Overview

overview

7

Static

static

3

Feather La....9.exe

windows7-x64

6

Feather La....9.exe

windows10-2004-x64

6

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...64.exe

windows7-x64

7

$PLUGINSDI...64.exe

windows10-2004-x64

7

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

Feather Launcher.exe

windows7-x64

5

Feather Launcher.exe

windows10-2004-x64

5

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...up.exe

windows7-x64

1

resources/...up.exe

windows10-2004-x64

1

resources/elevate.exe

windows7-x64

1

resources/elevate.exe

windows10-2004-x64

1

vk_swiftshader.dll

windows7-x64

1

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows7-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...ec.dll

windows7-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 18:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Feather Launcher Setup 1.5.9.exe
  • Size 104.0MB
  • Sample240213-w2b4vaeh8y
  • SHA256 6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Feather Launcher Setup 1.5.9.exe
    "C:\Users\Admin\AppData\Local\Temp\Feather Launcher Setup 1.5.9.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe" /quiet /norestart
      2⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe" /quiet /norestart -burn.unelevated BurnPipe.{191A34C4-3D3D-4197-9438-E6E512DA7D50} {9BD776DB-48EB-42CD-8204-19EF55817B6F} 2932
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2056
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 392
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2452
    • C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe" /quiet /norestart
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Windows\Temp\{4DBBA5D8-2716-4A7F-8759-4F758EA75343}\.cr\VC_redist.x64.exe
        "C:\Windows\Temp\{4DBBA5D8-2716-4A7F-8759-4F758EA75343}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe" -burn.filehandle.attached=224 -burn.filehandle.self=232 /quiet /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2848
        • C:\Windows\Temp\{B78A9612-0D80-422C-82E9-6CB56BE31568}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{B78A9612-0D80-422C-82E9-6CB56BE31568}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1E8DABA8-0345-4097-BBF6-DEB42CADA2C1} {F7B4A2EE-4C0E-4B1F-985B-6670A7875939} 2848
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          PID:2260
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1912
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000060" "00000000000005A0"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2836

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Feather Launcher.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\Feather Launcher.exe
        • Size 2.5MB
        • SHA256 ffef1c9a3ccccab2b24a4bb32d59b5e4dba01e8604014563df53fc4e6d95496b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LICENSE.electron.txt
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512
        Submit Download

