fe5779ccd01760caa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\sl.pak

Filesize
362KB

MD5
1dbb16fa2da8c13145420e85cda509c4

SHA1
6bee3ddc96a98c1e658299dabf6457fcf90c67cf

SHA256
5015c0685b66ef38c92ffc4963e144e913b646d8e855f3976e50c8039879cccf

SHA512
a98b086bf9175b7c2b5c25e1208c8f7248c6eed2bc9acc095a52479550b58bd22dfd9a09dd3674f59ce9ef537f27b0dafcdab194158438d0e68d3c120fb97e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\sr.pak

Filesize
560KB

MD5
7b929206486e740b4c9299112186a94a

SHA1
b52a4c8eafa2d9439d525a167cb3482f31d7a6e1

SHA256
a0ef17a572ce510796886b844226b65991bbddcc71b763b91569a07ef23d2070

SHA512
91f4676cc8eeee6f3d643f13c27602ce05639b3707bbd950fb0f745242e92d053b74f575d87522a43f2135662870ca3e3eb6ca894737a5d14900b9e48c837673

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\sv.pak

Filesize
328KB

MD5
c5bd14d64a64ac7f361e49035405852f

SHA1
e2484e58f524464fadf898ee0a3c972db19fa9d0

SHA256
21c7d459c55f255c6da5a6454eafc836a3bcdba9c99c76bad0f0d6fbbe7a33ef

SHA512
74443233e16ec24814ebc4e16aa5108ab447c4b1d095c2e18ae4cd2d25fccb13a182fda1dbcc286b9f8b07e80e19ab19544fe758efd90910a4eb1d05c3ce3393

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\sw.pak

Filesize
344KB

MD5
8e490ee67f6c53f9916715b0d32257d2

SHA1
dbf51ece8c770f38019f497bb10966feffde0ea9

SHA256
a8d904e4871efa01c72ef64bab601e6cb1de216db4a696966e90fe1b733bef17

SHA512
a5774b930e4d5f6d91049fafdb6a743fda32f670e9aad9000740010d1b271a4c3c881d138e40abfcdbc6bf98f37fb3791007a74d38ac507b8bf86ebe0ee00c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ta.pak

Filesize
880KB

MD5
2204d0005209a5a2fe25bb44b8e5ace3

SHA1
161d7d4e286d7bff25e3f096923a5a7c7a3cd30c

SHA256
fafe173abc2ca773026b0caa24e693a0ac4c9d0ad7c40258bece10e4714dcb15

SHA512
8dc654487702636e28a1fcde05b8b9d2ec71a640c48233dbd5ed0aa174a875e275e310973f7e993908919affb7671282d40a8dd280b24a1c5cd29dc66e4f9abe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\te.pak

Filesize
819KB

MD5
d7f858c12123e975b4a862c3df05c0f4

SHA1
f8d2ffbf76883f5f095e10f3de5694c209c47b12

SHA256
29e4d010c6b951c129633aac0f55b70107fd24dcf1062c20e263611e30ab4b93

SHA512
1d44549e83b0af8d9c1b5826c970eb8dba5e8159c0ccc3586022d65d1e5234b06cc97ee4a9d45d7d944e882f4c5a12947bf810f73c8c064255ac0f46e35799a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\th.pak

Filesize
690KB

MD5
73bc88a210dcdfb14b6f29d8f86f4f4d

SHA1
fb3392a03cc355aae318902122b7245f2fc13d01

SHA256
bb8b656b1d2c4cf5f361f59b44abd4809cd774e664dbd0f90b62b97ea125e3c6

SHA512
671b90bff006b22ce714971bb8ba87acc4d887f9893709a090a85a8dcabb1ecd72edf54775c77378ae22dfd5ad2880df10efb201b1d4c11a1d304086b8ed3c8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\tr.pak

