6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7

Analysis

max time kernel
26s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Feather Launcher Setup 1.5.9.exe
Size

104.0MB
MD5

50cf11684fc7dd4030f36f36f2bda97e
SHA1

4795a86361032d110cb22ffb71711dd91f678cd8
SHA256

6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7
SHA512

f79e88c30f058de8e209837b20674867cdc2bf536b2496a50906abd823195f59df5af07beb77526680a6b5064235491b591b1696b5590a0e1dd947382148e6f2
SSDEEP

3145728:7KQEzgzrCBz+GBTRJmgm0IRoFO7Ahhq60XYJMP2ZA:Dw3zlggmtn7Ahh9mxeA

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6} = "\"C:\\ProgramData\\Package Cache\\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d} = "\"C:\\ProgramData\\Package Cache\\{ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Feather Launcher\vulkan-1.dll	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\cs.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\fr.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\gu.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\th.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\de.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\tr.pak	Feather Launcher Setup 1.5.9.exe
File opened for modification	C:\Program Files\Feather Launcher\resources	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\sv.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\resources\elevate.exe	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\Feather Launcher.exe	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\LICENSE.electron.txt	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\fa.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ko.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\nb.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\v8_context_snapshot.bin	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\es-419.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\hu.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\nl.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\snapshot_blob.bin	Feather Launcher Setup 1.5.9.exe
File opened for modification	C:\Program Files\Feather Launcher\locales	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ar.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\fi.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\Uninstall Feather Launcher.exe	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\da.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\en-GB.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\te.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\resources\app.asar.unpacked\native\cleanup.feather	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\chrome_200_percent.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ja.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\resources\app-update.yml	Feather Launcher Setup 1.5.9.exe
File opened for modification	C:\Program Files\Feather Launcher\resources\app.asar.unpacked	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\ffmpeg.dll	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\it.pak	Feather Launcher Setup 1.5.9.exe
File opened for modification	C:\Program Files\Feather Launcher\resources\app.asar.unpacked\native	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ca.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\he.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\hi.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ru.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ta.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\sk.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\sl.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\d3dcompiler_47.dll	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\libGLESv2.dll	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\el.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\id.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\lv.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\vk_swiftshader.dll	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\fil.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\pt-PT.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ro.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\ur.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\icudtl.dat	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\pt-BR.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\sr.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\zh-CN.pak	Feather Launcher Setup 1.5.9.exe
File opened for modification	C:\Program Files\Feather Launcher\chrome_100_percent.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\et.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\hr.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\mr.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\sw.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\vk_swiftshader_icd.json	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\bg.pak	Feather Launcher Setup 1.5.9.exe
File created	C:\Program Files\Feather Launcher\locales\kn.pak	Feather Launcher Setup 1.5.9.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57af3b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57af3b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
4860	vcredist_x64.exe
3164	vcredist_x64.exe
1368	VC_redist.x64.exe
1248	VC_redist.x64.exe
3796	VC_redist.x64.exe

Loads dropped DLL 11 IoCs

pid	Process
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
3164	vcredist_x64.exe
1248	VC_redist.x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000da362e54a03ebf190000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000da362e540000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900da362e54000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dda362e54000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000da362e5400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Version = "14.30.30708.0"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\ = "{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\Version = "12.0.40649.5"	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\Dependents	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Dependents\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12\Dependents\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\Dependents\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents\{ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\ = "{ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d}"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30708"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\DisplayName = "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40649"	vcredist_x64.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe
2880	Feather Launcher Setup 1.5.9.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2880	Feather Launcher Setup 1.5.9.exe
Token: SeBackupPrivilege	3612	vssvc.exe
Token: SeRestorePrivilege	3612	vssvc.exe
Token: SeAuditPrivilege	3612	vssvc.exe
Token: SeShutdownPrivilege	3796	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	3796	VC_redist.x64.exe
Token: SeSecurityPrivilege	1804	msiexec.exe
Token: SeCreateTokenPrivilege	3796	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	3796	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	3796	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	3796	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	3796	VC_redist.x64.exe
Token: SeTcbPrivilege	3796	VC_redist.x64.exe
Token: SeSecurityPrivilege	3796	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	3796	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	3796	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	3796	VC_redist.x64.exe
Token: SeSystemtimePrivilege	3796	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	3796	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	3796	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	3796	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	3796	VC_redist.x64.exe
Token: SeBackupPrivilege	3796	VC_redist.x64.exe
Token: SeRestorePrivilege	3796	VC_redist.x64.exe
Token: SeShutdownPrivilege	3796	VC_redist.x64.exe
Token: SeDebugPrivilege	3796	VC_redist.x64.exe
Token: SeAuditPrivilege	3796	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	3796	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	3796	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	3796	VC_redist.x64.exe
Token: SeUndockPrivilege	3796	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	3796	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	3796	VC_redist.x64.exe
Token: SeManageVolumePrivilege	3796	VC_redist.x64.exe
Token: SeImpersonatePrivilege	3796	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	3796	VC_redist.x64.exe
Token: SeRestorePrivilege	1804	msiexec.exe
Token: SeTakeOwnershipPrivilege	1804	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4860	2880	Feather Launcher Setup 1.5.9.exe	88
PID 2880 wrote to memory of 4860	2880	Feather Launcher Setup 1.5.9.exe	88
PID 2880 wrote to memory of 4860	2880	Feather Launcher Setup 1.5.9.exe	88
PID 4860 wrote to memory of 3164	4860	vcredist_x64.exe	89
PID 4860 wrote to memory of 3164	4860	vcredist_x64.exe	89
PID 4860 wrote to memory of 3164	4860	vcredist_x64.exe	89
PID 2880 wrote to memory of 1368	2880	Feather Launcher Setup 1.5.9.exe	99
PID 2880 wrote to memory of 1368	2880	Feather Launcher Setup 1.5.9.exe	99
PID 2880 wrote to memory of 1368	2880	Feather Launcher Setup 1.5.9.exe	99
PID 1368 wrote to memory of 1248	1368	VC_redist.x64.exe	100
PID 1368 wrote to memory of 1248	1368	VC_redist.x64.exe	100
PID 1368 wrote to memory of 1248	1368	VC_redist.x64.exe	100
PID 1248 wrote to memory of 3796	1248	VC_redist.x64.exe	101
PID 1248 wrote to memory of 3796	1248	VC_redist.x64.exe	101
PID 1248 wrote to memory of 3796	1248	VC_redist.x64.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Feather Launcher Setup 1.5.9.exe
"C:\Users\Admin\AppData\Local\Temp\Feather Launcher Setup 1.5.9.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\vcredist_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\vcredist_x64.exe" /quiet /norestart
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\vcredist_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\vcredist_x64.exe" /quiet /norestart -burn.unelevated BurnPipe.{99E1E9C4-5C64-4CF4-AE4C-692E192F443B} {5520C645-82DD-41C3-84AB-BA43FBAEA301} 4860
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3164
- C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\VC_redist.x64.exe
  "C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\VC_redist.x64.exe" /quiet /norestart
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\Temp\{CA4EE494-19DF-4E7D-B8F2-D6CFB7A26F1F}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{CA4EE494-19DF-4E7D-B8F2-D6CFB7A26F1F}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\VC_redist.x64.exe" -burn.filehandle.attached=664 -burn.filehandle.self=672 /quiet /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\Temp\{EE6D68FF-7D0D-48A5-8E96-99E3BF916C9B}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{EE6D68FF-7D0D-48A5-8E96-99E3BF916C9B}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{060FDEA8-E240-43EB-BDB1-5FD93BF0A5DC} {1E57EF82-9C44-42B7-BC9F-D34D8E8903A1} 1248
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3796
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d} -burn.filehandle.self=1164 -burn.embedded BurnPipe.{E800A8E1-D331-47D0-93AD-D92D7E6CBEF5} {E45C1EA6-19BE-4A1A-AB11-A5A4675041A5} 3796
        5⤵
        
        PID:2376
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=648 -burn.filehandle.self=668 -uninstall -quiet -burn.related.upgrade -burn.ancestors={ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d} -burn.filehandle.self=1164 -burn.embedded BurnPipe.{E800A8E1-D331-47D0-93AD-D92D7E6CBEF5} {E45C1EA6-19BE-4A1A-AB11-A5A4675041A5} 3796
        6⤵
        
        PID:2020
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{42DA9263-D242-460E-A8BA-8011E1C121D9} {364907AB-125A-41EB-A1D6-891275DDA1B2} 2020
        7⤵
        
        PID:1292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3976

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Program Files\Feather Launcher\Feather Launcher.exe
"C:\Program Files\Feather Launcher\Feather Launcher.exe"
1⤵
PID:3148
- C:\Program Files\Feather Launcher\Feather Launcher.exe
  "C:\Program Files\Feather Launcher\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1776,i,9249853422460792765,999783717867574433,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2928
- C:\Program Files\Feather Launcher\Feather Launcher.exe
  "C:\Program Files\Feather Launcher\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-path="C:\Program Files\Feather Launcher\resources\app.asar" --no-sandbox --no-zygote --disable-blink-features=GetDisplayMedia --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2240 --field-trial-handle=1776,i,9249853422460792765,999783717867574433,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  PID:5080
- - C:\Program Files\Feather Launcher\Feather Launcher.exe
    "C:\Program Files\Feather Launcher\Feather Launcher.exe" "C:\Program Files\Feather Launcher\resources\app.asar\preload\preload-skin-watcher-fork.js"
    3⤵
    PID:5468
- - C:\Program Files\Feather Launcher\Feather Launcher.exe
    "C:\Program Files\Feather Launcher\Feather Launcher.exe" "C:\Program Files\Feather Launcher\resources\app.asar\preload\preload-mod-watcher-fork.js"
    3⤵
    PID:5448
- C:\Program Files\Feather Launcher\Feather Launcher.exe
  "C:\Program Files\Feather Launcher\Feather Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --mojo-platform-channel-handle=1932 --field-trial-handle=1776,i,9249853422460792765,999783717867574433,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:2588
- C:\Program Files\Feather Launcher\Feather Launcher.exe
  "C:\Program Files\Feather Launcher\Feather Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3568 --field-trial-handle=1776,i,9249853422460792765,999783717867574433,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57af40.rbs