        LICENSES.chromium.html
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\LICENSES.chromium.html
        • Size 1.8MB
        • SHA256 14deb731a9f7bd7b2b535b4d6698c541711d1c0fdff9ce0814623d78418f3eed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        chrome_100_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\chrome_100_percent.pak
        • Size 126KB
        • SHA256 662a9db6ef4197cb4b6c50648a2cafceb7fd903015828df3fee605a602370be0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        chrome_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\chrome_200_percent.pak
        • Size 175KB
        • SHA256 d4282ae977f23afe252e19e421c8d09696ea3b83a1e73a6aaebaaa5547c74cbc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.1MB
        • SHA256 969d1b8c4301fe0e385baaf48c028fca00b1a42a54afd8616aeb7f76af99e571
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\ffmpeg.dll
        • Size 2.4MB
        • SHA256 839892fe2c10b9d32842c0c7b2784a0a453ac76da80dbc175c992a9f343786ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\icudtl.dat
        • Size 2.0MB
        • SHA256 d33792db61f0bc20c9d8ed4ecfbcf1773ae8c48e2b3abd33e9b4b0e968f8a158
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libEGL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\libEGL.dll
        • Size 458KB
        • SHA256 498fafb59d3d1a91fa24f95a59411dacf3fb373408e8ea5f931e2ed6b2732d36
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libGLESv2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\libGLESv2.dll
        • Size 1.6MB
        • SHA256 c6d3104377483ad7276e2b9a447caf81e38a5472f8bc7a2dbe7f49e80a74d6ac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        af.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\af.pak
        • Size 305KB
        • SHA256 4407b169bffd8c68a20f06c1256b43ab411e0a2f2f067eeee332e6064598964a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        am.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\am.pak
        • Size 472KB
        • SHA256 13e16e9c30eccc579be94a5208b86c7c541cbee5855683b6d304a53850890fd0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ar.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ar.pak
        • Size 64KB
        • SHA256 78b7d0e5e5e8ceef9a9e0f2400845ae461f7b8df082edd6b4d6f456d5e52d7b2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bg.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\bg.pak
        • Size 65KB
        • SHA256 62a2a1502442d80c605dfd51aa2abcf623a039d9b6af02ecd47a48c357168b67
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\bn.pak
        • Size 64KB
        • SHA256 ee9d426c38a429314ee6bd694e5d60839d0c7ab146606b7610821a42ccfc4364
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ca.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ca.pak
        • Size 363KB
        • SHA256 95758e3b0e83067a8eb8f135f1a9f6112db18ab6a21981c5ec32c899c729a159
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cs.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\cs.pak
        • Size 64KB
        • SHA256 4777810902c875206ada5a663f89fb6fe12e6a50207bc7f54c9e24aa2c0fa16c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        da.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\da.pak
        • Size 19KB
        • SHA256 b63a3cf7124f41f34e932591d5891fb99c4626d8707e3482eb9cf02dfa981525
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        de.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\de.pak
        • Size 21KB
        • SHA256 297d6a3450c3454d9259b18637ebffb762cb66409c64812f62838dcb43f244e4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        el.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\el.pak
        • Size 650KB
        • SHA256 b4bdd19191dc4bc22f8a3ecab032f034b0c0c0669e9a5ba1b42717ec0b5b418b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        en-GB.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\en-GB.pak
        • Size 293KB
        • SHA256 e252661d412a068610ac2e2a64609f21f71c64602c579a14d7e6ee59d08fdfc1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\en-US.pak
        • Size 296KB
        • SHA256 bd67fc968d75e77f2bae7ad552c398ccc4dad8635d74814c2046f813010c45e7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        es-419.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\es-419.pak
        • Size 358KB
        • SHA256 45f136986a226b1385189997aad2f660d0f518cc9871862250736237e0b105cf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        es.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\es.pak
        • Size 359KB
        • SHA256 e1a9180677d2989137e8dd381e6c847c47b385a6d3e965a047829479317736ae
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        et.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\et.pak
        • Size 323KB
        • SHA256 8e75989893f0d59f6ccae2042231ec8e7dea6fbc78210700d0d1d3a67f6b1d59
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fa.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\fa.pak
        • Size 2KB
        • SHA256 78aeba98b2649b36635d5e28e834c07b60525674b15728db920c3963edfb846f
        • MD5 SHA1 SHA512
        Submit Download

        fi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\fi.pak
        • Size 332KB
        • SHA256 0b41ce33c0036aee83989ce4ffc2d096b2f6fab77634e4bb500ec70a51b4e0bd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fil.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\fil.pak
        • Size 372KB
        • SHA256 742705b1c87900f6e8f02fa112d2cf13ffaa6c09c62a7dc34a2cd6a29608dd10
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        fr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\fr.pak
        • Size 2KB
        • SHA256 e4088c664ad8763a04273206273babdce94ee98f07a28db55a935ded2b9590b8
        • MD5 SHA1 SHA512
        Submit Download

