7ad99c1905e0c0ca46bd97650a50645592a6006f05062aa4580198c41c6491a1

Analysis

max time kernel
111s
max time network
117s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
14/03/2024, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ExLoader_Installer (1).exe
Size

20.2MB
MD5

06d4e995805a2afd7496f4f4f0000fd2
SHA1

db80fb0f047f5754aa33781268421407fd07d29e
SHA256

7ad99c1905e0c0ca46bd97650a50645592a6006f05062aa4580198c41c6491a1
SHA512

fd4d245e28e6584f7fe3489bccb35341f5957933de442c259a507e04bf07f018bbb1bd769d638a07a42ce7a1677c6bf1aa237f4b22b3a5dcf9ccbc5af43150d7
SSDEEP

393216:QVZarTJXmFjzqREtDlwcPUTc9t37DMncawXAKaVnayxZtFDb:SZ4TJXmFjzqa5lYTiInf46VnvHr/

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4980	ExLoader_Installer.exe
864	ExLoader.exe
2156	sameabuse.exe

Loads dropped DLL 29 IoCs

pid	Process
4980	ExLoader_Installer.exe
4980	ExLoader_Installer.exe
4980	ExLoader_Installer.exe
4980	ExLoader_Installer.exe
4980	ExLoader_Installer.exe
864	ExLoader.exe
864	ExLoader.exe
864	ExLoader.exe
864	ExLoader.exe
864	ExLoader.exe
864	ExLoader.exe
864	ExLoader.exe
864	ExLoader.exe
864	ExLoader.exe
864	ExLoader.exe
864	ExLoader.exe
864	ExLoader.exe
2156	sameabuse.exe
2156	sameabuse.exe
2156	sameabuse.exe
2156	sameabuse.exe
2156	sameabuse.exe
2156	sameabuse.exe
2156	sameabuse.exe
2156	sameabuse.exe
2156	sameabuse.exe
2156	sameabuse.exe
2156	sameabuse.exe
2156	sameabuse.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\sounds\pl-pl\desktop.ini	ExLoader.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\sounds\de-de\desktop.ini	ExLoader.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\sounds\pl-pl\desktop.ini	sameabuse.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\sounds\de-de\desktop.ini	sameabuse.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
46	raw.githubusercontent.com
1	raw.githubusercontent.com
3	raw.githubusercontent.com
20	raw.githubusercontent.com
36	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
8	api.ipify.org
18	api.ipify.org

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\cc.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\ni.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\ru.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\sz.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\tg.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\zm.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\keyboard-properties.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\pumpkin.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\skin_items\weapon_knife_cord.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\media_kit\api-ms-win-core-datetime-l1-1-0.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\pn.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\cookie.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\search-alternative.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\skin_items\weapon_deagle.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\fi.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\is.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\sb.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\nc.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\to.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\ug.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\date-calendar.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\rules.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\skin_items\weapon_awp.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\skin_items\weapon_ssg08.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\media_kit\media_kit_native_event_loop.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\ca.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\de.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\st.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\refresh.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\forge_second.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\media_kit\api-ms-win-core-errorhandling-l1-1-0.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\backgrounds\warhammer.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\ve.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\cancel.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\telegram.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\media_kit\api-ms-win-core-processenvironment-l1-1-0.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\bd.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\admin-panel.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\media_kit\vccorlib140d.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\audio\abominationpissed_en.wav	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\af.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\arrow-left.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\bank.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\other_items\decoy.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\skin_items\weapon_scar20.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\media_kit\api-ms-win-crt-locale-l1-1-0.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\ir.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\kw.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\media_kit\libglesv2.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\hk.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\li.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\mw.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\wf.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\bo.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\gb.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\mh.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\va.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\trash.svg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\rain.webp	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\media_kit\api-ms-win-core-console-l1-2-0.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\media_kit\libegl.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\kr.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\sc.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\icons\plus.svg	ExLoader_Installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4980	ExLoader_Installer.exe
4980	ExLoader_Installer.exe
3296	powershell.exe
3296	powershell.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	2504	taskmgr.exe
Token: SeSystemProfilePrivilege	2504	taskmgr.exe
Token: SeCreateGlobalPrivilege	2504	taskmgr.exe
Token: 33	2504	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2504	taskmgr.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe
2504	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4980	ExLoader_Installer.exe
4980	ExLoader_Installer.exe
864	ExLoader.exe
864	ExLoader.exe
2156	sameabuse.exe
2156	sameabuse.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4980	2236	ExLoader_Installer (1).exe	78
PID 2236 wrote to memory of 4980	2236	ExLoader_Installer (1).exe	78
PID 4980 wrote to memory of 3432	4980	ExLoader_Installer.exe	79
PID 4980 wrote to memory of 3432	4980	ExLoader_Installer.exe	79
PID 3432 wrote to memory of 984	3432	cmd.exe	81
PID 3432 wrote to memory of 984	3432	cmd.exe	81
PID 4980 wrote to memory of 3068	4980	ExLoader_Installer.exe	82
PID 4980 wrote to memory of 3068	4980	ExLoader_Installer.exe	82
PID 3068 wrote to memory of 2036	3068	cmd.exe	84
PID 3068 wrote to memory of 2036	3068	cmd.exe	84
PID 4980 wrote to memory of 4644	4980	ExLoader_Installer.exe	85
PID 4980 wrote to memory of 4644	4980	ExLoader_Installer.exe	85
PID 4644 wrote to memory of 2304	4644	cmd.exe	87
PID 4644 wrote to memory of 2304	4644	cmd.exe	87
PID 4980 wrote to memory of 1036	4980	ExLoader_Installer.exe	88
PID 4980 wrote to memory of 1036	4980	ExLoader_Installer.exe	88
PID 1036 wrote to memory of 3160	1036	cmd.exe	90
PID 1036 wrote to memory of 3160	1036	cmd.exe	90
PID 4980 wrote to memory of 3296	4980	ExLoader_Installer.exe	91
PID 4980 wrote to memory of 3296	4980	ExLoader_Installer.exe	91
PID 4980 wrote to memory of 1580	4980	ExLoader_Installer.exe	94
PID 4980 wrote to memory of 1580	4980	ExLoader_Installer.exe	94
PID 1580 wrote to memory of 1948	1580	cmd.exe	96
PID 1580 wrote to memory of 1948	1580	cmd.exe	96
PID 4980 wrote to memory of 2112	4980	ExLoader_Installer.exe	97
PID 4980 wrote to memory of 2112	4980	ExLoader_Installer.exe	97
PID 2112 wrote to memory of 2004	2112	cmd.exe	99
PID 2112 wrote to memory of 2004	2112	cmd.exe	99
PID 4980 wrote to memory of 3736	4980	ExLoader_Installer.exe	100
PID 4980 wrote to memory of 3736	4980	ExLoader_Installer.exe	100
PID 3736 wrote to memory of 5024	3736	cmd.exe	102
PID 3736 wrote to memory of 5024	3736	cmd.exe	102
PID 4980 wrote to memory of 392	4980	ExLoader_Installer.exe	103
PID 4980 wrote to memory of 392	4980	ExLoader_Installer.exe	103
PID 392 wrote to memory of 2420	392	cmd.exe	105
PID 392 wrote to memory of 2420	392	cmd.exe	105
PID 4980 wrote to memory of 3068	4980	ExLoader_Installer.exe	106
PID 4980 wrote to memory of 3068	4980	ExLoader_Installer.exe	106
PID 3068 wrote to memory of 2160	3068	cmd.exe	108
PID 3068 wrote to memory of 2160	3068	cmd.exe	108
PID 4980 wrote to memory of 3436	4980	ExLoader_Installer.exe	109
PID 4980 wrote to memory of 3436	4980	ExLoader_Installer.exe	109
PID 3436 wrote to memory of 776	3436	cmd.exe	111
PID 3436 wrote to memory of 776	3436	cmd.exe	111
PID 4980 wrote to memory of 416	4980	ExLoader_Installer.exe	112
PID 4980 wrote to memory of 416	4980	ExLoader_Installer.exe	112
PID 416 wrote to memory of 2896	416	cmd.exe	114
PID 416 wrote to memory of 2896	416	cmd.exe	114
PID 4980 wrote to memory of 1104	4980	ExLoader_Installer.exe	115
PID 4980 wrote to memory of 1104	4980	ExLoader_Installer.exe	115
PID 1104 wrote to memory of 2104	1104	cmd.exe	117
PID 1104 wrote to memory of 2104	1104	cmd.exe	117
PID 4980 wrote to memory of 2864	4980	ExLoader_Installer.exe	118
PID 4980 wrote to memory of 2864	4980	ExLoader_Installer.exe	118
PID 4980 wrote to memory of 864	4980	ExLoader_Installer.exe	119
PID 4980 wrote to memory of 864	4980	ExLoader_Installer.exe	119
PID 2864 wrote to memory of 236	2864	cmd.exe	121
PID 2864 wrote to memory of 236	2864	cmd.exe	121
PID 864 wrote to memory of 3444	864	ExLoader.exe	122
PID 864 wrote to memory of 3444	864	ExLoader.exe	122
PID 3444 wrote to memory of 3608	3444	cmd.exe	124
PID 3444 wrote to memory of 3608	3444	cmd.exe	124
PID 864 wrote to memory of 1712	864	ExLoader.exe	125
PID 864 wrote to memory of 1712	864	ExLoader.exe	125