Filesize
19KB

MD5
1d46ef74a8bff98ec74eff188482673f

SHA1
cf2c55fe43f4463850bba397f7f52721a6b8baf0

SHA256
8b1fa09a06734ecde4f062b28348b9832d94b48288e262fb1edaedf85c2791e0

SHA512
e2a88929fd54464ea2c199529597f9a650e0259e640bf260a2032a01d761e72a16ffcfc9cb56a87be5786538d139db8e957afd9933a6300f2d0ef3061fc06e45

Download Submit
C:\Config.Msi\e57af4c.rbs

Filesize
19KB

MD5
c0344db8ce0c264759b6190f51c95f80

SHA1
3c0eaf6b690e1436052e79cdcf810cc2ccd602ba

SHA256
55b15d017a9c7e7b7c0c17c8e98568a50c7aca83be1b5b71f21237e5f6a74d76

SHA512
569f6058edcac2224bc1ff45fa08a111262c92cdfe4191fb0f79921cd2e5618f2410466198864a72ebe7d6e5d2400b6620fe1f4b775cdc88be2048dd0f0ea8e1

Download Submit
C:\Config.Msi\e57af53.rbs

Filesize
21KB

MD5
7713ba2a6b9e7efe085136b8e2b4445a

SHA1
0628d9522392e7124b7c9c9197439cd4694eceba

SHA256
36908bb2e7596df207b97b7e6f17f29a2d74c10c80d34bb73970b2831664e19f

SHA512
92b052cc82002cdaab38f4df88f68f0432fb94f9912968b95e463e78a2476d0a07f8fc2e36ecdd3fd6a718cf24a6db353b213826461926763cc9b7d2ffd1d3cc

Download Submit
C:\Config.Msi\e57af62.rbs

Filesize
21KB

MD5
6438a5dced184a3bcfeb400f92b036ca

SHA1
e6fbf0eed01fa396d66800452f36834aa53c977c

SHA256
7edd0d62fd4a7ac178e2ae54218811a0ee5e749783f108d095f0e1802e4f29a1

SHA512
3e47a89b20dbb676db7b7fdee3e2ccd9139917f7de12e8e19dfbd29b46cbb9ddf541098f2c73b838b753142b757bedca2c5553f263e1c110b7da86cfc6038e6a

Download Submit
C:\Program Files\Feather Launcher\D3DCompiler_47.dll

Filesize
1.6MB

MD5
930dc313097ffc012996fda4e1b5ee71

SHA1
70eba424f1236eed35ef3073f74adcb4836b46a0

SHA256
a3859f6831f8d3c6949c2a616939975340185425c9b5c70107acb1a121d7ee14

SHA512
f1b7db16352e1a69a4cd4fdee753d4d236c64486bae79ed5fe0f795d388b603b9037a6a2796efd9b95c5c4459d993dd1c619a2b31ecc893845cfaf591364b190

Download Submit
C:\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
460KB

MD5
c213fab58afe246ecac06c8506a0c857

SHA1
8d396816b866edc7dd0b39f8c25ac686164f8fd8

SHA256
5f69aa4c6f48bdd751b47991e61b9b6db4d8cfa664c025eca23498dd6ca4ff09

SHA512
e63192ebcf8030118aaef15b8ac052bc106341dd2eec08edf1ded572ff4b864510b40aa1c781e28c172d0895ce0185f838e6ec46eccb2c243c4e384221310e56

Download Submit
C:\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
343KB

MD5
f7256ee4659e7d26c94e49f60f71a525

SHA1
aace8a1f8eb4f233ab9b8083603c8a21542e3d1f

SHA256
71c08444acfbd12ac72224a3d89fff6aa7034aabda7e0240dcfdd174faa2b5a9

SHA512
3d3cd6d95eb42496119c1ca8ff74c00f8add574eb29f637ac903925d547552a02a0b61efc88aa2acb66211c23ce491fb17cdf036ad54bf5da47a90b40a858986

Download Submit
C:\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
2.6MB

MD5
3b37318d4a39baffa93f9c219018a308

SHA1
d7a2ef7f9baf3cf86ed5232b095dcb300882044b

SHA256
b967c633e06d8167ead77f5e9a9e93ef0e849fb1a669d2766e9e71ce683b0cac

SHA512
0c455b249bd2629295bc24c493e565622edc9f1551f6cef04ea0668c56af13b153019ce63cd9b3a18052ab0dbe8c795aedd6648d5787705190e87f118f19b379

Download Submit
C:\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
1.9MB

MD5
b65bbd054310476b5139cfc70a63931d

SHA1
608d223f871e8ae5014a93911b973761bded4ce7

SHA256
2d7686d2f003cfcc7d026c8aee6e6c7ff6da99ccf4503d1a9ec9b803c36f9a6d

SHA512
26bf5f4f44f676d8618c145dddd4149e69820fddcbcc1878062e7b22dc563bc431dc74ed5cdcebcc08cd454fd8bd3554fb4f32cb1260166163683df2b5b5817a

Download Submit
C:\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
2.0MB

MD5
fb4220aebd2bdb98406b74a91b156f58

SHA1
34d161ad23f468a2d08b0f145edef64d2377b55b

SHA256
de3d1f1bd3d2a11c63cce9669b1f75d71061102fa66d49fc05a14d0cfbb783e6

SHA512
e8102477ee7c1b6a2ab405959966a256f1a54772de1fd77211193254b900b98655334288de134b76b85d80c0218eb81cd80a4664889475a266fb628e96e0982e

Download Submit
C:\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
1.8MB

MD5
ed7e12435e59dc032972a44c03c553b3

SHA1
0e4477295ce569d41dfa5ee2fe7119ff5b83aa7d

SHA256
4a5a6161fdae7e66b7e32becfcef0c1936c369bc4cdae614e2e830e1143b0968

SHA512
ea7a027ca2dfd1721385929d56242236da21d41f84e163ae8c21a26f5a3aaaeca76301efb130a19e14665c6f9e914929130b2e6ae498a03d350f7d661abd9881

Download Submit
C:\Program Files\Feather Launcher\Feather Launcher.exe

Filesize
1.5MB

MD5
402eeed84f9be744dde5c949b8574c00

SHA1
c5056483426ab86fc335dea8eea764b81f15b8e2

SHA256
59acfafe6b6cdf9d5fdc8e08d88dd3cd980fc5eb7464be5c32b0e035ec92d4f5

SHA512
2911d20f043a024dbf422e699f6ebc049633824f1955d24d309279b131f8c3519f1374ecac539f34aba87142834376dc613865d2c16de9512434071a5ce95c0c

Download Submit
C:\Program Files\Feather Launcher\chrome_100_percent.pak

Filesize
126KB

MD5
a3d4515d3a33a407d313a62818e82a5d

SHA1
967ff9a6774a66f7b3299af4fd5d70961ed54d79

SHA256
662a9db6ef4197cb4b6c50648a2cafceb7fd903015828df3fee605a602370be0

SHA512
0c757e1beccbca1ae0791fa0c51a9e2019696bd0965c73de67b364fba6f317ea2cf20fa65e4fa7dd22519683528e5112dc8c530049170f4e702e0c8d4e065801

Download Submit
C:\Program Files\Feather Launcher\chrome_200_percent.pak

Filesize
64KB

MD5
25cf39165e05a57a9c88b9ea282dbf4c

SHA1
a9b98096275e2522788f8381cd51ac159e9f11ca

SHA256
85bcdc12dcf72f4fedf2d24b13f5d25c44b2027a90f49e372b41eb7a91484c1b

SHA512
b5b9b9a4deaab549f6f386c948e2524c9e6f534b8b4a6adcfd1a60e7e9482ff5c84158cb6ab4328cfd28c1ca5a62c5185a0922e11b2496a3616bc59460491c55

Download Submit
C:\Program Files\Feather Launcher\d3dcompiler_47.dll

Filesize
1.6MB

MD5
f6dfcad5e73a449d3b3cd26727ea127c

SHA1
70b5e62f464c331f922e8d7b0dbec67809ffd5ea

SHA256
61643013640a8bd57db9719918f7e2b6e6fb18c3f8ad0ff1fa0563df59296762

SHA512
4076882335c8670d4ba36f556884009676199fc42374ff8831d4712fa7b14f6a30f515f5668b4dfad641a4586c4d21279bc125d2b9f8e1c9279f33750a40cb4e

Download Submit
C:\Program Files\Feather Launcher\ffmpeg.dll

Filesize
455KB

MD5
b01deacf414586d28c4a9b2b180c0636

SHA1
b84171f6606d0dfe4aca2c914c798df8b1fa3027

SHA256
f9afc63392c9050d82e49f73366ebaf8cf5f50eed46316268042a1740d107ada

SHA512
f404d059179d90c813c174c8b92a9cabdf0f08fcc6115a0db5fb1ba832f649593c0d1b5b2d1ef0fc37333cd9092302f5f4852c0aed02040537ef24b5849a9840

Download Submit
C:\Program Files\Feather Launcher\ffmpeg.dll

Filesize
453KB

MD5
a232a82b6f4555791f2a23db672a4ac4

SHA1
052f36d95769c13f8a6da21e053c093f5ca54ad3

SHA256
c76e04d6138672af786442b670a689b7e38d7903b62e1822934c75dfbbc093ee

SHA512
4b864089ba8e35ba3b123b03413d5378eff9fa6a1f39f31d7f707ccd6d1ad0829be6c28cabb3793019f2fdba14a42fe7859f96ccad1fc27390d96e698bc47b9e