        gu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\gu.pak
        • Size 740KB
        • SHA256 984aed687408ebdeb291a57893034490d6acfe9d34546dcc3715f33c8907ca61
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        he.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\he.pak
        • Size 458KB
        • SHA256 4e972808f0a25619462a0390105e8a869037341a30b3481b3c80d918009efdb2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\hi.pak
        • Size 771KB
        • SHA256 b23dd1037a3d133ef29b73f5fd90765a7af9f0f69b24858343acb084a59b01c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\hr.pak
        • Size 358KB
        • SHA256 66e85a46152b7baa26b2fd8d6af3df0ca67f54b75281aa08cf6a0f7e769aee8c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hu.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\hu.pak
        • Size 387KB
        • SHA256 df6c21a38bedd4c6d02ab60650f4c34537e238d4c72b96b2857973027542c3d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        id.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\id.pak
        • Size 318KB
        • SHA256 788a4e41a8e6b70e714913b4894a48fdf24799f7a20320565c523b233a41a8be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        it.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\it.pak
        • Size 353KB
        • SHA256 94652279dd554461d91613fd2cf295e0c68a7fa46855c53172781b15a5b2bcb7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ja.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ja.pak
        • Size 430KB
        • SHA256 1b3bcb7b6482cd9b005aaf30ccde3b4f3603f0a9e1d0f2209d70ecc74f7353de
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        kn.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\kn.pak
        • Size 854KB
        • SHA256 c06445ffccb52fca884686db4eda33d315d8340fd653c199c0fd8a07d1872720
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ko.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ko.pak
        • Size 321KB
        • SHA256 801d080c613f96debfc0a8831d830de45edb566f35e1355bdb5e6d5de47cf8b8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lt.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\lt.pak
        • Size 387KB
        • SHA256 da21c47633640002d0eb397d9f2685df542b6f5e53ee3ca655340750de2f3217
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\lv.pak
        • Size 386KB
        • SHA256 1af1ac2692035d502e772f976c977936d0feb42f65a9096e0af2fcf8b7df03bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ml.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ml.pak
        • Size 897KB
        • SHA256 c990dd02ea8ccad94f5002b2b05e74ad258a9b13ec1168732cde06d0723e2a91
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        mr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\mr.pak
        • Size 728KB
        • SHA256 c20543bde56b4ba78b7efd8a1fd4d6990e751ea7e243c91a2e83ca78dc0d9289
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ms.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ms.pak
        • Size 332KB
        • SHA256 d51d9f4fd2be492a751db6898b4c2843b2b6cbfe893bb66ffa4eb8e1a66e7e5f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nb.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\nb.pak
        • Size 325KB
        • SHA256 fee60b6eff88716fd8ad4a9b2da8b16827753c819671831e2d7dc2723aee3bf8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\nl.pak
        • Size 336KB
        • SHA256 361d54411d890d26fbe6d1f8e8f8258e72afca143783f9f16145b9f4f5f9333d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\pl.pak
        • Size 373KB
        • SHA256 fb1dc5b556f59b6ad642167f1df9e654517ad494559eb3f441ca8f79d56a86e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pt-BR.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\pt-BR.pak
        • Size 353KB
        • SHA256 1054376071aba92b165cf561b7931a18ae0b29c9ca22eda85c5c9c7e6721e49b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pt-PT.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\pt-PT.pak
        • Size 356KB
        • SHA256 e5c382258030217591f439a4020069378c3362677258d5129c69ef8e25abd6c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ro.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ro.pak
        • Size 365KB
        • SHA256 d56825b2ad81fa419b428855d8b3cff01015a446b7cc989d7b17fe1b3b5f45cd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ru.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ru.pak
        • Size 271KB
        • SHA256 21a12ab5d80f7bd18d68723b9123e4376894534f4aeccac638d3189bb7cb450d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\sk.pak
        • Size 376KB
        • SHA256 fe43904bfb0072add943ee8d44e9f92a80eb2aa55ce7157de52ea625c277db53
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\sl.pak
        • Size 362KB
        • SHA256 5015c0685b66ef38c92ffc4963e144e913b646d8e855f3976e50c8039879cccf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\sr.pak
        • Size 560KB
        • SHA256 a0ef17a572ce510796886b844226b65991bbddcc71b763b91569a07ef23d2070
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\sv.pak
        • Size 328KB
        • SHA256 21c7d459c55f255c6da5a6454eafc836a3bcdba9c99c76bad0f0d6fbbe7a33ef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sw.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\sw.pak
        • Size 344KB
        • SHA256 a8d904e4871efa01c72ef64bab601e6cb1de216db4a696966e90fe1b733bef17
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ta.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ta.pak
        • Size 880KB
        • SHA256 fafe173abc2ca773026b0caa24e693a0ac4c9d0ad7c40258bece10e4714dcb15
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        te.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\te.pak
        • Size 819KB
        • SHA256 29e4d010c6b951c129633aac0f55b70107fd24dcf1062c20e263611e30ab4b93
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        th.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\th.pak
        • Size 690KB
        • SHA256 bb8b656b1d2c4cf5f361f59b44abd4809cd774e664dbd0f90b62b97ea125e3c6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\tr.pak
        • Size 350KB
        • SHA256 e31a9cefcbef64d082b77a16a2d5dff11673f74363cf9fc34e36004a62e308d6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        uk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\uk.pak
        • Size 192KB
        • SHA256 26fa30505f7601e1064bc0dbddab58be0c1736f0b16c824a890cb1d888af79f2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ur.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\ur.pak
        • Size 192KB
        • SHA256 2a42ea2cdc0a0a0ce80076b5601bf9ea01d06cb75d52150395990f6ae6c4d383
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\vi.pak
        • Size 128KB
        • SHA256 0427ac6aaa18a5bc1f54ae63ed360529db625a759b011d4b434d1d7638e94033
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zh-CN.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\zh-CN.pak
        • Size 128KB
        • SHA256 f4bbadfa519c40236613183d6fd6e6fc7a375a68825fefff615baff32d75840d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zh-TW.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\locales\zh-TW.pak
        • Size 128KB
        • SHA256 9cfe268a9808ac2acf47ad9387762b04cbfa3b131ae0707d535215497f1e6f97
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\resources.pak
        • Size 1.3MB
        • SHA256 51340efccdc2ee59c974d0796bcacdb2f6fcb701ba997af55527b7c89ea71e85
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        app-update.yml
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\resources\app-update.yml
        • Size 144B
        • SHA256 53c824fd08de03ee221296cb75ad6e8c3cff5b8254a467180197cb308666377b
        • MD5 SHA1 SHA512
        Submit Download