C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer (1).exe
"C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
      4⤵
      PID:984
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
      4⤵
      PID:2036
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
      4⤵
      PID:2304
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
      4⤵
      PID:3160
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -command "$WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"c:\users\admin\desktop\ExLoader.lnk\") $Shortcut.TargetPath = \"C:\Program Files\ExLoader\ExLoader.exe\" $Shortcut.Save()"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_CURRENT_USER\Software\Yandex\YandexBrowser /v last_startup_time
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKEY_CURRENT_USER\Software\Yandex\YandexBrowser /v last_startup_time
      4⤵
      PID:1948
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Opera Software" /v "Last Stable Install Path"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Opera Software" /v "Last Stable Install Path"
      4⤵
      PID:2004
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Opera Software" /v "Last Stable Install Path"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Opera Software" /v "Last Stable Install Path"
      4⤵
      PID:5024
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Opera Software" /v "Last Stable Install Path"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Opera Software" /v "Last Stable Install Path"
      4⤵
      PID:2420
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Opera Software" /v "Stable Last Running Time 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Opera Software" /v "Stable Last Running Time 2"
      4⤵
      PID:2160
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Wow6432Node\Opera Software" /v "Stable Last Running Time 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Wow6432Node\Opera Software" /v "Stable Last Running Time 2"
      4⤵
      PID:776
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\Software\Opera Software" /v "Stable Last Running Time 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\Software\Opera Software" /v "Stable Last Running Time 2"
      4⤵
      PID:2896
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Opera Software" /v "Stable Last Running Time 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Opera Software" /v "Stable Last Running Time 2"
      4⤵
      PID:2104
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Opera Software" /v "Stable Last Running Time 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Opera Software" /v "Stable Last Running Time 2"
      4⤵
      PID:236
- - C:\Program Files\ExLoader\ExLoader.exe
    "C:\Program Files\ExLoader\ExLoader.exe" -deletePreviousExLoader
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:3608
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
      4⤵
      PID:1712
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:4080
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
      4⤵
      PID:1536
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:1032
  - - C:\Program Files\ExLoader\sameabuse.exe
      "C:\Program Files\ExLoader\sameabuse.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops desktop.ini file(s)
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:3112
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
        6⤵
        
        PID:984
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:2036
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        6⤵
        
        PID:3352
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:4104
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:892
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:3956
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:4804
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:4336
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:1224
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:952
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:5044
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:2108
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:4084
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:3132
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:1100
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:3160
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:4068
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:4136
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:3616
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:5004
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:4716
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:5084
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:1580
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:2704
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:1644
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:1028
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:4920
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:4236
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:3940
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:2972
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:3544
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:2280
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:3652
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:4104
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:2608
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:772
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:4620
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:3372
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:660
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:1964
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:1416
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:3272
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:5080
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:3132
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:276
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:2296
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:4892
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:4984
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:4324
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:3288
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:1208
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:1948
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:5084
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:4200
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:2704
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:1920
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:1328
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:4700
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:2876
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:4852
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:3228
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        5⤵
        
        PID:1864
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
        6⤵
        
        PID:332

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\ExLoader\ExLoader.zip

Filesize
19.7MB

MD5
c18695beaf3ea425b051f9cad4b6a369

SHA1
e3e2b6e1d68adbf749529009e672e069d7a45c7f

SHA256
b7d03746da77216f94519f0d1a2a427da1ed5504345ae1e54ad7a3f3b4877102

SHA512
792de3a6e68dfb8fd98121b9e90aa66e77786e18fbc29593e1b40ce6d8f576377a100a07de7190524ab323c6aecffc8c178542f0f86cc939d2c34bb3177efc31

Download Submit
C:\Program Files\ExLoader\data\app.so

Filesize
2.2MB

MD5
2ebd292bcef74d2a232260da2881b6b8

SHA1
9179e2cbbf10277c24ca26ac5b77ced57eb1f414

SHA256
34e38cbd3d0788dbe2c381bfa67966a22bfca5f7e0b77dddff7d7395ceea043d

SHA512
f9e4c216bce41f3cca884d8a7bc40dbb1e5ee877cc9692c2e5ee937e51632c6bfcb0bee8f8eff97483670c6953f0eb57d15d0a7ee47aa7b385e13b0d41f6dd81

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\flags\au.png

Filesize
3KB

MD5
547afa2ae4ca6cdc6393606d03e953d4

SHA1
6bde65e0ac8c6350ba88797d39178a43600ddd23

SHA256
dbcea978deaebf92b7c3df6aef8d21a8acfd177ca2be03a888a600b7027f2a10

SHA512
26b9546bd5d9e680b867766ffa7667de21c72eff980636a8b7bd4b72fd1fdfa0220e58038276ce804a70343c2d190045faf390f2dd4e56e07378324ee1a5959c

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\flags\um.png

Filesize
2KB

MD5
58d98fcc9237832c42164f413fe906e9

SHA1
74af76d12c341b469499630471916380d6d8e046

SHA256
9536030a6f2caaa15c950f28d8d9386afef5a667b05e8760975a74b5cc7f9f46

SHA512
f550015eca03527f7e54651ddfbbb10055b4bd798fad1df8450fa11c76731ad259aac0f8b151280e3e685e53e667402848efaf418d5d86751150822decb36df0

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\icons\exloader.svg

Filesize
2KB

MD5
05a0b2956aa20cb8f92f3f09dbfd6ffa

SHA1
292a08937dfff6410ffdf285e6db83171bc5b423

SHA256
bcb60f31e94ba88ec7a788fa08622e728c5859675efee925167771456979bae7

SHA512
8c130a2d125cefd72eda53cb81ea2b809f8ea55d9477c657b2ebb32b53c575053d24310d916b6569db9bef501400ff9a5a61324818ba023536e451a91208934c

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\icons\favourite-add.svg

Filesize
533B

MD5
e8b7b3d288ab2328b33657f7ba9a3e29

SHA1
04027c95834489c6b09d684ae04267afaa00c7e0

SHA256
f3ef6f54d23542653ba6c054fba6a73ebc6bbea008d3638cee41be07c3866260

SHA512
e2f6951903ff2f4cfab951861946f42fef7018b0e5572c996736d80eb4d7f5b0582d4bf30b9e54730dd7123e9b0cd06930042440d4a3ad2ed84b9611500d69cc

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\icons\gamepad.svg

Filesize
1KB

MD5
85c225f64e742876cac2c29da30b3b4f

SHA1
ba32dc395b49838af6a73e0532f219efb9abe006

SHA256
030967a1868bc31029d8dcd8927c5a7afdd0950d931e9a480a6a9ae50a976531

SHA512
012b1684cdc2f978360d9fd454b2364f6a49499fdc51878d57ec4ce0c44c3f4288e3a5937934cbe317f992a32355735e425e91652f666fc8372560599b8b5ae8