Download Submit
C:\Program Files\Feather Launcher\ffmpeg.dll

Filesize
1.6MB

MD5
0925279e8a3207b1e3000ecb1eaabdd3

SHA1
6e14fbf328fc5ee910cebd71364eafe92ff4c7be

SHA256
f554ea46edd9f1de217c0c46f51c28f02bba850108ed440a0ddebf270c116bb7

SHA512
45baf92595702aaca05256f5e7a3f60373c22d88fe32a168a1a90c8c8fa8bd8a96b9a4237430488f87fd3eddadcaec7ddf151c68fb01940d3f31c6871f21b8bc

Download Submit
C:\Program Files\Feather Launcher\ffmpeg.dll

Filesize
1.7MB

MD5
b4d0a794bfdf4861eb39f359e66fa093

SHA1
62985f816af537cdce429d77604662e2ddc97945

SHA256
7c1164f3f4be3930f370dee8776cab2c3060d578006a3b6b3a3397ec56a79428

SHA512
041d8ebffb711d4529eb8f4016b3024b8b72ec2703fc5ebf7ef01692bdc49ab4179544b9124241450e269ae0d0422446d620f5751c47e6c4727850276ad3d67d

Download Submit
C:\Program Files\Feather Launcher\ffmpeg.dll

Filesize
2.2MB

MD5
2702b4d57e5f4f8fb2f617521e81da9b

SHA1
82c0194e58df4075840bbab281594863456cc30e

SHA256
0e67bb97104d5b81e7ed0fad62ffba02637e9bdc176b3ea29391faa0d65c7d09

SHA512
7316288d086fa4ad39f75c423797da226c2c8660989a6ddfb474bccf8cfaae3a207adc3713b30c501d4b474cd41b1f5dc7c0832d68841214dca164d576397d87

Download Submit
C:\Program Files\Feather Launcher\ffmpeg.dll

Filesize
1.8MB

MD5
d9b8dc551bc99e9d45fd54fd769f569e

SHA1
6de0709f9d2f9806bb031cac2a0238fd60cf8d59

SHA256
a37ca9ec31c4e2a95ba677ba5f1f10b2515becea9365f3603eef1e27602a2a34

SHA512
9855c144ef69e2225eda00c7e021603799c41df39e7d2aec9e5321edb554b334b8db59099590f471f5e3bd5a6f20fdee9dfc63b126a1c0f035a8db862c34dfd6

Download Submit
C:\Program Files\Feather Launcher\ffmpeg.dll

Filesize
1.7MB

MD5
8d52b99e918528771d2b78258374a5ab

SHA1
66b6ffb9dcfff8c17664ac350feeb04754d2a514

SHA256
2eb11ccb861fe3fdaed4dd7face46eff1ab6bacce9a3acd959d3778005df6831

SHA512
c0f356de92d5ddf60643c99f55b1e4ac5c067277d3901dc4bb65d4590fbbadfcb6be00cfe514fe0094b3880019526aa53de4bf97d490bdde941f7a792922fdad

Download Submit
C:\Program Files\Feather Launcher\icudtl.dat

Filesize
1.7MB

MD5
a35d150a80d319d5b115671dfe8879d1

SHA1
621e6f6c1c29a644837210fc0822e27d527f3d42

SHA256
80aeac426d99753ea85a7f5c1630e6dba67237e7d2aac59c454b7a4933cd2df9

SHA512
16b3a120c344abde81f26d02a4543bb1e146a1f8cf85a1a1cd58206c3b18d2e06ff294db5c2f1617e25ab4c97a155fffca5a34e2cbeb12e72dd60770a654a1fd

Download Submit
C:\Program Files\Feather Launcher\libGLESv2.dll

Filesize
1.6MB

MD5
fdc39f158796ae7bc8dc57ad5d70dbe4

SHA1
ca709fc08fa19c88fc2295cf14be8deed0e39bc6

SHA256
47e025cd41f25257265085393d7687c05f4e7669e23a3edd9ec180672c135dee

SHA512
e4139a2fa900d31d26fed31bf4474888e303adfccfd764e4deb576722615587ccb4e154b35e8b6afff164b95ef33a88096b115b82b99a9587b6f688dff40bfde

Download Submit
C:\Program Files\Feather Launcher\libglesv2.dll

Filesize
1.7MB

MD5
7880368fd9894242b7891ca124a3db8d

SHA1
1dc0a1fae4e88700ee77c50b20d53f33b8bfd0b6

SHA256
c89e180892163eed65a5a275a25760a7da422cc695b15eecbc344731d542fdeb

SHA512
eb965eb54ccaad6f41d32dc3a6bd94f82672c96bc6bdb84593d7c2ccefd7067fa8091af6d8e43c98d0bdd0d5e60524f7c02d182ed30e5f178c05da607cb977c9

Download Submit
C:\Program Files\Feather Launcher\locales\en-US.pak

Filesize
128KB

MD5
ec3d7705101cec092e003f882ce7fbfa

SHA1
cfc0c88edd63a4766edbc27e80faec098d90777f

SHA256
4f4129fedfd283202c5b315f9f8fa69188601d668f645534bf68ce6874602c42

SHA512
80cd62aae9522f8ab54ecc347120a9d469ca71aeaf5e7c6f2a780cf36e7ab998eb5468efbe2f90c7fc5b3b8ac64288286ae0cfd7cb609a9c0a01f4be156cbbdd

Download Submit
C:\Program Files\Feather Launcher\locales\ru.pak

Filesize
1KB

MD5
85ec5648a7ff96c6d8f3d99caf9b76c3

SHA1
51ae3d2e671484f218634bb7e140d57b26ac3a18

SHA256
8ba0cc4c604a8ac9c96efa029022c38e105434fa72203cdcc95e045730cb5bd2

SHA512
6d5c5fe02200fb0af8f804b22eed8f29d674486733c97629be36acd19cadb0f2643e92c53a44b8e204b9a1095723b4e1a214a5297d5684eda47c533e689c149a

Download Submit
C:\Program Files\Feather Launcher\resources.pak

Filesize
54KB

MD5
23f4e63a1d45cb7d1ab510e15ea9fd97

SHA1
c8be8108763a2d364c25968f15d8231b39c9181e

SHA256
d99a84c4abf533af9656b6aa9d82a05cbab762925cb20161a0f54884fd929ead

SHA512
3b01685ded507102d527a6adea43d761032a97b38f75309812f4f6ccb04493f67b37189635a6ed38066caf72e776763bddd43c089c1f31a8cccf84e3bc83191d

Download Submit
C:\Program Files\Feather Launcher\resources\app.asar

Filesize
1.1MB

MD5
c4823bbaf6575623a0baecdbe9dc74e0

SHA1
9068d51885fb87ea6cff14e70626f1dc8dd94646

SHA256
584021306804f16c8db1d3080764c0cf0b5f580e306d4da03dfef05350240a57

SHA512
66c66aa162030dcebadd4b5e74aeae94c3ccc81f068f9dff7390fe147cda27169d9d569a31ac8e47c30b5b20554dd736b920bc7214f13289d76ca1dd1fee0f12

Download Submit
C:\Program Files\Feather Launcher\vk_swiftshader.dll

Filesize
1.4MB

MD5
8cde551f7bd4f6d36b95bc5fe279a1f4

SHA1
22250c99d03f0a824105cce7605a0a969461fdea

SHA256
abf57f77e382c088014e5143176c7308fa4f43192120d8af562f6b9692a8cb13

SHA512
c26777ae399fbae0bf39330a13de36b2a7c0478e961402d99ce6329a06df3710c124381fa1ebaada6aa4d5012bbe7fda525491ec0c981c1fcbd01c8b57626787

Download Submit
C:\Program Files\Feather Launcher\vk_swiftshader.dll

Filesize
1.7MB

MD5
1642af3b83ec85dee57cc7330f7df6c2

SHA1
e5227ffeb3483e913649b52d773db12972a0483f

SHA256
17ce4a6c3ce7365cf267d8345128c27adba0373cae56c99604cf1f5a945d8407

SHA512
d98a47e012478458cd84b0badc36950b019eb6526b505d4504e84fc7c9ad8b9f01f642b76f50d35db6a2781a402a3244ba5f88be9b05b23009006318aeacba8f

Download Submit
C:\ProgramData\Package Cache\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\state.rsm

Filesize
716B

MD5
31b9e92ef9e1a570860fb91c64149821

SHA1
c0cba70ff092979a8e0dcdd6c6e56561a4537f05

SHA256
895068c5f47f6a62aebef074130570c99b1ff1a4107130693f95e0ed89a82012

SHA512
462e14453c3365835a872e6db937efddda26c977fa71fa1420300bce195c09c9e93f62aee9b1cb9f61a9426d4d917ccd368289053ed1bcf2169befca13b7a6fe

Download Submit
C:\ProgramData\Package Cache\{ee198d9f-cfe1-4f8a-bf5f-7b1be355b63d}\VC_redist.x64.exe

Filesize
199KB

MD5
c11ae5cacb577306b8128b2e5e291a15

SHA1
f1e93c917769682b1ff45451c131e344bee1b234

SHA256
76f91e1f01f17dc99637d537fadadaf1017e33da8ec5dcd37d0a262094de202c

SHA512
8526f9b63f74ddb9e0e80a9f3cc3719c1dc3faa8fb17c27706aa0023ed20259b2dcfb27cc5672b0467a62d2f8be6181e051ed9fd8445d8c61a80c4ac13e270c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a645bb5-35a6-4b0c-ab6c-98c84f7833f7.tmp.node

Filesize
828KB

MD5
80ba1db4928d8f1192032b9106b0a378

SHA1
dd545b6e073b52856d7bd833acd86b9a48df2079

SHA256
2a628fb196b5f985db98ce8d8dcfda2d7476899345dcbb5556bea5bca219f713

SHA512
96c0b53c8feaec4ab06bde86f4103438a144a75807b8adf70aa70cf34f40d7c5799ed8e67ad21acfe90f8a3d8cb78b3b49a03b9f802e6a8a69aec96fb8233d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240213182752_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
1ce3babbf9d32a953fa2561b2c4570c0