        app.asar
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\resources\app.asar
        • Size 113KB
        • SHA256 acf01974744385942f30a123c814b4ebb0125a5d6de61c4cc23a5478b8c0ef93
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cleanup.feather
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\resources\app.asar.unpacked\native\cleanup.feather
        • Size 64KB
        • SHA256 11dc6a42ce919a7c3e466ff0edcecfee46a84f148dc376c15f7e590d0bcaabbf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        elevate.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\resources\elevate.exe
        • Size 64KB
        • SHA256 8a9cc57d6f67288e44edbfa17f1e135e30385e5542d758c7809c090e86227d34
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        snapshot_blob.bin
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\snapshot_blob.bin
        • Size 401KB
        • SHA256 2590aa136bc101f1075e42cd8939c7679ceb35b773c989be2ada49acaffd01a5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\v8_context_snapshot.bin
        • Size 716KB
        • SHA256 f59fa568139442c7f547fc8a5a0fd090ddc8427cc409e2fcef0518a9dcb47a96
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vk_swiftshader.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\vk_swiftshader.dll
        • Size 850KB
        • SHA256 4e863183b44df90c75d49cf01bc6bc15dac9e4f731eab2fdab438a4f5c34b75c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vk_swiftshader_icd.json
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512
        Submit Download

        vulkan-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\7z-out\vulkan-1.dll
        • Size 849KB
        • SHA256 ea1f3a66f9322d20da4542c42595eb789e532a224a0338dc488e998ae00e59ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_redist.x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe
        • Size 2.6MB
        • SHA256 73534ed5580dd737394ee51a7bff4182c807cf7f420b2b1e3129591a90e73a16
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_redist.x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe
        • Size 2.8MB
        • SHA256 eb91e7d276dce2b46e4de75dacdd7341e45e3686d6d28c35b623380f9d519f19
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredist_x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
        • Size 576KB
        • SHA256 4f76198299753221a79b9bf0226d1895faf45f06bb6b8b0b12dd55e8039cbdf2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredist_x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
        • Size 192KB
        • SHA256 6427c292efc61774c7ae66b295a77da78e4e0eb870eace87d13a471054f97d63
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredist_x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
        • Size 42KB
        • SHA256 6f7140310773394a32653721f95ce75d1e482981680855cdbe255a193752f1b9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        logo.png
        • Path C:\Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.ba1\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512
        Submit Download

        vcredist_x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.be\vcredist_x64.exe
        • Size 455KB
        • SHA256 e52469f3bce3768b43615ba44bc891dd2cda1b8e05659debd0cdbdebaaf9b199
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_redist.x64.exe
        • Path C:\Windows\Temp\{4DBBA5D8-2716-4A7F-8759-4F758EA75343}\.cr\VC_redist.x64.exe
        • Size 448KB
        • SHA256 68d451f7cc0651f193d2fcb1fea57faf0b9f32129f9415116f41cdbd4f15f7f4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_redist.x64.exe
        • Path C:\Windows\Temp\{4DBBA5D8-2716-4A7F-8759-4F758EA75343}\.cr\VC_redist.x64.exe
        • Size 634KB
        • SHA256 42305b0bdfc29a9b03bbbf17b0adc12146cdb37031ae51029b440d537f714571
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_redist.x64.exe
        • Path C:\Windows\Temp\{B78A9612-0D80-422C-82E9-6CB56BE31568}\.be\VC_redist.x64.exe
        • Size 128KB
        • SHA256 dac5fc531dc1ca9f7a3bab14246cb153674e126f5eeeeb473d311974fe434a57
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WindowsUpdate.log
        • Path C:\Windows\WindowsUpdate.log
        • Size 16KB
        • SHA256 df6e842b0c92f9a2a3f78290baf64b659c4061d41ad0c651f207a306d55fe9ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Feather Launcher.exe
        • Path \Program Files\Feather Launcher\Feather Launcher.exe
        • Size 908KB
        • SHA256 32c287ae2068fef75ee21693330608129889f95f57f4251c2dbc37914564430b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Feather Launcher.exe
        • Path \Program Files\Feather Launcher\Feather Launcher.exe
        • Size 896KB
        • SHA256 f16d850c8449e71d6c011c182a81b87de5d1b14b0ed3f10cdfa6018dffd20826
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Feather Launcher.exe
        • Path \Program Files\Feather Launcher\Feather Launcher.exe
        • Size 768KB
        • SHA256 91353365e609114a80e715d2c4fba667994d34a131a74482c2e55071d0a51c91
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Feather Launcher.exe
        • Path \Program Files\Feather Launcher\Feather Launcher.exe
        • Size 704KB
        • SHA256 d4d98a87eda2785003b260fd2d3f17d02ac00bfee7ff4d1432bd73c3a98c9d57
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SpiderBanner.dll
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\SpiderBanner.dll
        • Size 9KB
        • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        StdUtils.dll
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.dll
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_redist.x64.exe
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\VC_redist.x64.exe
        • Size 3.4MB
        • SHA256 aaaaa62956d9449e98185f12764fc0a0f80e813bf383cdd2384a39e8e7aeddaf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WinShell.dll
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512
        Submit Download

        nsProcess.dll
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\nsProcess.dll
        • Size 4KB
        • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsis7z.dll
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredist_x64.exe
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
        • Size 3.5MB
        • SHA256 2d434c511163945867ff46c09724872028492101511cfb45db75ab8405c14b1b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredist_x64.exe
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
        • Size 154KB
        • SHA256 6c19608ce9aebfd6bce7e94099f27198b94622b2368ebf61f4dabd80cb73ced1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredist_x64.exe
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
        • Size 229KB
        • SHA256 858f7d82a1a3f56ce6de31758a865918d93b89d5f7c9c144b22f394eeabf2c95
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredist_x64.exe
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
        • Size 284KB
        • SHA256 2772c4aa04ad70ee65fc5aebbfa32fd05591ac2aac2653e523850c1d4bc56126
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredist_x64.exe
        • Path \Users\Admin\AppData\Local\Temp\nsd60D6.tmp\vcredist_x64.exe
        • Size 2.0MB
        • SHA256 08d825c8b4379a713e931e30daf70663ddb98035e7c57a369ba9a268caba7de2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        wixstdba.dll
        • Path \Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.ba1\wixstdba.dll
        • Size 117KB
        • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_redist.x64.exe
        • Path \Windows\Temp\{4DBBA5D8-2716-4A7F-8759-4F758EA75343}\.cr\VC_redist.x64.exe
        • Size 512KB
        • SHA256 18c776904a6b63d0f869838e31c8fcb91fcfbf2cf760d82148cb0f2db6cb8395
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        wixstdba.dll
        • Path \Windows\Temp\{B78A9612-0D80-422C-82E9-6CB56BE31568}\.ba\wixstdba.dll
        • Size 191KB
        • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download