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\icons\library.svg

Filesize
502B

MD5
455ae760d442e9f2a8b32a7b3a2f51c4

SHA1
6429a8ebfb90bef7920d0fb3b966e57859e512f0

SHA256
e0f2a585677b9ef7a7ec37f9f16ac24b85a61cb2d7c8ec2ee3b37ebe452d6e81

SHA512
4a5e88e597ecc40ecd00aef5119b5c4e843c32c843a6c6bc037612853930d5d83199af8698f9cb90a3efebfe680dd9c2a23e9688b5334598e24512abc3b5b688

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\icons\notification.svg

Filesize
685B

MD5
27918f26b61f943c6e0391ca1aa5730a

SHA1
45cf6a4d0ac8c637443ca3ab037bb172cc732838

SHA256
1255fd2bdadebe9a32f483f517a3e3d493da72cdac145f123102b457e774be02

SHA512
494930a48446dab6b43edbeb0c296ad1e3d27be03fdf677cdf60e224c435e00908005a93d36710abaff797a28bda424fd1a77ea75812201391a350f0ad6f678b

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\icons\plug.svg

Filesize
722B

MD5
a97ee0dd52799d2ae04b370d3e823d85

SHA1
0f3e9ef3fbd8f3dc15d3c27d3152192c792374a0

SHA256
f72a502f7f4e7d8c7e461f70368aa59a50ece61eb5ed6580ad413754a0c283ec

SHA512
bdca1d644cd835db67aba10b52dae87c44c3df29b680911142028d046c5ac45d67cf4cae4a96fc03b5e5d9a688c530703bb87243881e351a45a8f14c638c0bd4

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\icons\preview.svg

Filesize
1KB

MD5
18d3399d9564dbf1267a729031eb486e

SHA1
e76edae80a639996c582e0668f4c860ad324d9dd

SHA256
4140dbdee21c2e09ace7bd4ff7fc99ad2c657ab8890dcd9e2b6328fd7782d229

SHA512
e5c489ea9fe585502ce7768d88d0bc39aef3fd22ac1efcb3867b80952dac34962eb3309906545092e41c9ff343c981e416468d0ed42f1d864daea9c78387f68f

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\icons\search.svg

Filesize
271B

MD5
fafc49bc19b7bbb0f09c3fe2a3d369b4

SHA1
52dbf44bdbcdf7cbfe216aabf480af5f6b1d918e

SHA256
5753c64d6cb9bacb4be302a8681fdbb7dcb22a074e7abe5541593b532c75e677

SHA512
87217db5e8cc30a4491baa4659b206f86087f6db2f614839cd39aedb8ee138566e3d00024af473f6081c11f98a2dd395d54cf47591f98ceeb55f26859980431c

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\icons\settings.svg

Filesize
1KB

MD5
ae7d2bd31f05120461fd0e5781f6eb10

SHA1
8b85efbbdd7de78b27dd66d52c7d70b8f317e492

SHA256
92c0de4f5734114bfc4b4b8802766a73f96f7a0c05e4f4c3e02cfafa781ccbea

SHA512
272b6e847b376f3eff9ea9ab46f4ff544b1d2cff0aee00faca2039a625ffd51278e09906dd276e99ae5251e9af3b3f546e156b4f6e6447be583917f68bd46dc1

Download Submit
C:\Program Files\ExLoader\data\flutter_assets\resources\other_items\molotov_ct.svg

Filesize
5KB

MD5
43287d7cc7f2849e9388c99f69c56a4a

SHA1
810914fbaefc629511089a5ff787b46ae46ff93b

SHA256
b2a01e47d015fe073e59714e08fc1aee188c9cfc07e0003677fbdbc050d10a9e

SHA512
909e739e5fa1e1ee81cbbc73a24d4623034a9f28114b987e6c8e2c052a40598439a947afe11d5e4e4bbe77c79185077babcbfa7f0273af892f9dc8709a20cd2f

Download Submit
C:\Program Files\ExLoader\data\icudtl.dat

Filesize
674KB

MD5
3c17e386cb6839c71757d5ec8a44a2cd

SHA1
94efcf1c6c7711f63ebd76bb86eba95aa6d18cac

SHA256
3231576f8e2903d4cc32b5a5d2289712c759a5f9b850340982b66adee8039fc9

SHA512
4ca876196323d080f49892d80ac3901069202c6ee8e99501bc550f33769541af59af5e1c80746eece0c59b8b1d0f29a69a9706e174304d999b520f897f59c0f5

Download Submit
C:\Program Files\ExLoader\exloader.exe

Filesize
329KB

MD5
d750f49bf66e34366c3f262fe0a65a03

SHA1
6e85fd3e244cc01c76e8d6a31816285362336fea

SHA256
1f636552427f93edb0369a9d3c17ac0132780eb3f49dce48ec1e1196b82d70b7

SHA512
0a7900f5a92e12011507943fb4d5403137e89135c30786c397e9e6fc5aa1b80ec68cb36185e4fab333d729cc01c6dac96218b13c1fcb9f608a8a1482a820f3dc

Download Submit
C:\Program Files\ExLoader\flutter_windows.dll

Filesize
12.1MB

MD5
f7f5caccc96e336e254417f765f5f3e3

SHA1
64c188da2ed75fb5d1fde252300cc95956d01995

SHA256
49021c5e69e2b626bf51e9f8cb37993fe0f3bdfa0f99529528cbab4f26cd021f

SHA512
c30070aba6b9ee877be493d06405601d2ffcea6b6364bc83625e3095800501e6f3c3cb1ea3e67085cb5af849939cbdfac767a649b15c3685bf1ef42933714e8b

Download Submit
C:\Program Files\ExLoader\flutter_windows.dll

Filesize
11.4MB

MD5
2caeb0b7eed3df18671d6b585c90064b

SHA1
ae925647ab14071f069bcadb34a06528a6935460

SHA256
c3eba1af92971b44b3c64f6c46b47624c07a4d3e889dae8c6d25dd70de7ea2db

SHA512
064983271b1c86fb124c8533cc87e0a0966b3c01538728c353d059abf402ec1d50b9eb33fe232c46f9ab367713376bf15f06133be8312e92b8fdbef720124efa

Download Submit
C:\Program Files\ExLoader\media_kit\libGLESv2.dll

Filesize
3.6MB

MD5
4ff6911c53248ed2fbc5bc497a0e5636

SHA1
3ea6a9a58ba2c73e4f5c621b5ee1fa4175effa8f

SHA256
84b423132b7ad6d4db2440166f4ef11512d295ed2b55a42dde213cd08e7f584d

SHA512
37c3bb5face45fb59c7df13855e54184c85047914401b54ca8c949102de140a17dfadf312ed393f2652c96b080f7e851b236d2e6bc632a2c75737b9a690fab04

Download Submit
C:\Program Files\ExLoader\media_kit\libegl.dll

Filesize
461KB

MD5
0f61da7cea39e89861117f3cb4620dae

SHA1
9ca286bf6d5617eb38101d5e166edac29497c9c5

SHA256
b2590bd0692f0381fc45c20bf1c7f7f713c9ea19c7ea6bab62efdd1fadc4eaac

SHA512
7dc2bbce9808e00122ae0d960ad6b0156d201494aedf4c4c9e261f50986b72dd19b41d443138ffdf1b2e5b8e29614f0a1e909e4c867262eab311f6675618369d

Download Submit
C:\Program Files\ExLoader\media_kit\libglesv2.dll

Filesize
3.4MB

MD5
3e1bf025d2ccd89148180a1becd23b4f

SHA1
e4cba88f52c2f44b77e5c01da4766fe8376b1fac

SHA256
b4fd1d95b12465827b261f086bb95c11916c37f581ca6f6baadcf1a883c149da

SHA512
ef2bcd902344624afa71c0678a7bcfee0ada25c0c2e2a6ff1d3ef86d119f49f0b7fe179247d4e052247b62fd5dc59d6b47daa954a709619d76f74018ef05eba6