SHA1
480320f9a8c6d85501fd06cc5cf4ca0c93508e87

SHA256
df564a9c67316ee0940e29dbe884bd81077897487f11c024e6080b0c55a50265

SHA512
228852e1032ed8ea08c9f9be257d6619f990cbb36ffe96acbdca07daeb0a6baa3c0f86baa6e431b48e36427ae63cd0b1e5c40b24ad7e81cf608350daf1ee3b00

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240213182752_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
c21636a62836e66003f99d1a8c111cd7

SHA1
98c4449ae36749b5ea6a8786a99847a9cf6ca08c

SHA256
bcc5b481881a67133565690cff50671b436f4d6b9c56cca3e1a4923041eab295

SHA512
67254359912dad838024332a9ac7201d8a2849d5623e6bf6072fd63aa4e0f9695d5e34ca9603ca346a4989a799d8a1e349b69036d324f21d9bc2de5c42267475

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\Feather Launcher.exe

Filesize
2.1MB

MD5
89072d2da702268309a7e6f766c1115d

SHA1
79fdf27bf40eabed4ca5a4f347530c66097a43ba

SHA256
e75ee7c20868082639c6f6638a273d3cbbb423611c293573c0e2177cb3e61cf7

SHA512
50ce7b9cabbd1ba10a6d32e92b4c27843c239f44d8c07e5ade343e6e1c3b4ddf5692df2a0ccc57bac54ef76c760cf5335591b5fc5c4186268066eb89851bbfd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\LICENSES.chromium.html

Filesize
1.1MB

MD5
1a3237ca22e0d8eaccf457fa6ca6a875

SHA1
52c1729b389e879228093379e22139569f1f20b5

SHA256
f248647992909f374016867526a2fd96ada1b3710844d473edec3c572e2c67ba

SHA512
f428bedf4fb0e346c5cade9283fe1416d1baa826b96df74102f107a601f7d46f541d28537a227285c9e7b0701e0d094057718f2f853848285a916187284b1bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\chrome_200_percent.pak

Filesize
175KB

MD5
3bab45c70f22646cf8452c30903810cb

SHA1
40b31d4c79b5a2b8d12f8cf8b6c49c962c31f766

SHA256
d4282ae977f23afe252e19e421c8d09696ea3b83a1e73a6aaebaaa5547c74cbc

SHA512
85eda055494f0233c963e821906cf69d94e664d8396e8b08e7a8f412e1c16af71252fef1bfe3ed43cfad157aa90c0dcbb375626e2ddf0e807c9b23ad27e61d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\d3dcompiler_47.dll

Filesize
2.8MB

MD5
87c6a75ddf46c15108d14bbece3b6101

SHA1
e4cc354822be8922d3237494c13cb98fd0f50aca

SHA256
c14019c84e5a17d859679bf89615388ba50fd4ccc7aa67f0403803d50ec9e0fa

SHA512
cd6262b2fcf89717ab5065d8106f2bf3b656acdd76485eb0772c8402f49e982a90841d4c7c522e39164188c0c59e0bb4fdbdf17434f0bc70e703ee4157f2a283

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\ffmpeg.dll

Filesize
1.8MB

MD5
43f806aa459166ed1c35ceac1689773c

SHA1
8b5d1895602fed0afb2abe88d58e136a515405df

SHA256
805bbd8fc2a5bad503e304e05b98d0513557858b65c42c6590720b3774f12c18

SHA512
aa2f8d3f2c015c3b89352124a22970fa3a7351f4cd12255d563da3e2d1430aefdeca38e0cd9881b3d0332f64ae1533dbcb44e3b66675cfb6d6bae0819f6e98c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\icudtl.dat

Filesize
1.5MB

MD5
2783f44768367108f6d71f1d8a2ae292

SHA1
b9f0f86f4f62bd00537e2303c7f0c756bde119b5

SHA256
1ad78bc0609ef8711c83df053902f3f66c1e67acd0b330e0efdc9978814d9147

SHA512
eee653000a09939c2c43366821c6528d18fefab7ace3311bf9aa67ffe7e7106133b314824144b0601cf28295c2511d499de69f5b0fe7315d0fb2339c127bf7f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\libEGL.dll

Filesize
458KB

MD5
655672c205e37b079c34a4427118479b

SHA1
e1d595a25e76f2f1be50f0ac3046e82462790d69

SHA256
498fafb59d3d1a91fa24f95a59411dacf3fb373408e8ea5f931e2ed6b2732d36

SHA512
a5ad3ac4e382d28d2d95cfc1b02ffca2ba1b5277567c1db81e14a87891e6ef9e5b8b2b56f4b63f8512c0b527dc3de7a5ebf5bb479dad827dfa17294f5874ab92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\libGLESv2.dll

Filesize
1.7MB

MD5
a7df99e5b4b2f2121379deb834c948e1

SHA1
ebae0edfea0a49c9c83f8d1f6663abdf1e772c47

SHA256
bf0da86b9bf9787fc617d1bdb1ad04e3737e3b1b78c46c7c2fa7f8e0df93f3af

SHA512
95d050d017f1a9c11f05fab2a6f9f6ca3caa25f53ed71717886c1d83703e91573eec9537156e6ee5e725f1b0ebc935ad43840bee706c3877be0ef1d2ca2eed5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\af.pak

Filesize
321KB

MD5
3ab2fcf223a5fefe8a186741b3507e14

SHA1
9e851c09c08415a228fad02ba87a9caeb29e3b9b

SHA256
e6db19247e92d007323f9e0ee776c423a6a8a64ab321c9d5c964cf137e390a4d

SHA512
c1259f7953191b7c89694d826f4e45564d4c7b6be2aa7e85b73c5a6f723894b139ba62d215def008f45a95215fb3da7463e229c8ed014a6db4b03e64133891e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\am.pak

Filesize
519KB

MD5
1ef5cb04c40f553fad6dd74295ff4588

SHA1
9065653dc4ec508b657fb86f45a69114d1ab4be1

SHA256
9aa0bee97cd6957d3fa1dc43e3bc45b7fc4f55df6df9a33faa7aeaf6e2c46a71

SHA512
fe766d0841a1a247442e85b5e4890fd3f83c76686e61c2243ed93a373d7c4b9a79558200583e58fb17cfa64efe053d61c582d83beb078a62ef232376e4741ead

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\ar.pak

Filesize
561KB

MD5
f27d0b588bfb76f541e9a8d83c74fc58

SHA1
23d01bdf7e1a7d9cc34a53b5d0e9a221395d0f67

SHA256
88645be62d0421ace7b2c44df7de67a4a83b04977049bef82b465f60f06d5560

SHA512
9406a3150e40a5c93c9a2ba82030b334161273ec3d66c8812cb7328340cafd0ce549f178cddcd00bfc227a258e8aba64305be203fb6502fd87f76f224d0a7126

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\bg.pak

Filesize
596KB

MD5
d9291d2f1e816471f691f37c5a4635a0

SHA1
201f26fff690b95f559d57866d7db519364ac27e

SHA256
4a7d229dbd7ca53bac0438d5705a8ecad9e33213f6752e58624da1b9e9cd571b

SHA512
074b46011bed5750dd49ec5e021b02850d11b235730c27bc2d0910a69f2f1d03c79dbe692b5dc34b7be28ab071b8af6c639151ebb10364f04b8acf4615c54270

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\bn.pak

Filesize
765KB

MD5
bc688ba7dd2b0f9946ac98a1df15131f

SHA1
b453ec6785191b3dbd5d78e7b25b9481b6522b32

SHA256
6ad844d2b22c8fbf3587ea603140deb1475dab934ac62e402dbf1c6946dc882e

SHA512
3d60102975a6acb39ad5f750128ab4967bdb5a64eeb398c5fc71e5fcca860eb97487df4e85269a5ffdc1f030bae2ff1c03d61b08565792f84696693aef8119ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\ca.pak

Filesize
363KB

MD5
711098caf9322fa49fbe4ee2ba794a7e

SHA1
d567f076ed6b8b1479c566efb155ba491401f140

SHA256
95758e3b0e83067a8eb8f135f1a9f6112db18ab6a21981c5ec32c899c729a159

SHA512
bcbff969d9e3ed54f6072b359f911c0c9ed875b12fc7a29002e9a251331b4d47b7c0d740ef1c596bbc8828d6e32f216f41bdadf0873a0a85ea5b65bc8770158f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\cs.pak

Filesize
370KB

MD5
11a76a16e2f94290a6671b2fa7c782bb

SHA1
ccaecdb49758bcff8fe31ec0907b3a4a0f1ee6d1

SHA256
dee2f88b85753600284bb4acc844be1f0edd5688f98340770bc042aecbd73fb9

SHA512
a19845703cd2af109c085383307eff88e8f2ea4f6446541ba1f0bba89522e714d43cfa355af149a9a12ead96ab389b27c273a53dd15a93b401f6f7eb4d43886c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\da.pak

Filesize
335KB

MD5
528f37f3f0f7b145a979d5c241b4fa0a

SHA1
553184bd357c6493e73c1a1dcc5d142e1a36f0ff

SHA256
19444d709ff0b9343aef93a640c505566572a0f3121012716d2af937c08d6dd1

SHA512
6a58016bd952dd93026e81bd240a5d02b0538c61b3f0422ce4439a719d4c0d76caada1f3177d4c4942c0b573844c7e42d202285758dce8bdd8c44115ea4b068d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\de.pak