Filesize
350KB

MD5
8faad383bb39fa15ccc8d07beffa5a34

SHA1
5bcd907923c04b310dda718b5eff4115cf42c6fe

SHA256
e31a9cefcbef64d082b77a16a2d5dff11673f74363cf9fc34e36004a62e308d6

SHA512
9a604a1e4cbb23d48203d02950465020c6dd5a3556ac6e5ef7dceb0491b8d5c5722b6b73226642f2234885a36dbdcb1f628503b6cf63c84b4a28408d74e82764

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\uk.pak

Filesize
192KB

MD5
b32fa71fa31bee9ec48c69207a9ae2cf

SHA1
0493b237abd731ad582fcfb406e44b6cc410f88d

SHA256
26fa30505f7601e1064bc0dbddab58be0c1736f0b16c824a890cb1d888af79f2

SHA512
1a0951fe07b93f6d819d7291202bf2beaf5b43a9ab0371d8f94a42d6e0568efa20f3049be6dd03f249a43ed605b53b85c2ee45190724ef037aafbcd3165b60db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ur.pak

Filesize
192KB

MD5
a4e817c74323eae7e701a1889677dec1

SHA1
82a1c5a5dfe0e11cb6cca6d3b05384610d0ad18c

SHA256
2a42ea2cdc0a0a0ce80076b5601bf9ea01d06cb75d52150395990f6ae6c4d383

SHA512
d6b2a4bcd1effd11888840c3fef9b6fa1b3399cd50ce04909f7f316e1f8f0f7b944c413c3e9cab041a83586187c18ebbf61aaba295356d7d88d166d5013e8844

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\vi.pak

Filesize
128KB

MD5
d434d3c13924244189e73fd80d858ad5

SHA1
8a9b6c874445db7266cd33b3afa362877dfd1f34

SHA256
0427ac6aaa18a5bc1f54ae63ed360529db625a759b011d4b434d1d7638e94033

SHA512
f1ebd922e64fb594302d33a48caa28d3e9ff748f0f86e9483c8740c3bd24588adaea932dbd3ab8e67f637702d29bd26a0be31c609adde12f418b11dea940de75

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\zh-CN.pak

Filesize
128KB

MD5
e4787d62a5e072df76b486f58a047598

SHA1
fe3fdff3a99337c29f344b1ceed24e43d276ffe6

SHA256
f4bbadfa519c40236613183d6fd6e6fc7a375a68825fefff615baff32d75840d

SHA512
a42ba33244da03573ee25df6089d4aa51f3834684089dc8916127a0a7817e7f466843bf34f6874fe0e451b5410ed648ccf314e97436d94db5f8c5255abfb313b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\zh-TW.pak

Filesize
128KB

MD5
3608fe072cfebad9f39cff104e2cdb7f

SHA1
1c334ffd10eff4b5cda7362473a5cde40e407c84

SHA256
9cfe268a9808ac2acf47ad9387762b04cbfa3b131ae0707d535215497f1e6f97

SHA512
3a15a4e15aafa1e5d5448d9514d0aa1586aa3799366cddd4f06df741ba089c33c3fee2b011998458958715e4e379f0eadaa5ea60ff9d59a06fbb89b2684d1e39

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\resources.pak

Filesize
1.3MB

MD5
48ea00940c7c7f4d469c5b87144dbc27

SHA1
330968302a0329a4686f765bd289c10263391114

SHA256
51340efccdc2ee59c974d0796bcacdb2f6fcb701ba997af55527b7c89ea71e85

SHA512
57857d766268889ccff552b71f020ac469c83c0ae2e79d4a96ec1137b5988b2e2abda7b7cdab024805053c6a3f3123634d61023af4c38f10124cc587134224fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\resources\app-update.yml

Filesize
144B

MD5
9300d1436965c7c0933f53bd16bd332b

SHA1
96246ceebfd51faa9470f9152d0925f6cc1983cf

SHA256
53c824fd08de03ee221296cb75ad6e8c3cff5b8254a467180197cb308666377b

SHA512
9683ac45be9771e053fa11a0b13b7fe6866c44385046c3f7b67e77e1fd068f5903bdb1987209cf68432ffc021f8366f6fb002c360e3ed6ae030a8fe3996415f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\resources\app.asar