Download Submit
C:\Program Files\ExLoader\media_kit\libmpv-2.dll

Filesize
3.9MB

MD5
8fe699afd2caf36b66a89274a7c0ab98

SHA1
08a14b8dd0e5fa38c24ee0cd7e0c8e42336417de

SHA256
093580a3dc9cf5300b87a09bf272c4ed4bc4f071a8070c7e21df174d321a38a0

SHA512
cc37f3887db681243bd714cb6895c8727abf10a8e04fc1ef07e2bc636c98554625ec4e73a348efeb9d78c20e3656c5609dd26e854a12768e040a5c0406eed0b5

Download Submit
C:\Program Files\ExLoader\media_kit\libmpv-2.dll

Filesize
4.1MB

MD5
1819cba4184058f0880e28903ec87768

SHA1
3958de369c89e28858085271deb1ff9ed1da388b

SHA256
1185b773659b70a6fb003c6e3b49d658479a52574b198acc11e4f49263e13536

SHA512
cae5b2f0832c2aeb8e6094d360ef0cf7a199118841e9ee9a5e5828a8d19f520ee8475685ef4527b51d1f29f6ef3cfa38f1b87c14d44009b8568cccb88f42c24d

Download Submit
C:\Program Files\ExLoader\media_kit\media_kit_libs_windows_video_plugin.dll

Filesize
11KB

MD5
8231308e0b97c4056a549bae544f053b

SHA1
a87eac05898a5e522669689fa5b9a484cc77a870

SHA256
8d8cfc67b209628aa0a1cdbc019b30062def22ed2eb3362b646b69ab7c50af33

SHA512
b59001d4b8ab8d5eaa96e18bdef3ab458f26874864cbf551f428e5d7d97cea5aead8609b54fb463109abfb0a9e101c7e990906c0ab847d17f27a96e41fb017e0

Download Submit
C:\Program Files\ExLoader\media_kit\media_kit_native_event_loop.dll

Filesize
37KB

MD5
a2728a8f6a4ffa20d9ceab7ceb2566b8

SHA1
2f1ab08c6b2e6d4b6507cc327ea58f27d8afd98f

SHA256
ddc5ed3c208f29c7a6cf4bc1b09475b4796cad23578fba627e67a5262285549c

SHA512
c6e08cdce42e4bfde819e4924ceaa9797d3bf9dc71f81be7e8c72f2553df5576856844e87c1986945b260dadb8aefbf4df11612dcee36a699e9adf8865e2c38a

Download Submit
C:\Program Files\ExLoader\media_kit\media_kit_video_plugin.dll

Filesize
138KB

MD5
bc001e738284a29c3e11a721d3d8eee1

SHA1
8d21ca9ad7020af699e5e4323fb55862a1660626

SHA256
bd4de21ba715fa006cba323a36c8c2f63414e4a4e3c8fff6ecfb2555a942b3c3

SHA512
b37ba193ada4223532b6de4abf046e4cc16433f830ffb039242e6d6679854790285c57a7c8ac7bb0ca1dd694296f8ca477dff26426a3778fc2c7f895108debb5

Download Submit
C:\Program Files\ExLoader\media_kit\screen_brightness_windows_plugin.dll

Filesize
90KB

MD5
58e0957295a6ecdac6679b5d8dfe7d83

SHA1
1f280f8b81d0b1d0244a50c72ff0fd2e756857a9

SHA256
a1b3fdfbdb8d39641fb61cc7928a48c60e678eba92b2aa522f588de5b68cfcd0

SHA512
185a4278286228aab97f147b458413eb3ae6b93347a3d7ca71b87603ed17401e71835be87187e40c43593e72955094ca1f6ffddc3b21eb1a2c9fc604e304a305

Download Submit
C:\Program Files\ExLoader\msvcp140.dll

Filesize
559KB

MD5
c3d497b0afef4bd7e09c7559e1c75b05

SHA1
295998a6455cc230da9517408f59569ea4ed7b02

SHA256
1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98

SHA512
d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe

Filesize
161KB

MD5
89a6ed1e786dd059f598c852e5dad5d6

SHA1
8bfe891b475b3503acabfde158e58856ae17f367

SHA256
227d42f778e3476633d3711ea07973cb969ae151471e3579f63601dfd01d8e80

SHA512
6b47894d4e6352edeed02e66e76402fc4c50c70221d29353c7791974dc9e7322f97e347041cfbfdababd867b3d3e67cb9af860bac1c700740982701ec68d3591

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSVCP140.dll

Filesize
555KB

MD5
8ca88e5abe14c948028107a35c4f0e0f

SHA1
af091f5081f1d286bbf40abe23d2dc41eac391fc

SHA256
0ed35af7358964f4a5c42c8dbcda58e00c315d6fbec59c9c3560f09570cecb15

SHA512
ac195ea2b0e554f3f2fbd74d1e68e910d956a76d1a5c779a651c04719b3b76dbc801096d1bc717ae58c20b7128dc7fe3a173078ebeed9ac3288f85db2d56764f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140_1.dll

Filesize
48KB

MD5
eb49c1d33b41eb49dfed58aafa9b9a8f

SHA1
61786eb9f3f996d85a5f5eea4c555093dd0daab6

SHA256
6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e

SHA512
d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d3dcompiler_47.dll

Filesize
692KB

MD5
2807179dc6abe55dc90d0c07e4781140

SHA1
f1d12f4dfc91360d6bd0bd73b4e9d48f2dce8d17

SHA256
2c19e59a7f81517f6f1c5a03c9f3d3436cb98093b3d0f6f95b2dd02bcd37ccbf

SHA512
76865759dcff2f9149b38cb818a017c2ea7875212b1e75d93027a821629f6f2210dce218fb83cb6048e32804d4dcbe9214d52e1dec6f7feae02ea6b4cb8e673f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d3dcompiler_47.dll

Filesize
661KB

MD5
faf7021c08605fd5a07d2cf44c94884c

SHA1
385f02757b682f6aadd264e5f829a19b353f3aac

SHA256
a5f9b0843a522fdc0aefb9d9648f9c1e9dba743ace796d8a8d28233f830c3ad8

SHA512
c9421c50511d3672d62af58a8bdfafa6e3795f4d81eec5ffa719d0809a67c79c2bad054492b75efb4128a501d20e311051a8cff773e7cf270a4a748bb8624083

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\app.so

Filesize
239KB

MD5
b5189d1b62cda0cef95b3b78cc29ec11

SHA1
1e8b463ada15775c4f9253a0cddadb0d9a000d0d

SHA256
0364d66475819d17e76f39c1562649df18186bdc38e590a692e7df00d777ddbc

SHA512
cc47e9616aef0506dcddea5ec8dc943fa78a9e3604f854c3affe67f3a6d5eb0ba63a26c15855571c6334f5692b10290c9555cf2b02273f0e15365697b20f2669

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\AssetManifest.bin

Filesize
36KB

MD5
37319e9e5131c88c5169e044dfd432fb

SHA1
f8207003744b2cf6d6ebd6080c9afe5925904a0d

SHA256
f50d907a3487cfbff2fe04f6eca8f38c968d52c971c8044a9e9d39286becf735

SHA512
3e8750f329f936622e55162003b73a57a808db1a3c408fcabb0a3653c5126b0848e1df1b84bac54406b5c365b8a89cf4c29d41774c97b8c393457e308f994b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\FontManifest.json

Filesize
687B

MD5
08916680285af6ddf4adbd1dd265487d

SHA1
e5fa77912a69248aab08714c5b605df62c469f33

SHA256
ef252f80a090c0ae1499c34148c27f3e982100b25c8daa9921d102343383f751

SHA512
68c9858777147a6a1c4932c13149aba4bb97453a3aface4c80077a5746ed493c811e36cd89b838e34429e91b1833b1866177b4bfc216129d555f310fe71a108f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\fonts\MaterialIcons-Regular.otf

Filesize
1.6MB

MD5
e7069dfd19b331be16bed984668fe080

SHA1
fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4

SHA256
d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453

SHA512
27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\backgrounds\Ori%20and%20the%20Blind%20Forest.jpg

Filesize
93KB

MD5
babd1b019be8944f7ef6c64c8194bc8d

SHA1
702a50d3e3a0933db4dc1f37423bca3b5c52acde

SHA256
71ea07c900e7993072f4896c0ab621303feaf4d13b7c9a4b2993e06122b10f76

SHA512
6a854fc0db7206dd182f6ebc594d763b62a75f64663d3e58029cfa2586048838fe8878b043d174923e05f4e3cd2f3e9d96a6dcf5ba8bbd7322bbc3540bbb8b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\flags\RE.png

Filesize
2KB

MD5
23f2c7dc04bfe492598bc440f57114af

SHA1
c30b386b7138a1d89b90f0e679ef58f4c545ba42

SHA256
94a0c4bc3aa825e44d36b0a463f9bfb012c2156392594a8ac6d76b389776e3a9

SHA512
edbc28f9f61ad48ac02e1bcb0f862249b5baf352289e068cb5df5552b5e9752a205e7b093b7caedccf4230186659d4b12579433ae8141b5129a5a6cf4c6bc5f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\flags\SJ.png

Filesize
2KB

MD5
bf25a4249d34f915ec1a246a468290cc

SHA1
5cc47373c11ff0488929124e18e280c7eb36b232

SHA256
0dd0e0a0d72ff4179b11afd5367a72b000de4a5c5ea0362f1f1723f80a3a2d22

SHA512
982fbc34c0c0ccad148b6745185af317bbe12215e08c879c6a06a7073d2afbcbc70c4fed9e028cc91a6a1eaa1fece064dbddf415a4b97a799dbfb1debcc02337

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\Raleway-Black.ttf

Filesize
159KB

MD5
35e0e2e7a5b03275ba569a214edbab77

SHA1
b341b185db9c7231884558dcdab0124d2f5ed1d0

SHA256
2d1149ca6075e3559fa4234107474b3b500bc479baa0bdaa8a99563a587c62f5

SHA512
e3d752d8fd5a7306dcf8fc428b72df1668991b7152b66fba41e365cc61626f8ddfc8092dbcbc2b2ef3acea5c09496e83af2a2208cdd5b66e7ff3267b2bf2f0d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\Raleway-Bold.ttf

Filesize
159KB

MD5
88079335418f389bfb2d86bc4f1ced64

SHA1
fd799b6fb4aff1a9402e071ab02d1ddea731b868

SHA256
85c6a818e33ae8b62d15672522c0b12f2e602680f75c4414ee815a73596ad365

SHA512
5105d0f432cda4de9749e4e0dd09f9687d06ad17b7e02f98dc9d0b2ffc3d959c386302f8882c3a3f1021c39ecf88e60f5e630b929fb905eec48bead923b47e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\Raleway-ExtraBold.ttf

Filesize
159KB

MD5
27f7ef17de3691b5cdb9f1ee1ee5cc6a

SHA1
1c92715c134738f2956bf758181522243c7586dd

SHA256
118e237edf796dd76c453e912a4f445816e918bc3ff1d3941b2548c0a8fdfe29

SHA512
6d5c68056a37d989f64528c092680416c1300c95471be43ebddff7b579bcae9dfa7f402ab422406bf3a4a3df728b4af1e68e15e385b49221847f48e0bc59f228

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\Raleway-Medium.ttf

Filesize
159KB

MD5
b952c3c81ba34b54c66c748ea1e828a7

SHA1
9d35f805e98f95e72f5d0a4ced7397584d7349be

SHA256
f5a6dcd3227d1a75db47a6770e617d8077cba42c146d1d6479ae394431c7d40e

SHA512
30ddc9f9fd2916b3ac846cac60c93b5f89057a1369ffd38ccf569a6eba3dff6be10408ad7413257e794e94a46e68e67105fae28f1ce95544485edbe85842a420

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\Raleway-SemiBold.ttf

Filesize
159KB

MD5
87641f9900d717d6bfbf108b8755868e

SHA1
75f4fca0d4d80e2b9a62d3283261e933786fb8c1

SHA256
564368e49d2d7d65005649278c3e042d6954df5e5dee3874a3b548ad067db0cc

SHA512
a319660d6457efd705c291aa5445146f77e2d099ac26be3f48963b9846cb0f3cfaaee1fbd1e9acb5a7ebb74d39b541d00c76fd50932b388cee7ff54da2ef40ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\icons\close.svg

Filesize
201B

MD5
7f8d672a2849987b498734dcb90f0c51

SHA1
e53b9319bf964c15099080ac5497ee39f8bab362

SHA256
4a290648cd1cfaaf1db4909d7552ae8cb83cb0b0e36770e64d153ab07ce6e7d4

SHA512
b3ddbf719f42440238c55cee896409179b4562ffe74f607d3640f623c8264c2fd2000b085dfd9a25ffd8ba2166695dcd663efec56cdac679f9993cfb602459d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\icons\collapse.svg

Filesize
195B

MD5
ad6092934dc48be9d00331e6f21eb235

SHA1
29cd8e5478e432b386382caf6ac7b3537b108c33

SHA256
2e0eb48ef144b771903a2ee5096ac4305ef43c830d2905f46b0384a07f5f4090

SHA512
38254a977c1a74515ed6184b5ebb3b1b3125db4b713a2de69aee9dc54912a9e869fede36423548e9ebf8cfc66e6711738789ee2c33f6f3af74def779eb7e5afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\icons\folder.svg

Filesize
232B

MD5
50cecdece7b4bc925f5d0ee89b23f203

SHA1
dac0f01235ed5abd451b5ecd342686670a51a906

SHA256
be467574fdcd107ce7a0e7f7036a5c97a8073c77caafc3cc414da5335723cce3

SHA512
9ae7491302fcaa7426f944ec0658d05a32bf29601f8613828a2a00f9ebbdc66cd6b7f3d03abc9030e907ea057b623bc075319ccd2546430b92a3904e4cc4ef2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\images\grain.png

Filesize
79KB

MD5
3577f702479e7f31a32a96f38a36e752

SHA1
e407b9ac4cfe3270cdd640a5018bec2178d49bb1

SHA256
cc453dfe977598a839a52037ef947388e008e5cdfe91b1f1a4e85afb5509bee2

SHA512
1a4a03931ab56c8352382414f55eb25b324e11890d51ba95597dbd867b35db45db5adcefb47d95b3763f413a66e3228e59531bdbd5ba5541469196adb5eb3d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\icudtl.dat

Filesize
798KB

MD5
cf772cf9f6ca67f592fe47da2a15adb1

SHA1
9cc4d99249bdba8a030daf00d98252c8aef7a0ff

SHA256
ac44ccc3f61bf630bb20fb8043d86cfe4c8995d06b460084400db45d70497b30

SHA512
0bec0d3a34a4ac1cc2ed81dba3bc52981c5dd391a68fe21132dfadb70e42ffbe8f3ba798185733d64a900fd2bb2403f9a8558e6666f2c1e2c0e818d8e3f154fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll

Filesize
780KB

MD5
e94e5995ed925527151e4ab48c70909c

SHA1
7f6380c1b03977baba978f87fd15e772e61f85f3

SHA256
ec6eff39607fda61c811050e6e30d932ad23d21d0ebc47030fbd4b1e4349bc5d

SHA512
a772f26e97a0e01cac671b09aff81a6c17aef70cbb35cae80c38419d102ae2f12af66198782b039fc4d89b46b38b5c7c69afd4f319de2274a9503ef863524d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll

Filesize
242KB

MD5
d6809c56fd07349e18329be3a76e11e8

SHA1
364b0b2c93566891228760b81f527411824a1c9f

SHA256
3d28ca5582ae783d828ea2cfabf9002d4150beda13e8ba216d4d7c399cfbbd42

SHA512
0f0cfff14c7fbad731cb362838d19c7b7aa344b8928252d7a6c4366f31a5e405d75a45b04ec82ffd95476ec5fc1c94ea2f116778b241826dd74a2518d4ff45d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\msvcp140.dll

Filesize
359KB

MD5
33663b6bbef5079665e40c041f95a2f8

SHA1
56f0d4a446e7993db948e3a9de33ae9ff1a6e4b9

SHA256
4c840424e5e5c550dee01a2d4a9e84348bc71059184db0e757f383a4f312fd3a

SHA512
c3bde4dbe91017435d88dbaed27468f2dadc826e0aae0b0ce30cb566fd692dc02a5b5df93fba8fe92b2cc030b0072aa54554caec8f8a62b8a969e1145258908c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140.dll

Filesize
116KB

MD5
e9b690fbe5c4b96871214379659dd928

SHA1
c199a4beac341abc218257080b741ada0fadecaf

SHA256
a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8

SHA512
00cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kr54cvew.vne.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-10.svg

Filesize
874B

MD5
e1733e3a43bd068e53cd7797a68a6167

SHA1
26e1c47dc2ef31f4f62d4c2cad930aa7378dda9c

SHA256
6acd550e4998b761df3470d8914357bc958d03ba0f60229a0e4888d9b0c502b2

SHA512
2d042d04c7dab4659740869ab609a99d614289e5c042ca4aebef3c06cc3888b9cc98c9b5ea7b449e7b90d61078916584e93b65e8ea6ed25153056eee81c2e75e

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-11.svg

Filesize
2KB

MD5
e481da5bd89b9455baa45f686046466a

SHA1
e01fc3914c52af85fdf9a0a3573606faa2150cef

SHA256
b2d49e98435c31dc561f44ea22b4fe109b65190ae8598e60cc48f8caff9ceec7

SHA512
0417957790453a0da90b4541b5b1797c7b85afe7b4a6aafd69550c7daec69afb668ef7c14661e6d56e193ef379790eaf54c639e1049c278d906c2d2fc05ecab4

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-12.svg

Filesize
466B

MD5
b82be3e7bbc539cff8c65d2445985f18

SHA1
c05337b679a610240df0b8bd46491b89dc4ad182

SHA256
fbbe56de1740285b80b2c1462136c909b120be05a5fb88283d37236301b60c5c

SHA512
decc9399d6d59e5e5c5eb514d13ce0e93eff858d9a8192ce9dcb62f2267407b2930291de00d1c5e484fb16dc107eb602f78557bd88b52ef27527aa20c45d876f

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-13.svg

Filesize
925B

MD5
937cefdf70a564a65c26315cdcb617d0

SHA1
e5c65db186de14bf8aac97c4e0e641aacd37e5ce

SHA256
b2cdd4fa37d58c52739361fdfb4a4d7997f337ff7e93e369cad2840714f16606

SHA512
4b51a02560485c6db8cead3fd5937a43632c11dfe2830bc1ab90b3563774bef4753e7883eedabc13ff6fcbbd8136921703b1703ac89b8d6ae850affcb055975e

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-2.svg

Filesize
2KB

MD5
f374bb708d64f3314f9d1c6198294512

SHA1
8a800faa352e5aefc7ecdd2f68bcc8a7631823ad

SHA256
afc41b419bcee57934803cc8215dfebd4283f65b9d160a23dae760e159b7da53

SHA512
53a2bf23a854928c346f5fa4a317b19b5ace630402daaadf4033f8fbc49110d222b0c6d8772c04efa39146f92720dd91611844fc2b201c6397d8776fc87d76df

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-252490.svg

Filesize
972B

MD5
67c47120d5ec695a91d8183cb5670628

SHA1
89235ab6e57044032d8e4841bf609d735e6bd77c

SHA256
299354d2c1ed79df9957868b229a6898d7aa32decec3101793154d80749584f7

SHA512
b754fc5705485a125fb9a6ba60f387c2dc638b419d03d673b17f02d523117f17054029b1d7836b5e5f58826598921e388dc39cdd0f5db798ed3b81a44d294120

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-3.svg

Filesize
430B

MD5
f3d936c7c4fe49fc15acc614fad46dca

SHA1
cab911867e02419f510672ffa7a43ed38e4f3756

SHA256
64add75f471ba76341e7191e1644ec65bd58099bc659dd98f8516adcb61b9973

SHA512
c6a04897b06ef4d348a0a749042f49899d7e10f802523e4a08becfece46e4c8aa0663cc916302081081b2aec28dfba73ad5b15424c5463833a4798da69576ee6

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-42700.svg

Filesize
5KB

MD5
51963f67a91fe04a2d6ae1a1d07948b0

SHA1
430622e795184a4208657492b3b899fff3a49320

SHA256
78f72961e264a266b835a60c3e1b432be8de432e2a61689d168284080ff5f1fc

SHA512
73aacaa085d5e07c42d3449c2b93e45125c75876c2a443b383921f75a641cfd3d5e9905fcd640daf5b8a07427c2a668c4c544c3e2400be473587bbb3df574d1b

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-5.svg

Filesize
626B

MD5
d2e388ae38f72644abf751d39eb8690a

SHA1
564b44d16ba3139d08a04326741250a3042b9a25

SHA256
86d36614e223078594e8eb96d77909e06e273b2317c4d5e0d9f8fa1c5a39fc67

SHA512
02356f177cc03df2b955358363eee98403f831d95db86e67a9e338b9e2baaa3d2f9439d1ff8f1af2d5cffa168c15228691b9da167f7209eebb872c77544c3c2e

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-6.svg

Filesize
721B

MD5
7b985cf8f7842c2b93233dc7d2488bb1

SHA1
4de78ff5db8a9b45371529e03383bc157df9127c

SHA256
ae7bd928ab4d0143b99d80834f6efce4bbd3258ef544bdda56944b1259d0bc09

SHA512
efaaaacfcd999da5c318ef8ad5e014e60cb971167ee824171a89be4314d52905039c42af6a109f90283854b1226b79757cca3c1b7c7b84b39021ed1d9e65af49

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-7.svg

Filesize
866B

MD5
34b50413b7335587a0175328c9a86a4b

SHA1
22b4c58badda96626aee9e50c3c2d16cd134b1a6

SHA256
e0efc2d3a7a0836a695f56f126c30854eecc8550c60d8a47dfc8741137f15ea4

SHA512
b5ec5ba12fac8a987b624b4ea1090f0fb7646eb6a10ea5e31801a25c6f398196145b5441111322141dc68d9cfad0a92873d2e76f9a8245697fbf6aa540024fba

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-8.svg

Filesize
747B

MD5
2defbe5c7bf5b395e8fed6720bf3fbea

SHA1
792a5fea20a88ababd2758fb4fd3bfd3606233c3

SHA256
75d1339247c7549e7b666e273a18294077398c183e50ef05c791d2eb90aa9bce

SHA512
b636529f3342052fa3b678f00b4e333a230dd5aa30551fd1aa1a21f39d1226192dd6a522404f1068db0d96c214be8291f9a8b7b0d09754296de3b00f52df8bf1

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\-9.svg

Filesize
5KB

MD5
37673fb4737f110ffcff30820f7411a7

SHA1
bcee7220faa640dc81e7bb225606a0837264cf51

SHA256
ea279b74ffba3ac4077d923e4cebb684b47670ee47bea531c7ec3ddce6ded9b4

SHA512
d5d319aa929c8daa9e5397a2f657438c4692dd0b477339071c2991891cc3d171dcfa5b46c5faf76ccf345abd2aaf1baf26dcb5d1114a5871105cf3146fd8b7f6

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\10.svg

Filesize
3KB

MD5
15cf6a3e9ba4a7d11a7985a5db7566cf

SHA1
2a567ca89cabc616f10d51b921d10264f1573742

SHA256
82f74a005c2a0182c66fc97bbb13112828df961db3287b062fd29c730cc59b02

SHA512
d4a743dab395318c346906f334e92abe05a0118051872083399a664fd4d304773584ce4b9a40f198200c93fd928570c3c42b6c56609defe3cfc40ea6cb555d69

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\1172470.svg

Filesize
454B

MD5
32023b6e90d55c9da91d9c9c0768c5e6

SHA1
60d3e784395f0af77ea0570bb76ad01b7fa83776

SHA256
52cc775ad72189ef294aa7c090f34bf21f0035c65f6f199f5673073c23e99657

SHA512
a5ca4cbf08916285b2e49ebb692c5f1adaa2e5f9261aac4336ad96e4c1cc443200a0aec868a4bb3981727c8cc5b1afe51321dd5c496efd04e6018dd2b688c232

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\1172620.svg

Filesize
19KB

MD5
4ec209c323686d0ec6020de44df9d255

SHA1
27eefcfc6e9a34b934c1ed425ed6c75ab3556806

SHA256
1ec6c143637a647438a4af779ea8976a7d470ecd5d73cba7de6f4c4f2b3228b7

SHA512
7dfffe247eb7a80bebece27e90949404911e7ef17a4b6cba0c03436392695488dcaed609086ad0f423a1fd8b9320fa578d6b92153ff6334cbdf1e1e574bf0bb7

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\1623730.svg

Filesize
2KB

MD5
ab88961a57678b7d1b62468e10a06420

SHA1
978e5c20af843af29f51b28a22e4e563d3d9ce9c

SHA256
aff383b405180b7802aec8369858df99a5481d16138ca301b8aac943f7afab2f

SHA512
30dd8d6cce0a445b7f5262400c222b9b8bb531d68aa0bc02924cd3d2c759aa6f013360fd01585557e342326bac234267229cba0aba4fc3825e7e6fd90ed99c38

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\1966720.svg

Filesize
33KB

MD5
5caec73ea52aa613243d9aef369fa4b8

SHA1
ea579c39fdee7bedf6c5a274d9e0ddeef1845574

SHA256
bfa8e1bacfa74cf58d74911da2052c87f695b4efb72c93cd8bd47adde449c45d

SHA512
9468a776b30535cb849e5d09733fa1e22d34c4f6e522e990ec37b937503f9713a9e5d83cd801478d9220d55dbaddb96e4de7b0e9bc803c507c55c394b3f8cdb6

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\240.svg

Filesize
1KB

MD5
1ae03acedc307c0cdd568eb3279a704d

SHA1
d038d97a0e32d644cb80764020e76c925a29d4a2

SHA256
6febbd4148072bebd4aec847f2e476a5674b4b165e9b1fe0f919e027e5fc99ab

SHA512
619794107cbef64c09d43aedafa8a3463ac9e986b9babcbaa697b1c634b482bec4dfab24c2c806ee7673850d1a67c7a97ab0125d9e752914a621adf57b6d9c04

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\271590.svg

Filesize
724B

MD5
ff13af16817c1a5913f70ab053b55d5a

SHA1
40569c4e66865e41804db84671a1b1b04f43d7c0

SHA256
13fd39fd44ffca22e442c6b200096eae6a4132c49f64caeb1a56b40f2b2c2beb

SHA512
10d09021497bce0354bf42b003bed6a741f6d740bb5ae8976e6e2dac70bcf1255f6ece9864fa1e583a9cba92e4fffeb620aac667a37421dbfb22e02cc4288406

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\304930.svg

Filesize
1KB

MD5
44a37801889fc2fcc6397e7fb1286c14

SHA1
55707d11d25df26b5647956c8cec51dfe3d72ba7

SHA256
7b299b18ce300ca36bce22f7c8bedbbcf6a299e1f641e5a76ec34813c630ec2a

SHA512
cd54b4e7c9a089efee331b824a07bfe72ff545f78fc60e15b656beab168cf32f666dfcf08c6db04cfce2ec79ca7919bdd3b66fd926c79d92e670fa4e8b5026a7

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\320.svg

Filesize
695B

MD5
99f33f2b60d2d1a0bab71574f73728cc

SHA1
ed72326ad12b4919e0396cadb74cd99c2c0ce7ef

SHA256
a405dd019294eb623c37fa1565044919954bdf92c9fc42ed2f1d901f58e4c270

SHA512
92529874f9d513e77abd74cc82f887e87ef02c96a705c4aa9c9c306283afc8b23081dbd4bb4224eb17d910e44e8955489f1039f78ed26691f479bcca03568d0a

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\4000.svg

Filesize
1KB

MD5
c7695e25806185b8d62c37866b6c41ac

SHA1
c1ebdae56b6445dfb08c981cbfd98fd1410a3ae9

SHA256
71626b7ac4e4b28d0169014d161a55a97ffc03b655d86d63db0e96d78680228b

SHA512
235520361e00a72ec5a772e0008d1d2e7191ac9e3aa292ad98fda33cd1f58756fe577820457450799529af1be23492322fafa471d15e92019bf1b0d127f45b0b

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\440.svg

Filesize
766B

MD5
3b531921781a2400c33d1d35ccacb369

SHA1
f1f234152a8ad61112d4b29283e57a8a40dbb474

SHA256
195463ae571b1730967b0ea06dd8496df2364f9cb683c3d169236dcac51f4c60

SHA512
8ae3e3dccfc3f814ff61b0eb30514f4dda580eb4fdb9913d73d9dff699c724c04ad0b6b8762cd942a3e842f317e27be63f88bb669f723f1b915e5165f281c2ea

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\550.svg

Filesize
1KB

MD5
f138aba7dc07fda623e78581a299a290

SHA1
ae465a1ee4021c5b97b93b2efce96cdb465b02fb

SHA256
6b531e50d8cbfd269095a3d57d01c3ec2c4402f66b16d53aa5346f2ceef7abff

SHA512
530d583521064643f513c6d826bc431209ac2af1ff0f4dff1d8f85dd7d4f2955551738b96ef6ddde1cc02d906b932017bfddb21c41b3f03db32e439edacc22ea

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\570.svg

Filesize
1KB

MD5
4c0a9209c2c60797c3d984addf0deb8a

SHA1
2ad7946f379aca5f0b195c2ad38b2a844f3c962b

SHA256
3b5b14a838196a58cd3f0539f6bcde5a00f79c95e8830ac531c8c1c01fea18be

SHA512
d404e079d94b3e8e22884e9091f67b1c971ce7192ebd19983e9c5accc70536667e7de9b545cd5f0125f24a6a5961eb68c706e8c732ef2106d4f7132204d28f2b

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\730.svg

Filesize
3KB

MD5
6d9817ccb2be9280308fce44c456b5cd

SHA1
9a17d7f992d78ff4c968d990189e635975a87ee0

SHA256
f66b912bcca1c69a36742ec0f7d1e23b1b50ca7158321a60aba4bd631e43bc81

SHA512
3d830f6f4ce885de48f94f1433109736788f83fb92fc8bdfb10d00ec1c21bec886d48374d30d096181249d46bcff766c4e58b9cffdd300e2b5f50eaa9c33cd6a

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\731.svg

Filesize
3KB

MD5
96552e7d817c03a0f288a5955ec78b2a

SHA1
eb4a454c80e2f985fbe78ac2db1ade4e5cd84064

SHA256
64dfa7a49091c7f824aca93975d4d47469dc967832bda600903695bbeb0ffa56

SHA512
4a8c9f609eb082ec9c9d734b913293e48c00e3431c73be31cb8210460a4e02c12b150b98392ed80e312bbc15e011895433f247838a4a097147e0e0d291d4e9f7

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\945360.svg

Filesize
4KB

MD5
24bf9616c43ff2bdff3f2be2d17fedb5

SHA1
473366969c39bfd2245f6e13541129fc4a11393b

SHA256
4f4f69262f7ac58cf7915013edf1b68fb18637cf452c0b04f53b223a4b7dca6b

SHA512
5e0546e1ef2c14c359356fb9f904de93f6ed1ac0dd885753cd0667c74196669b10e7e8b92a7ab9db757da24eb2ce2b53ec55fc690f0024c2659530394e515e6c

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\shared_preferences.json

Filesize
262B

MD5
bb52ff288270bfe61f39be1bdfd694e5

SHA1
35f2955a6ad3bc08db5f026b92b136fc130d2c1d

SHA256
7cd9a17b6c58f2e08b432a4950252e5c2a97b0d3e3ff72949926bdbbb02bc3c3

SHA512
3efa04142fa0bc54d10d56fde3702c8cc6efe93753c67b00e26e8965403e83189f65f34b0006dbb98d701d2fb5cffc3dc47b3e0123e29ee16689b42a8c7a3eb1