Filesize
345KB

MD5
97bb0ac19a91bde86ba7f9ae7be18a57

SHA1
57dca4fc766470747641ca3882b14732f4b4fbf7

SHA256
70a4957d4d34eca27ab7df5494ef8202d8d6470d026db310be2ead00abb08d75

SHA512
134994f4439da771a6b99aff5dee5d83251128a6ec6cd256b7b95d42d7a3f2a51ec13e65b823bd838a09872e136cc29f7c488d3846928965b7ac7daddc491b3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\el.pak

Filesize
256KB

MD5
59f19af9c56644a0b0ba7afce6e9bfbf

SHA1
8bd4f4f43019c85988c34b0517b83c2faba4f81b

SHA256
75a4ae5853a99537ecf55051bc81edbf13f9618d0e013223b2b157ea58815d6e

SHA512
7e667744edce481384f615dae6ae1317b796cf65c038f48f3bbc98966aff958f78ae79af9489ceeeff751e0c595c5f39f4aaf425be83b5b0c4f6322a17bf4874

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\en-GB.pak

Filesize
293KB

MD5
0444defa8f211ac4eabcc760b14a5b8a

SHA1
f143e080ba73f83c77d6c095ab8be1f71f763532

SHA256
e252661d412a068610ac2e2a64609f21f71c64602c579a14d7e6ee59d08fdfc1

SHA512
ef4977e477c3c39c2915e82162bf44370a3e2242a2fe57b43a0c2342171d02278adcec9d602ad4d4021a6554ad85a55d4635ccf3cf97405bda30626379d875b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\en-US.pak

Filesize
294KB

MD5
585b70580b0e48bbaad16d3164f5dcd7

SHA1
15796346635e4f59ed61949880b4ea2fca2e6ae5

SHA256
7c6fa232848c578d53f4be64cc7e3b91450c053577a24c5fe83896b69d854d86

SHA512
1de1f14f1a4cc4e8d11967f049bd5ea0a3a98b916c1efd85de2d9d36508fd0d6cd114cff939ff5aa45f87e527617764c6d9e2fe5b063600685ab343902b04ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\es-419.pak

Filesize
346KB

MD5
afd8115b30a14875d1fc6447c88af5e4

SHA1
b3404d65e6c5cb41c1b0a72ee75a3ffc477e7d66

SHA256
4da4949ee3c197fd7ccfcff85d30a399a2f705ceaf15002d9cc9be70886ea1cb

SHA512
2b853880406225415dc116942a5fa34a03b7fafaa5de91e478410eb510dff163541595032f48d54eed2b3983aac7c5fc25fc6e51e979e2bf8f8fe44bdf5f90bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\es.pak

Filesize
221KB

MD5
fd436571dfa38949020ff1157caaa33d

SHA1
48b39cfa161275d7f673de2bc3a5a40d5750945a

SHA256
9d45b0e6ea8892af3c1f00ef1513680f8b04b08db52d6e8244d8a6154fcbb129

SHA512
39b69b1ca89c761493a8d0e2de899424f8690ad0da7a303378393a5cd6afa8647b39639acdecaa8d1573c1d4a34d3208a12770f79cdc27acafe7a8e373916d2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\et.pak

Filesize
323KB

MD5
f6b7f59ef4eadb505faf6f939adafecd

SHA1
738f208a717786f23d124201aa16b377b686cf50

SHA256
8e75989893f0d59f6ccae2042231ec8e7dea6fbc78210700d0d1d3a67f6b1d59

SHA512
195bec3a111c498cb4b791bc7d15b459014717fe4270cd82d01e6e4d1b12bac03e267b7699b12e43db5c6cfd8625b6358bcee039aa18edf593f824fb27bcb38e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\fa.pak

Filesize
253KB

MD5
0bdbfdc832c2cdf1e1709cd004ecb74c

SHA1
654ea890bc06b6dfe716ce341ae8271a959464e4

SHA256
167350272c2ffbe8fb4990e6d9cd10236a492cb2049fb706532295379b49a493

SHA512
3f585259d08db8a4cb162787528705bac672f47776db4a947548877e4193fdd90b8f0255804bd92dcc805ccec31dc1980da72812fe4530d9455f2bd0b4159d0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\fi.pak

Filesize
332KB

MD5
71f7182ad054b5294d1a3c8fb91d1612

SHA1
13a210397d6352912c35ffcfceb0e2ba3910f7b4

SHA256
0b41ce33c0036aee83989ce4ffc2d096b2f6fab77634e4bb500ec70a51b4e0bd

SHA512
157f11807cdf4667efbc93cf2f3134d9d48b6eb08b941eefb7b085dd3e110efc42c78ef554c0faa2b46e0155903342c6b5b6b20f796907138619b880bcb2d2f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\fil.pak

Filesize
372KB

MD5
850333b9705ef8ea07a6a9ded5904040

SHA1
12950aeb4d7f13ff335c5012e1d0af0da50ba541

SHA256
742705b1c87900f6e8f02fa112d2cf13ffaa6c09c62a7dc34a2cd6a29608dd10

SHA512
c464725f7f9702c9e94a7491e963664fbfb2b07507ade4f32fe2372eb9d0313bb229fa8eada511b338d094780341c24cfb59f745471b0b82fbae94ebdc8ef4e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\fr.pak

Filesize
387KB

MD5
0b0722d0c9187ed3bb445e66b9f73668

SHA1
426b41bc9677861b61daf77e235c20ca70b5deb8

SHA256
b7b3e4f04dadde5c228408c32c55f088372181cad5b71df515cdad8dd1ef9e6d

SHA512
4d5e3d6054cef9f903844a0822906c612def3d4c3319a7114a54421ff1a4d3c523d02d457d5a2ef8636d6f4183392f64d821c6ab2e8b79c9930e95f7a36a891b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\gu.pak

Filesize
398KB

MD5
6c57b7e5446a6ac4b643d3c9d3a39ef8

SHA1
af14bf3271f4e0176f9598fb1299897b76c60a3c

SHA256
8f5f6ef5f8f515cdaa52fc92e725d5e74d47719f738a66e9bb0ddd88a71e0391

SHA512
5d9985bb0f1ed8ab7ac5e08c0ccf4a54511b32c96dcb534a9e4e1b31edc0ce3eb2e0e6a1de8384e9a2d566014f6ccb954327cbcd87f46bc6218e781cac6074e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\he.pak

Filesize
279KB

MD5
17553d02b2e166e50a1d482a346c7ac3

SHA1
430a4211115ebebd3f1247a917617427ac204dbd

SHA256
b474895a146e6a589d272bee432e222a37c2fef13d80695a0b94203065b5cdc8

SHA512
579661dd4cc11982de47570c1456763a805e7ebee67e33e3a39c8e36266d04c2632de1cd4cef65956901fd8c653f4a6c7210cdcea55fbd3e5e87ce19468fb232

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\hi.pak

Filesize
406KB

MD5
28a1251fdf119a03c64800a1731491cf

SHA1
630fa4ba56750dd0b088dd787ed9377b020286b0

SHA256
0ef1e69ed00d8a730a238ff33f8c9d0abad94cea42764f56dfcc655b8360a77a

SHA512
973ee46dd0782924494256e51132a420937920fac5d10c79d81943fc7c8b90e374bfeca1b515c1415bf2f7dfe909ac79c44e17858644ad64cfcce88706237424

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\hr.pak

Filesize
358KB

MD5
5858fdf0f665ef6dba8a4e68ae175974

SHA1
fc8085083e4b38462c42e6ca5ae67fea408f18a8

SHA256
66e85a46152b7baa26b2fd8d6af3df0ca67f54b75281aa08cf6a0f7e769aee8c

SHA512
6b32b62749b2e1a8921faa425ffe69f1d3bb3d8ebceb74f5215c355a35aac8220ae8a0624c68ec45123430cc731812504fc22bfac1d50e810168f3b3509176cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\hu.pak

Filesize
320KB

MD5
df8672a58f08bf8e787684ace86d232e

SHA1
36c103af1b1123e4bf24bb096dd1a432ff49627c

SHA256
a4a8df1b4925a88dcf6414cee40f9fda351e4c6a7a6d2a59d91d21ff255de925

SHA512
539f70e0a332c1034ca900086580b75f4662f62be465fcfce8365e60957761609abfabf256e92022f650d5bb10d137414955e49d8934d73c514020e08a5cd630

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\id.pak

Filesize
318KB

MD5
437540fba9de2809d42dfc66ad78d664

SHA1
0ef84382147c9ec2c1f8f248f7234506d0f3785c

SHA256
788a4e41a8e6b70e714913b4894a48fdf24799f7a20320565c523b233a41a8be

SHA512
e893b418457b2aaef7605e36a61351b43b18b38ba675b2377bbf7744c7ba83fb66db151faf28f9bf0361f874cb4dc93e4bb1066cb7a5fb6a41b1b97f907c1dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\it.pak

Filesize
353KB

MD5
f21eee789d7b89f4c1ac03bcc95b6391

SHA1
754ddc787e22378c3034c78dc126e49d952c1ffb

SHA256
94652279dd554461d91613fd2cf295e0c68a7fa46855c53172781b15a5b2bcb7

SHA512
588640b61bc8ec60d9d6a6110544b0d191cf0d084e17bc79ab19177eaf74899c1eccd7b0f0f6852182b48b19596446e819ef0c1d64fbffbc87552a8d0eddf49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\ja.pak

Filesize
303KB

MD5
694d528d801f5d3b7005c7e814fcb9ef

SHA1
83e31b1ec1cc6a0fdf200a335cc87bfbc22ff989

SHA256
7a8dbcac7cce8c1ebad828fdf7c61ab68c3c07db6909ca4ef7485b7272a39b09

SHA512
224acabfdb5ef78ae6d4606965b5d8d484655b042d2cc5a786d4e46d3a0021fe7f5e9789b6f2b9cadf0bb2c0a8d82dad25d895fa1c665a45a1714de4cb2bae06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\kn.pak

Filesize
248KB

MD5
222f8b6f84151be81421208ca9c176c5

SHA1
4cf4cee9dc5b160e567280e14110946cfbd9a66c

SHA256
356077fb8745ce8ed6f548a64dd1723c4269ef8c8d5c3e2600adea9b810dbc4d

SHA512
6448eb4e79f1a06dd16ca0573f33aacaab5ec54d9164491190caece1233740d53ab80e22a46344aa3088ecab5d47ecc7ead5cf0ad6c1d6d2667542963fab205d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\ko.pak

Filesize
168KB

MD5
65f2a0c7cfa94cf36ff403d5f50fe97f

SHA1
6588ee6265cbf99b1b9d8b2c40bc38dad7f93343

SHA256
68715fa82a4a41111a2700debe67a8f1f6e2b4c066907da4cda80400114cb5ea

SHA512
10b3a30138b165fa7f8d83a8a4ac7eff2c11c1d7547398088c31290fbd8e0e2125e97fd7282ea68197123b4d0d72f83b209657f835b10a407d75082e6c91b967

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\lt.pak

Filesize
262KB

MD5
eee28da47d96855baeb47e2c27ea62ee

SHA1
f5e0dd3d764cf6a42547e7035a635317b371f1b6

SHA256
cc5713df59fcfad8ea88b473cf3ce4f6af14175b0b1125b20b56b0b9e127152f

SHA512
1eef29bf37e32d22834eba94ef9fcb5fb1cb9948a111ae366ac1173ef2bedd3e6fd93820e13f0f938958d107a0178229391cecef8e836965afba54541c1c7326

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\lv.pak

Filesize
386KB

MD5
f0645d37826c1e2923240b745506b7f6

SHA1
d41a06f30cb4aa187b6f02320db9c743058551da

SHA256
1af1ac2692035d502e772f976c977936d0feb42f65a9096e0af2fcf8b7df03bf

SHA512
29ccd6915aced1680eb0ab6ce4554ccbcfcc196a7e1398ae5da1433205c7b2e77ed2bc7349704d1dffafd108403bffe53c36bd018bacf6faf7363f8e35c32a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\ml.pak

Filesize
1KB

MD5
f37e4c24eb5b333384f9030ab7e92de4

SHA1
b86184ef699383a40cbee34622e0abc781ae8922

SHA256
bbaefa81b2400e057f7ad66c18eccc718985759be988942da4251a04c21af6d6

SHA512
4d99b27613ef9eed5c6c6c1dc9c04def77e962727e3ea2efb7f2f17b6f2ef4bead397fcb0065c666136bbb6f2133c71bc13af219b0779b6d1239a17cc0c39beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\mr.pak

Filesize
728KB

MD5
a72af6ed3bc9c364cdd096d65e3b5349

SHA1
f652a7d21e8cafebcd72cc38891d4b7b908444c8

SHA256
c20543bde56b4ba78b7efd8a1fd4d6990e751ea7e243c91a2e83ca78dc0d9289

SHA512
3d0523ac8ac9e1d9f2e3e802053a14c8c3ea0b45cac0865b10efb23e869236b8103824777b5efd45eda7d6da128e9ec15bc68963bb60cc46a034ef357fd66b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\ms.pak

Filesize
332KB

MD5
aa1d4538fd06a6663ca213e059592f90

SHA1
4197b4bdd58b09ca8caf76d0c22e3eda358dbeca

SHA256
d51d9f4fd2be492a751db6898b4c2843b2b6cbfe893bb66ffa4eb8e1a66e7e5f

SHA512
718d3ed30f8f8052b2c52e8458188880a050ccf14f2929e953e18a551f6abd4fbc87af525ccd2efa353bbee00529cdeb7146373023d598cb6430e16465bf1cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\nb.pak

Filesize
325KB

MD5
9cd8697bbc2b78dc3fe4c022d1fd5ee2

SHA1
9b0cc62586e391af46899464dc22df60746b53df

SHA256
fee60b6eff88716fd8ad4a9b2da8b16827753c819671831e2d7dc2723aee3bf8

SHA512
30db548a2bc7af38ffe0a1970a52afce2fee04c02b4b61b277d875f068c86fe46fe537303cbbbbb66f3f715268b43cf3b2cdfcd90c2a4157393d6242eca79c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\nl.pak

Filesize
336KB

MD5
abab4a5f1afd809d2e7d5cad3ea17e70

SHA1
d57dd02b63849f7798b1ba11efb889075fed10f3

SHA256
361d54411d890d26fbe6d1f8e8f8258e72afca143783f9f16145b9f4f5f9333d

SHA512
076a061a9278d83c76048696d14120310b64fe41a0300a0e0588e1c7ae933026d8994f9672d85c5c76046a3d7eba5fea6ce70fa7fb4cde0990777e3965fb1d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\pl.pak

Filesize
373KB

MD5
b5fa6aa430ac5ffbaf172627733d0a28

SHA1
22179851889ee0f30097b0ca7417575f91c9b7bf

SHA256
fb1dc5b556f59b6ad642167f1df9e654517ad494559eb3f441ca8f79d56a86e0

SHA512
80dda2de947cf5e2084bcda6623b83ab7cabfbcf5e6fe4d36d3290ee10f18f7be897b29bd3ac9f5be72572e04a7791e008532dee68bdb9647b20532fa38cb386

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\pt-BR.pak

Filesize
64KB

MD5
ba74ffcbfe73f648e7de26bcfd9489c8

SHA1
1eda2dea1640431d7aa51177e38628be3dae52ad

SHA256
a6c3fdaf2af94b70eb51eddd4c9b43e3cc74da27a0aa1e46310d930e40797556

SHA512
ef9f07622d6d50b71436a35eef6a06483bf344b4b44fa8f7a8cf6a27d8eb35d070bae4361c4e6265816080f6fb139a45faf988cc5b03dd36f0ee8351ba625566

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\pt-PT.pak

Filesize
356KB

MD5
a0e1ae3d3ee87f7031fffd278cce007b

SHA1
c36d4e8db6913f021a0be1d9b8a3e8a13943359b

SHA256
e5c382258030217591f439a4020069378c3362677258d5129c69ef8e25abd6c2

SHA512
bad63254f3a4fb65a9e7cf00587985cbbc93fb3fc2b48735b59fed3c98ebc1c51fd5e8394209f86c6040d05663b677b6d468cd98920f9b088c6fe1cdfea7b47d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\ro.pak

Filesize
57KB

MD5
fa6dc05bdec06828ac3a14239bc5deab

SHA1
8a2e7d00d1a7eceaf4648b19e395c37105b13f6b

SHA256
d09acdb9aea0bc899749cc6ca61a2c6a0579d9c932e34d4fc89f89a0f8b490ef

SHA512
26343ec1ffef30dd1f0d91c11fd621076a9169936cc40a1e89fee96711a5dcbd5d5e0df4dde538e84dc1d2cc2b6969c0ad9d8f978e280be95f9822aacccd50fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\sk.pak

Filesize
376KB

MD5
ff48eea350d1fe820a47c2cd0f9a93ac

SHA1
1a069d1f9b278be78cefd290670dcecc463aa7a3

SHA256
fe43904bfb0072add943ee8d44e9f92a80eb2aa55ce7157de52ea625c277db53

SHA512
507ab138d8b6dbabdeacf3031fe4c63687fd91d04d0eb5e27b12ffe1d84c93ee40f69e48853d6bebe177d614e4a14f034024f93397a0e9fe5779ccd01760caa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\sl.pak

Filesize
362KB

MD5
1dbb16fa2da8c13145420e85cda509c4

SHA1
6bee3ddc96a98c1e658299dabf6457fcf90c67cf

SHA256
5015c0685b66ef38c92ffc4963e144e913b646d8e855f3976e50c8039879cccf

SHA512
a98b086bf9175b7c2b5c25e1208c8f7248c6eed2bc9acc095a52479550b58bd22dfd9a09dd3674f59ce9ef537f27b0dafcdab194158438d0e68d3c120fb97e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\sr.pak

Filesize
560KB

MD5
7b929206486e740b4c9299112186a94a

SHA1
b52a4c8eafa2d9439d525a167cb3482f31d7a6e1

SHA256
a0ef17a572ce510796886b844226b65991bbddcc71b763b91569a07ef23d2070

SHA512
91f4676cc8eeee6f3d643f13c27602ce05639b3707bbd950fb0f745242e92d053b74f575d87522a43f2135662870ca3e3eb6ca894737a5d14900b9e48c837673

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\sv.pak

Filesize
328KB

MD5
c5bd14d64a64ac7f361e49035405852f

SHA1
e2484e58f524464fadf898ee0a3c972db19fa9d0

SHA256
21c7d459c55f255c6da5a6454eafc836a3bcdba9c99c76bad0f0d6fbbe7a33ef

SHA512
74443233e16ec24814ebc4e16aa5108ab447c4b1d095c2e18ae4cd2d25fccb13a182fda1dbcc286b9f8b07e80e19ab19544fe758efd90910a4eb1d05c3ce3393

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\sw.pak

Filesize
344KB

MD5
8e490ee67f6c53f9916715b0d32257d2

SHA1
dbf51ece8c770f38019f497bb10966feffde0ea9

SHA256
a8d904e4871efa01c72ef64bab601e6cb1de216db4a696966e90fe1b733bef17

SHA512
a5774b930e4d5f6d91049fafdb6a743fda32f670e9aad9000740010d1b271a4c3c881d138e40abfcdbc6bf98f37fb3791007a74d38ac507b8bf86ebe0ee00c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\ta.pak

Filesize
1KB

MD5
341f99e0d9276cd2d4a836dbbd5bb433

SHA1
181d9815f6973d9336436f8d99f4ba9cc7dbb8ed

SHA256
dbdddeb6877e706486304e213b6b06e1baac1bd17ea4c16ff91b21feea0da2a6

SHA512
cdd31256086a1c9d95c6edc17e382f75d62bfa160cf3b3859c77ac9c3ec681164411c30a0b86644f3bcc3807242b9a67c27820c93b3382d15d79c70b9740ee7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\te.pak

Filesize
819KB

MD5
d7f858c12123e975b4a862c3df05c0f4

SHA1
f8d2ffbf76883f5f095e10f3de5694c209c47b12

SHA256
29e4d010c6b951c129633aac0f55b70107fd24dcf1062c20e263611e30ab4b93

SHA512
1d44549e83b0af8d9c1b5826c970eb8dba5e8159c0ccc3586022d65d1e5234b06cc97ee4a9d45d7d944e882f4c5a12947bf810f73c8c064255ac0f46e35799a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\th.pak

Filesize
690KB

MD5
73bc88a210dcdfb14b6f29d8f86f4f4d

SHA1
fb3392a03cc355aae318902122b7245f2fc13d01

SHA256
bb8b656b1d2c4cf5f361f59b44abd4809cd774e664dbd0f90b62b97ea125e3c6

SHA512
671b90bff006b22ce714971bb8ba87acc4d887f9893709a090a85a8dcabb1ecd72edf54775c77378ae22dfd5ad2880df10efb201b1d4c11a1d304086b8ed3c8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\uk.pak

Filesize
592KB

MD5
987144e7837f63de1889492166f4330a

SHA1
f9b5055572eb238b357a7c977c4ceb6f7a768232

SHA256
d10af321c33d48f5e97abb1c74b76e43e63390b9022bed58437fa4d271283900

SHA512
32ae4c6d7e90cc0723ca385fddf36ae88fc803bec790d844eac4c7a67493352c3aa85a49b095178fcbfa4485b9167b6f4dbf0034e7784148383d0084d63fb9e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\ur.pak

Filesize
522KB

MD5
77ce70fb50d1de7cfdd6b13161a09809

SHA1
09d08cfaffbf255a013a8b9727d40c776be51d37

SHA256
ae2457b6f347d34fa8ecf524d91154ba9b80ee160196d774546c1b8924049495

SHA512
7fae3a792a2d64ecbf60ba2b694ddf2b40df0e1fb81b602b878ede856912579b7ea78488bbe998151350df814a8d8b0f3f1299882c9b330d214f9db05de86b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\vi.pak

Filesize
415KB

MD5
34f3d7788e213b731c0495b2fe45c78b

SHA1
e7a2ed024e61375077973031e2dc82d924ed75ca

SHA256
2ca9eb9d04ab45f479b392ca9067d353e5472f863d3b784acfcb1361c6da30d7

SHA512
48400842614a31f65278e667b43d188dd44e4e9101c7d3d01ad75569d1182cb603ad07168195364ae53dc598f544f438f846ccfc604db208fb29998b292febdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\zh-CN.pak

Filesize
301KB

MD5
d9be21bde24de1026279aeb67999b1bd

SHA1
0a0e090bebc5e4e7550152bee739f220f8ad9e9f

SHA256
6c364baa231f41c668fb15da586568a985fee2b4bb3e611c07ba97675336c013

SHA512
d376aaa1d38f20e0cf89131452df6d67489711950a3c89aa515570588797c4d83c5dc467773d3af525a551e0f6087fdabbd2ec3d2b48db4b961f2c1e9932f0db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\locales\zh-TW.pak

Filesize
298KB

MD5
31b1d4dc9c0fbabb29c2e32c759e7238

SHA1
45810ead9541adbd12f15eb63bf33f932f7e48d1

SHA256
54469b7be7f1c7cd972e77d9853813d41b515b2ef8a3824e7fad2646b3ebb3a4

SHA512
10e76d0226cda5541a3352c8111b16d59d563e91512be4e0ddcac9b71e0c2f5953ac170d8a23fa1c6d523d3214057950ccb7a67f922921d6c34d475590055856

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\resources.pak

Filesize
1007KB

MD5
9bc7a884b444d22e53bbf339a3c9fbf7

SHA1
578cb6162b5469511ce1435bbd3264a1e282e606

SHA256
37e222ee11afc1bdb612df43fa0191da019e274814b888031021d4c43a214924

SHA512
e9a84c7e9973c9772f9c50504b5468bfd926bfac9ede02e1bfc80c8057edc0eb4456edd06caeb8e665a82779ed52f25e99736b15e3e716f1191898f1ab464a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\resources\app-update.yml

Filesize
144B

MD5
9300d1436965c7c0933f53bd16bd332b

SHA1
96246ceebfd51faa9470f9152d0925f6cc1983cf

SHA256
53c824fd08de03ee221296cb75ad6e8c3cff5b8254a467180197cb308666377b

SHA512
9683ac45be9771e053fa11a0b13b7fe6866c44385046c3f7b67e77e1fd068f5903bdb1987209cf68432ffc021f8366f6fb002c360e3ed6ae030a8fe3996415f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\resources\app.asar

Filesize
1.4MB

MD5
5c8e0964e8978e5df4b3a345c27a5132

SHA1
ed936637c27dfe95d405de65779c4d378fddfccd

SHA256
68851e7bc665954dd7e3d9f2b593d7bb615799246f05597f3ef4cf4a3dd391b1

SHA512
a4232879c7b0499555a698e5087ab6769482631ee65a1d00c7dc2f83694b82a4bd815ba4886fcac9eee4b266e4fb23887586aff2e797cbb99b260b33b8a93169

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\resources\app.asar.unpacked\native\cleanup.feather

Filesize
989KB

MD5
7c2dc9165c530f4888ac63233c040560

SHA1
41f5048d8365df3fd35c744ceb49bb5ff0e63edb

SHA256
4fcdb7229bfcaa4b158d0a2b4092e76d8145a1e82fa432c99a7d5ad11eb84e9e

SHA512
a6dcc746353c736d848ae3eed110a519e3db52195f4f02193d322220948073964e53e4d082cf3a07765c48018f357153257cd04d5f5f3d05bb44dfd400b2932b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\resources\elevate.exe

Filesize
127KB

MD5
e983313d1b03df6a0ac260a45ac849f3

SHA1
25183947c4a13059f2b78d1be12d00685f16c82b

SHA256
c96cb4fc5f3edc88f00c6e50a8818ee6312c56a12d61ce3fd65c307b3ff1cce9

SHA512
4d34fd0cc870677a3e0d70cefcaa8003c3da6ac18b3ef534b3689fe5ff78b3f8a52ff115cbccd1ad45ade9a6a9aa3ae205c1857a23406b6c452274311da0c14f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\snapshot_blob.bin

Filesize
401KB

MD5
17b5a28e6aa7ef49bea7555843937313

SHA1
8c740e68f009c3d03db74edc347cc5d1fac7b1b8

SHA256
2590aa136bc101f1075e42cd8939c7679ceb35b773c989be2ada49acaffd01a5

SHA512
af7efffed22246389d6a834cc8d8467e965849ffb8fbecd4d192c0596d1a026c6ddbe49cd2029163fd77bad22906e80446512bdb918875a7fa96c6ffef65cfc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\v8_context_snapshot.bin

Filesize
716KB

MD5
b978b7e83b574a43fe766af2b670c1c4

SHA1
ab0d1211740fefe3b8ddc8bcb2400e68cc88ba4d

SHA256
f59fa568139442c7f547fc8a5a0fd090ddc8427cc409e2fcef0518a9dcb47a96

SHA512
ac0f297b128e83d55788aadf5870849781d81cc61461117c5cf22f757e20089acb640b3ebc2f3bb2fbe1659e75da73a63cb884be4a791a90702758e6c52dc706

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\vk_swiftshader.dll

Filesize
1.1MB

MD5
0a000a2146b4e5bf53fa1fc8fa4f1329

SHA1
900446569c9ccd5757c7827e9c644075abbdfab2

SHA256
a596fc279f88238f70ac3f76d9bd1bfa5b4ba22e1e707e4e6413882adc98d157

SHA512
15c9103836814e0d37470bf6eb6f690e6f927474d41427e9106937d6bad93782ffec695d2babb4c8ccddb281bc6718698465cb5a05817a072b9a29534831ae7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\7z-out\vulkan-1.dll

Filesize
849KB

MD5
58871cf606db440509b56a3f764e72e3

SHA1
312e810cfcfb663b0da00eac3b87294c0b035cfa

SHA256
ea1f3a66f9322d20da4542c42595eb789e532a224a0338dc488e998ae00e59ea

SHA512
07279c40721414f6ab345f83d9189c3c7012a54fc839359cb33cf4793ea771507535518554be99bac339463b7bee89e263e7a5cdd3f443a550ca6476c350a2a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\VC_redist.x64.exe

Filesize
10.5MB

MD5
293cba05e8eba5de4e8485a117f849d2

SHA1
d4b401ba71ddcf74034d4613d7c85ed568818761

SHA256
5f6108e6ac80b3c994ff91ec46cd5602569cd66382a769d431ab0d0247d3c85e

SHA512
82709a1a265689faef37cf2407b831ae939a036eaab87ec31b8cb597747aa330d68f6d5a6f7b955e4bee8ad8cfe71b2dce795d4d9c0300b5e480b3af377b5617

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\VC_redist.x64.exe

Filesize
9.6MB

MD5
c6e1dd86004ea824ffae490abf5250ee

SHA1
1f4b35e7ee4e88f5c2917746293a737d3089a4eb

SHA256
5cb492b7feec1d10a3c34aeaf7e9c213eaca56a7be4ebde352ad9d6332b0b650

SHA512
98f006816a39d2fc9ce37c290f68eb516d5c4bbc091c7b203bc4441d31b2f77c611bd56b638567569ffbfbb16fe57c30e39faf8aba3003c80336d9552ec54dc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\nsis7z.dll

Filesize
244KB

MD5
b4c45343200ebb71ab9b38539b5b6fd2

SHA1
3348bdc6be707f917deebd9039b7d1a40a6faf78

SHA256
38b47cdf763dc3cbaa140430162a9bd808cb6db18a4a85f955944d109cebe407

SHA512
87c5369a36eb55315647e6bdae33a84e57cdb1e601deaf74b8fade0a34d8b8830d4193bf9cd524855cce0ac39e6556fe7658890953ad4328c763a334e377a85d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\vcredist_x64.exe

Filesize
901KB

MD5
7b7d75c3d3e3a5cce71d6c84523cc04d

SHA1
7995caa8aec186d17e8b1a0bee02bfa746c652b5

SHA256
9307917dd75ac6c56016e662a5a7e665d0c6997d419a7d4d5dce9cf4988659a2

SHA512
32563800ed5ae3137d9e3f1561399406cc847ac5d42552bbdc022e64f7f8ce45dc6827baa6138664b3ccf37a8a7163249983d773513bcf319319a3c516abcc97

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\vcredist_x64.exe

Filesize
973KB

MD5
6ba39a40e72215221f88b108ce94b1c0

SHA1
beddcac6288cee797569c9a19dc1169b0b354566

SHA256
0234770931d3b020dc266d81dccf7ac5518ceb4951b28d517296d1b22c903fb7

SHA512
a4c3dcd800d6086413fe13dd0cc65f58c85e57c96e7e644dccc0ffc25b65ed5f6a20be7256cad79f3af3af5f9d9efa45724430285b2e5ed86106592ab1cf6507

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso50FF.tmp\vcredist_x64.exe

Filesize
939KB

MD5
7f1c87522e750a33ff04a0bd24634253

SHA1
ec3f5d77cb8e054bc909835b4d1c015b2e9c84c0

SHA256
034ee495265d66658eedce8ec3c03d03091e3fdf42c3a22f18e419b65dc57771

SHA512
cf4326e11922fba9f27d236ffff89f5c6515528c739b470537a40dcada44a24af71e680ea82dce74b995469c12eab6801657663e8c6660586bb396061ca6ff82

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}\.be\vcredist_x64.exe

Filesize
455KB

MD5
622a95e2fccc1657cb2a760688b40665

SHA1
3feda4e77dcd8faf189371c71a35066b01320873

SHA256
e52469f3bce3768b43615ba44bc891dd2cda1b8e05659debd0cdbdebaaf9b199

SHA512
cd7a4705a8b7543d85b9d45d2832641d9783232494c66570d0a1084dbeb67cbfb5f4143e0deda7840f8f53db890f1029f9faf2a8814c1e885aa618f028a0b6b1

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\Network Persistent State

Filesize
594B

MD5
ed7e97c747a72f450a5d11dd13743e8a

SHA1
70f672990e48ec7fba0ea93ad8ec0dbf8e882a25

SHA256
b10da8faa17a48643d8c024eca214dd3eaafedc8527cf580f50de028d74d413b

SHA512
c545993844588b3d0edfd4544cfa31cb5f932afd45ca4a4600d2197c4d2cb8e43380f10526ea73178dfb9c499d4acf5a98ae888ceca6c5ca3d9ee71d92569dde

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\Network Persistent State~RFe58ddc8.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\TransportSecurity

Filesize
537B

MD5
c8f77db4b6f0641f3dd940ec998d2371

SHA1
da64e25d27081b4bd21c5fb5445d9ddaa26dd125

SHA256
683a39508ebeaa346150d1663d1781476e696ff0f7af88e4eda89dd13758ecbc

SHA512
2805cf6f5fc3c167012cc370bbee77f71ca42510b76acac764801a60e5378ab256d43005a2678e4f642b899f17d2c6b484d65d88b1781f023321a8331ab15b0d

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\TransportSecurity

Filesize
370B

MD5
e00a16b51b58f0ddd891499fa5eed6f6

SHA1
ada8aab11b69284cf2bf65045e03794eee2793fa

SHA256
c5c10ed6cb4db9a0ab54d854cf107b19f79b9504435f481f35cba6f898f69c21

SHA512
ead2ea49b34286891086276af00abaf71958ed865efa4fcdec214d34554a6d0b5aaf6a1d1512ebffad4b96a309548bf1c1740d47786c45440f60d52efd61b07e

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Preferences

Filesize
86B

MD5
d11dedf80b85d8d9be3fec6bb292f64b

SHA1
aab8783454819cd66ddf7871e887abdba138aef3

SHA256
8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

SHA512
6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\be3612c2-196a-4065-82cf-3f0db551a4b5.tmp

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Windows\System32\vcruntime140.dll

Filesize
94KB

MD5
c8e5574247f5a2468f71b53fc0279594

SHA1
c28d7c9cad48882beaeed0fba15cbc11fc2f949c

SHA256
0373c0cd6856950dee1b1a9e3ddb896099c6c823f6e46dc00802fed19dbd58d0

SHA512
d244d3879cbdfd22bd94eb7d4950916b5999d6c012b0287a8807a110f1bc80266049f4d0563b97bb0154bcde7480ffcba07e9f7e66fc2ac20020e3c77792df81

Download Submit
C:\Windows\Temp\{CA4EE494-19DF-4E7D-B8F2-D6CFB7A26F1F}\.cr\VC_redist.x64.exe

Filesize
634KB

MD5
464799b58f1090430afa4aa6183bedb6

SHA1
f2b3d878516031e4d968fa8d7b160a14e51688e8

SHA256
42305b0bdfc29a9b03bbbf17b0adc12146cdb37031ae51029b440d537f714571

SHA512
7ab70eb7fdcc107bc41c345b8ca7414ea40f7c3b566614d7767d5d9d93b84cb73d14e447b8a885ce71fb1c46a2469b825a56946a1ef7ac0f8ffdd3110f08d97b

Download Submit
C:\Windows\Temp\{CF29A0F1-CCA2-40A8-8982-D5554D720CC0}\.ba\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Windows\Temp\{EE6D68FF-7D0D-48A5-8E96-99E3BF916C9B}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{EE6D68FF-7D0D-48A5-8E96-99E3BF916C9B}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
1a7fda01018e33117041e2b5725916ea

SHA1
513deae0ed56c851c3a877a03b49489b595c621c

SHA256
de8136207a6ad76ab507e7c35f44fbf6ab9692d119453ae5af7f025d24ac138f

SHA512
b672c1e1b5a90299f0b05de15b18f49aab5f8d2a3cec07d4e4290def476ea7e0b643105848d3e814cd82abe68c6663aebe7c4d72ee846cb8bbefc71e9286612d

Download Submit
C:\Windows\Temp\{EE6D68FF-7D0D-48A5-8E96-99E3BF916C9B}\cab5046A8AB272BF37297BB7928664C9503

Filesize
869KB

MD5
13f098f4d6afca8049843ad230c32902

SHA1
dae3ad20a6966b267469e21d6a55706f762a4afe

SHA256
4f2b1de049338f791dab6d5d8be6edac556a33b5b4abd8b06662a25ed7c17a37

SHA512
cd0d37f5e027792ac6660af9d1b93cfef1ea367415f949f822379781b079cbd2a15d48b29b3c868f70154e9672f5616d19092b321028cd07d5d8e326d482993a

Download Submit
C:\Windows\Temp\{EE6D68FF-7D0D-48A5-8E96-99E3BF916C9B}\vcRuntimeAdditional_x64

Filesize
180KB

MD5
4963ff6455aad7d1f9d9d47e0ae3fa89

SHA1
bd44672354dc55d828b39bfc1d49543a8f8dce79

SHA256
39699ef0144e0b375091fd1824e940f8c91e4dbb7eb5b568903d4baf70e6d2cf

SHA512
ca419a5ab17533d3c1263c5e9c5334a13290495b87a86b41bf04058872874376114b4d62ca66cee9863c673862d513899dd80dafd4dece6a999702e2ad8c3bff

Download Submit
C:\Windows\Temp\{EE6D68FF-7D0D-48A5-8E96-99E3BF916C9B}\vcRuntimeMinimum_x64

Filesize
180KB

MD5
a074f9ba7166e1f8ad9db84ce76d843a

SHA1
2a36a3d8707f8b4fec94e26ec6e2a5df721591eb

SHA256
a3ba9b962f0e5ecdcfa3f9ff7b25bf7b61d78abe5f393ee45f71ef7ce0d9d497

SHA512
8ef81f2680f2b2de0453f2f2e8f209257c38f0e243a55d478a0085415af1483771741b09009eee3b1b78530016ca53c38b00918c5a6a91d947576d3b061bd31f

Download Submit
memory/1916-1247-0x00000145DC880000-0x00000145DC881000-memory.dmp

Filesize
4KB

Download
memory/1916-1237-0x00000145DC880000-0x00000145DC881000-memory.dmp

Filesize
4KB

Download
memory/1916-1236-0x00000145DC880000-0x00000145DC881000-memory.dmp

Filesize
4KB

Download
memory/1916-1235-0x00000145DC880000-0x00000145DC881000-memory.dmp

Filesize
4KB

Download
memory/1916-1241-0x00000145DC880000-0x00000145DC881000-memory.dmp

Filesize
4KB

Download
memory/1916-1242-0x00000145DC880000-0x00000145DC881000-memory.dmp

Filesize
4KB

Download
memory/1916-1246-0x00000145DC880000-0x00000145DC881000-memory.dmp

Filesize
4KB

Download
memory/1916-1245-0x00000145DC880000-0x00000145DC881000-memory.dmp

Filesize
4KB

Download
memory/1916-1244-0x00000145DC880000-0x00000145DC881000-memory.dmp

Filesize
4KB

Download
memory/1916-1243-0x00000145DC880000-0x00000145DC881000-memory.dmp

Filesize
4KB

Download
memory/2928-927-0x00007FFF16EE0000-0x00007FFF16EE1000-memory.dmp

Filesize
4KB

Download
memory/2928-1170-0x000002CCC7030000-0x000002CCC715A000-memory.dmp

Filesize
1.2MB

Download