Filesize
113KB

MD5
53e471376dfe70a5029a5b0743288bf9

SHA1
a7d56f33d0622ec883246b4b3153d17f2750493e

SHA256
acf01974744385942f30a123c814b4ebb0125a5d6de61c4cc23a5478b8c0ef93

SHA512
2b15dc0f7d2cf883df4830c9b249a452fd41aacdcdf819c8742703e99ac33cc1fc399e060f752fa35ce760fa8a5bd1eceed05f0530acac09beab1474298398c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\resources\app.asar.unpacked\native\cleanup.feather

Filesize
64KB

MD5
a1e75799df6e05a0078c2cc69165d72c

SHA1
e94b4b92d1b3555beaefcdc7f0363bbda17af4a6

SHA256
11dc6a42ce919a7c3e466ff0edcecfee46a84f148dc376c15f7e590d0bcaabbf

SHA512
9e58ac6b006be1bb6a1a4897a9ba9ffca0c4f64cb9ba7aa486acf26f0cf664015ab990f70e5c77ea6a60cf0ff64921bcfe938c358ceaceab2e87531a758b3619

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\resources\elevate.exe

Filesize
64KB

MD5
11118fa03a995c333bf0af72c0d1bd26

SHA1
90722cc9029098ed5753ca359e6e88ea455ff180

SHA256
8a9cc57d6f67288e44edbfa17f1e135e30385e5542d758c7809c090e86227d34

SHA512
de5c7eabc7d1485378a5877bf604a1a426648b166a9973383ca9c801deb19938477a73f20d4482e59e7a757d966b855353fd8904decb1e55351f439f6674b411

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\snapshot_blob.bin

Filesize
401KB

MD5
17b5a28e6aa7ef49bea7555843937313

SHA1
8c740e68f009c3d03db74edc347cc5d1fac7b1b8

SHA256
2590aa136bc101f1075e42cd8939c7679ceb35b773c989be2ada49acaffd01a5

SHA512
af7efffed22246389d6a834cc8d8467e965849ffb8fbecd4d192c0596d1a026c6ddbe49cd2029163fd77bad22906e80446512bdb918875a7fa96c6ffef65cfc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\v8_context_snapshot.bin

Filesize
716KB

MD5
b978b7e83b574a43fe766af2b670c1c4

SHA1
ab0d1211740fefe3b8ddc8bcb2400e68cc88ba4d

SHA256
f59fa568139442c7f547fc8a5a0fd090ddc8427cc409e2fcef0518a9dcb47a96

SHA512
ac0f297b128e83d55788aadf5870849781d81cc61461117c5cf22f757e20089acb640b3ebc2f3bb2fbe1659e75da73a63cb884be4a791a90702758e6c52dc706

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\vk_swiftshader.dll

Filesize
850KB

MD5
ac84370d43b6d4f35f48ee773751dad9

SHA1
f64fd39742e4f5df689ee651992d8e5c428fc548

SHA256
4e863183b44df90c75d49cf01bc6bc15dac9e4f731eab2fdab438a4f5c34b75c

SHA512
336680d5aadb54a008436e5c1ef051dc55c7f95a0d6528765e5231d030294c651690295b5e7fa9eee0393fd61b01c94e7241a7e307406b58c90529d9ea80e29b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\vulkan-1.dll

Filesize
849KB

MD5
58871cf606db440509b56a3f764e72e3

SHA1
312e810cfcfb663b0da00eac3b87294c0b035cfa

SHA256
ea1f3a66f9322d20da4542c42595eb789e532a224a0338dc488e998ae00e59ea

SHA512
07279c40721414f6ab345f83d9189c3c7012a54fc839359cb33cf4793ea771507535518554be99bac339463b7bee89e263e7a5cdd3f443a550ca6476c350a2a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe

Filesize
2.6MB

MD5
c5d5cd860a536e03401c09b825400aa3

SHA1
aae5ffe35772c6b12956254edb28fbb8c7a4e29e

SHA256
73534ed5580dd737394ee51a7bff4182c807cf7f420b2b1e3129591a90e73a16

SHA512
3e600ca8b01c796a78715716aee57039f98abe71ae3dcf05d78df54825f906cedce22a5c8923f12192115fe1c4eaf8c34b7d52ee7d5163a1a40c06623bc1cc34

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe

Filesize
2.8MB

MD5
21b1f861951e0f453531af1b5998f3ac

SHA1
c0281eee8ef39e5396383570764e6249f0d103a9

SHA256
eb91e7d276dce2b46e4de75dacdd7341e45e3686d6d28c35b623380f9d519f19

SHA512
6600e746996a90012bfe3e0802ac600dbe48797031fac5f87a87f19703056ee6f020bf2233dafbc1f6ded1df311b76d10f3b6e8dfa7a34c70759c438c568d836

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe

Filesize
576KB

MD5
788574c79bfc3b1ffd032f9d66b82a43

SHA1
922259c644117fd4b2869ee6175ad8e02ebbfa9e

SHA256
4f76198299753221a79b9bf0226d1895faf45f06bb6b8b0b12dd55e8039cbdf2

SHA512
ab03b17e0accf4406c285a3514ab2285bd4248820b28ac78dfd79f66b841233c27c679c68dcfca6bae2fb91a99ac752f3f57a0bfc858a0eb548da96f67185538

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe

Filesize
192KB

MD5
d3f7b74e9d354258507f81b4e342cc72

SHA1
c66c5b132812391a10e3feced9750cfe3aea2d59

SHA256
6427c292efc61774c7ae66b295a77da78e4e0eb870eace87d13a471054f97d63

SHA512
4b64a7cd9186db2c8a223a36886f720e5f7c0c5aeab68cb9b96560f6c2fa7cc83b7d4ecc1e792f0a16c63eb8a3b3f11e7a76e94502150578661b9a7333fd8319

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe

Filesize
42KB

MD5
497e422cca5b24a22e339c1722afd664

SHA1
b0c1f2b8c271a9c7338de601b8a8c3ef92a7a7af

SHA256
6f7140310773394a32653721f95ce75d1e482981680855cdbe255a193752f1b9

SHA512
fe49366ede16ae15962945a310b1a73889b8e1506d5c16a01e69e93e2fbee2ff2586c4e6c7e97fe7d9c8444a163760a342e698abccf0a7c455a11194242f1077

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.be\vcredist_x64.exe

Filesize
455KB

MD5
622a95e2fccc1657cb2a760688b40665

SHA1
3feda4e77dcd8faf189371c71a35066b01320873

SHA256
e52469f3bce3768b43615ba44bc891dd2cda1b8e05659debd0cdbdebaaf9b199

SHA512
cd7a4705a8b7543d85b9d45d2832641d9783232494c66570d0a1084dbeb67cbfb5f4143e0deda7840f8f53db890f1029f9faf2a8814c1e885aa618f028a0b6b1

Download Submit
C:\Windows\Temp\{4DBBA5D8-2716-4A7F-8759-4F758EA75343}\.cr\VC_redist.x64.exe

Filesize
448KB

MD5
e0f54a3412a6f872b3ebcc44afd873f4

SHA1
17342607694bb49a37a8289320b7c1071c986389

SHA256
68d451f7cc0651f193d2fcb1fea57faf0b9f32129f9415116f41cdbd4f15f7f4

SHA512
e150c5e67410ee45f80a92e6db92c97667ede144e142f4e5a9700b349bb6fb6c0f313ff5b3d7b4d9f15ebb1740de806e140585da45c669eaf35cb51ad1bba93d