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\shared_preferences.json

Filesize
692B

MD5
25418fe93971d7983cefe171d25d9800

SHA1
d411a3c919a6c7818a4d75b280e5065622a1f793

SHA256
ba2ca758ee6051f995b63b2207e7047d6d766f5e0b28dcb536a68e67743c05b8

SHA512
a5d52e1c6c4387bc832118c792cb59e43d77559c07283e72e221820e953208678b9d954d9ed396af8c993f5699f02ec88f9c9afb71248259a670d93ac6364df9

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\shared_preferences.json

Filesize
811B

MD5
b57a041f8d1a2f0604841a3853923cf5

SHA1
2f14c717b16faa70d28ab62990d91444e2b261ce

SHA256
97bf00c80afd886590a83b34e7838303303fc24e15d1c296ff308c1112fa83f6

SHA512
6891a8b2d19fe6bc5e6e0d01056bae5db606cac8b35590b0f66e090ae26496eef6f038d8448844f26c454cd13a891b2c99cbb7bfeeab71dd4245bef2600eeb8b

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\shared_preferences.json

Filesize
811B

MD5
a45b538e55789b4e912c84774011cb33

SHA1
db39ce443ac4110c8ef5626623c48d1fb440aedb

SHA256
26a63afe060ef87886d150f614df6af1679914ed4a75fe8b6120ace6097f4755

SHA512
1fc291f6418b95b74daa2a86aed2e29b4073b657dc0296db9a20984730e8e0242eaf6ee8696d1a50fbbd0facc72011427e05244f10c77b5d7d9578ced836782a

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\sounds\Sounds.zip

Filesize
18.0MB

MD5
17cfe601c1df81af1067b0ffbd9d7f71

SHA1
91fa853eefb652a9ab62789d55cf7647d95e662d

SHA256
e23b7ef7a3ac31413d1057a1a8e93f74731abb51cdfd5c234c5dd8ee0450a10f

SHA512
d6c473be82b7ac812e4f8a9a0a505bb4723271f25aec6a9a80d48b755a0140946fdf401f32447dd547f241440bed571e5b5f62deace229a20fb36e83bc77f878

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\sounds\de-de\abominationpissed2.wav

Filesize
131KB

MD5
b287fcc8278972ff72b8e46b481c4ab7

SHA1
71a91ebbcfb6debe7673a0b59079c5e90cb2ede3

SHA256
c87cb5c9c64b5798769af14563e268080ed82c7c8a1958f6fa1c1b5e7f10d2e2

SHA512
746f5d9232a06b5a415391dcc191902c7ec12465a22551342823da5880a16e9b9cb44da7052638fd0f5a2211ba8b97be6d835f5931bf34eb4fb1b96c6c529c40

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\sounds\en-en\abominationpissed2.wav

Filesize
80KB

MD5
04de7b1fd5d0fce157b378ebede59df1

SHA1
97709ff9bef57080569f04f99efec6098cba3bc1

SHA256
3939fcaa3b0efd6d601da475abea862d9f7c078643f1063df51c83609cf47a6f

SHA512
31dcee1e7f1da84853bc8e41c108b1856020ea8da09bf2dd75b2902223f96540e148be9daa2e802358a5d78296ca5c90fa68c8f34f0a52b610f9bad446fff728

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\sounds\ua-ua\abominationpissed2.wav

Filesize
156KB

MD5
5c4c79ff61bc28f30fc6b2a221975b98

SHA1
82bbdd2bf6c5bb2941788c0ea594c0185c6a17b5

SHA256
d5f7ea66bb3bc77de30b0b450b37dbac1dfa2f30b8108fce9ac2752ce9ad2838

SHA512
d2fe68b06c3852111cb03ac6b55cdccc6cf232aed1170eeb4709493e6b1e87a2b8b2c30223e502dacafb3a2d0b07b62a595086336cc42e63b83e8443244b5954

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json

Filesize
262B

MD5
e70d0497cd979139f361b4dc7eecc226

SHA1
3538f418ec2784f33603ae79db18129c51173445

SHA256
2b65eb11af83d045ca06c7c2f525ed7cd5f61e4b11a6713d1c10cba93a93f3d4

SHA512
3a0a8818bdb1a9deecc67ecda204482d23155f497c78c743a9471f5ac98b4ca0af701e95ebf117b948a9c8485d87103a7f9a854a3d501ea8e36cdb0ed517ec94

Download Submit
memory/864-1822-0x0000027752180000-0x0000027752181000-memory.dmp

Filesize
4KB

Download
memory/864-1884-0x00007FFD4B250000-0x00007FFD4D358000-memory.dmp

Filesize
33.0MB

Download
memory/864-2352-0x00007FFD4B250000-0x00007FFD4D358000-memory.dmp

Filesize
33.0MB

Download
memory/864-1826-0x00000277541A0000-0x00000277541A1000-memory.dmp

Filesize
4KB

Download
memory/864-1825-0x0000027754620000-0x00000277555E1000-memory.dmp

Filesize
15.8MB

Download
memory/864-1824-0x0000027754620000-0x00000277555E1000-memory.dmp

Filesize
15.8MB

Download
memory/864-1823-0x0000027754620000-0x00000277555E1000-memory.dmp

Filesize
15.8MB

Download
memory/2156-2819-0x00007FFD4B250000-0x00007FFD4D358000-memory.dmp

Filesize
33.0MB

Download
memory/2504-2836-0x0000020095930000-0x0000020095931000-memory.dmp

Filesize
4KB

Download
memory/2504-2835-0x0000020095930000-0x0000020095931000-memory.dmp

Filesize
4KB

Download
memory/2504-2853-0x0000020095930000-0x0000020095931000-memory.dmp

Filesize
4KB

Download
memory/2504-2852-0x0000020095930000-0x0000020095931000-memory.dmp

Filesize
4KB

Download
memory/2504-2851-0x0000020095930000-0x0000020095931000-memory.dmp

Filesize
4KB

Download
memory/2504-2850-0x0000020095930000-0x0000020095931000-memory.dmp

Filesize
4KB

Download
memory/2504-2841-0x0000020095930000-0x0000020095931000-memory.dmp

Filesize
4KB

Download
memory/2504-2849-0x0000020095930000-0x0000020095931000-memory.dmp

Filesize
4KB

Download
memory/2504-2837-0x0000020095930000-0x0000020095931000-memory.dmp

Filesize
4KB

Download
memory/2504-2854-0x0000020095930000-0x0000020095931000-memory.dmp

Filesize
4KB

Download
memory/3296-1772-0x000001E09BE30000-0x000001E09BE52000-memory.dmp

Filesize
136KB

Download
memory/3296-1773-0x00007FFD4D9B0000-0x00007FFD4E472000-memory.dmp

Filesize
10.8MB

Download
memory/3296-1775-0x000001E09BE70000-0x000001E09BE80000-memory.dmp

Filesize
64KB

Download
memory/3296-1774-0x000001E09BE70000-0x000001E09BE80000-memory.dmp

Filesize
64KB

Download
memory/3296-1780-0x00007FFD4D9B0000-0x00007FFD4E472000-memory.dmp

Filesize
10.8MB

Download
memory/4980-1097-0x0000012C9BEA0000-0x0000012C9BEA1000-memory.dmp

Filesize
4KB

Download
memory/4980-1098-0x0000012C9E470000-0x0000012C9F39D000-memory.dmp

Filesize
15.2MB

Download
memory/4980-1099-0x0000012C9E470000-0x0000012C9F39D000-memory.dmp

Filesize
15.2MB

Download
memory/4980-1100-0x0000012C9E470000-0x0000012C9F39D000-memory.dmp

Filesize
15.2MB

Download
memory/4980-1101-0x0000012C9BEB0000-0x0000012C9BEB1000-memory.dmp

Filesize
4KB

Download