Download Submit
C:\Windows\Temp\{4DBBA5D8-2716-4A7F-8759-4F758EA75343}\.cr\VC_redist.x64.exe

Filesize
634KB

MD5
464799b58f1090430afa4aa6183bedb6

SHA1
f2b3d878516031e4d968fa8d7b160a14e51688e8

SHA256
42305b0bdfc29a9b03bbbf17b0adc12146cdb37031ae51029b440d537f714571

SHA512
7ab70eb7fdcc107bc41c345b8ca7414ea40f7c3b566614d7767d5d9d93b84cb73d14e447b8a885ce71fb1c46a2469b825a56946a1ef7ac0f8ffdd3110f08d97b

Download Submit
C:\Windows\Temp\{B78A9612-0D80-422C-82E9-6CB56BE31568}\.be\VC_redist.x64.exe

Filesize
128KB

MD5
721acb01cc4f30d9fa741b6726701164

SHA1
4d71a1ce063810079eb2f9e200ca056c047ecbae

SHA256
dac5fc531dc1ca9f7a3bab14246cb153674e126f5eeeeb473d311974fe434a57

SHA512
9d30de3e96609ac6eaac5f66646f87751e5daa55c39d052d6adc891c676ce21364c3c26837b26a5db982b8a414f4ce303fbdcee1f5bd618f074f19a024f9d0e0

Download Submit
C:\Windows\WindowsUpdate.log

Filesize
16KB

MD5
63a3757e8cc89a94668fd776e8fa02df

SHA1
f7a07598e7a6c9402ab5193bae93d9796b5313db

SHA256
df6e842b0c92f9a2a3f78290baf64b659c4061d41ad0c651f207a306d55fe9ea

SHA512
92836d0ed117b8c55c96bb16794daeb15d43485900538ec2b1023573318800eb8f78df994644eafef0d5032b931da3f9c51229abd8be4c5493887358c9e61c57

Download Submit
\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
908KB

MD5
714a806162fca70c86097a53eb60b1e2

SHA1
788638fdb4547a4489b83074925edf89a52e94c8

SHA256
32c287ae2068fef75ee21693330608129889f95f57f4251c2dbc37914564430b

SHA512
9dd0bd3be69c34a7e1660528efad56c0737ec55ff883ed9311a57b1cde6b87f2799272072eef1b995416d9bc00f01d390cded3b22958adf5a87dc0325da3e7f1

Download Submit
\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
896KB

MD5
c63828500306099c008f260e01792e9b

SHA1
f972528ce40742cfa58a76b76fbabbd80ed4a0ae

SHA256
f16d850c8449e71d6c011c182a81b87de5d1b14b0ed3f10cdfa6018dffd20826

SHA512
5e401920e8f9cc7a8096bbaa4bbe33a9f2de1018f39eaecf1199e593ed5f005b2ee3341a1dfac80aabe61f5310ca54058e3ec2ad34cbbed1a442c96c888289ec

Download Submit
\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
768KB

MD5
48e7054f7de49fce7410210eb207795e

SHA1
fdb50d635f5f0f19a1143fc0a58ff254bd0d6a84

SHA256
91353365e609114a80e715d2c4fba667994d34a131a74482c2e55071d0a51c91

SHA512
68bfabd04e4957d57f846975854c897bbb961b3dfd6269fe1128543d3efcd43ccb77feb332e4465fd644a00d7cf722df1c393cc796481ef5484c98da8cc45a15

Download Submit
\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
704KB

MD5
0d7439b16752895be5a321a0fe5efca0

SHA1
96e4db640bb2e3d9821a5c076610cdcd0f3bead0

SHA256
d4d98a87eda2785003b260fd2d3f17d02ac00bfee7ff4d1432bd73c3a98c9d57

SHA512
7173eed4c22b51f6fc54c9d49b072245574765e6ffcf4c7f46a978977883bdf4f71ad823e92478c0fcf0ebfcd5fb5dea4589761f4f7616ce47e536890f463a3f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe

Filesize
3.4MB

MD5
16f972525e5a66f32e554bcdc350a898

SHA1
fd6f8f1481df4347db5945c71e9d5589e790cbf5

SHA256
aaaaa62956d9449e98185f12764fc0a0f80e813bf383cdd2384a39e8e7aeddaf

SHA512
a8f5d8ee40d42c9875046557f63e012d786b13cdf8df5836c8560a0e4cb47c2b5c8113797af6420329b993f03d892859ac8a1f6d29435d8a8ec2f7c6e5703017

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe

Filesize
3.5MB

MD5
b3c852b729d33d8cb5a35fd9e297ea88

SHA1
209d3cc0a4b7552f7f6f693af769f7c3142cf721

SHA256
2d434c511163945867ff46c09724872028492101511cfb45db75ab8405c14b1b

SHA512
95f54639c088cfc0bfa3f37daf8c77d9d6bdba66bd4f97c39cffcd05cc245ce8d150f266fcd59588aec419b95632fa95eae0492586adcbceac1aed03986b6217

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe

Filesize
154KB

MD5
fb23da30c465ee6b1b27cf62e5c00387

SHA1
8f5518739ba2412dd5c093244dde7f08b4047e4e

SHA256
6c19608ce9aebfd6bce7e94099f27198b94622b2368ebf61f4dabd80cb73ced1

SHA512
e0ecacb8f7be89870563eab4291506285c599d3a739fda05445e685a5e686ec041fb2816c2cbde795a9a2f9cee88c3a0c0b3fb1d35d853dc2b61d8e14545b4f9

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe

Filesize
229KB

MD5
eeae5f6037c62b29e55c93dfbc3b446b

SHA1
e1fcbe7e35845e6b3adbab1f376b30e6228e6d3a

SHA256
858f7d82a1a3f56ce6de31758a865918d93b89d5f7c9c144b22f394eeabf2c95

SHA512
52b251b60ed2f0108111bb86a17da04b6db174e4beb14f8efb90a9b2994a43ad8a32a8070c4f937e0229fccee83c2a662b19042755f2353dfa182d812a7af5e1

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe

Filesize
284KB

MD5
03d77b33ba4d5b4cf2e12165c459778f

SHA1
2488239f1e99070dc661afe414b5d973891ff9c4

SHA256
2772c4aa04ad70ee65fc5aebbfa32fd05591ac2aac2653e523850c1d4bc56126

SHA512
71f2d621d7a3d82d29116b36d004f299b812fc8ed759883811234465a481c4d8a2efbedc37c024539b2758ebb197ff8c56b12b90990822506112e5108a41aea7

Download Submit
\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe

Filesize
2.0MB

MD5
f18a1591b31340e0d79723a6108301e9

SHA1
fc8430721fba02757945d9ca162cedd382807b21

SHA256
08d825c8b4379a713e931e30daf70663ddb98035e7c57a369ba9a268caba7de2

SHA512
a88c968c8dfa3e343b3e6ee6294c51f54800aba4724307f39b39093eaa2ea6475d61b6e903cd3d996f9159419b87def2f7ff4b443a2ef3d9ba8819ecc02b5e05

Download Submit
\Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
\Windows\Temp\{4DBBA5D8-2716-4A7F-8759-4F758EA75343}\.cr\VC_redist.x64.exe

Filesize
512KB

MD5
15523f39ed161e56471d2a40bb5f2818

SHA1
bb21e7e1dd6e32e1db8b1f205c412b4b412fa14b

SHA256
18c776904a6b63d0f869838e31c8fcb91fcfbf2cf760d82148cb0f2db6cb8395

SHA512
fc15286971f60edb05148c3a6107326e3ea2a4db59fa299dd9d018d4083e5c9f923f67c34fee93a8fae3bb5da35ad3c6011b944c3db56c4abb854b5926ad30ec

Download Submit
\Windows\Temp\{B78A9612-0D80-422C-82E9-6CB56BE31568}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit