9429ec8822499a198cda14521355f7c9929fb957d1d50b7b08d51ef6f0223581

Resubmissions

19/03/2024, 16:19

240319-tsyv5sgc62 7

19/03/2024, 16:12

240319-tnhclagb68 7

Analysis

max time kernel
126s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sky-Beta Setup 1.0.0.exe
Size

80.2MB
MD5

f35cdad9509e69a23a92f011429b363a
SHA1

6d4785a2ca81dda97e8f16f83e676b5dc79966e3
SHA256

ddad1649d171367b307aa77f14b10826d6a5ae1d1dc1656ef1a7ddbe6ca43af3
SHA512

5465a46dfffa5aa83d077640736b3ff0678843b67cdc6d6c26c02f09c6b35a7baf86fdb63be2575a911297041bd29b45132828e64407ec24d0068c58eead9736
SSDEEP

1572864:JkJ39KfNXWLJ9MXY5B8ceyIS7nqYdd6hIEhSmnJZxRByudPXFPR:JnfNY9MA/vP7nMhJnzxRB5dPXdR

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	Sky-Beta.exe

Executes dropped EXE 4 IoCs

pid	Process
860	Sky-Beta.exe
3288	Sky-Beta.exe
1760	Sky-Beta.exe
2076	Sky-Beta.exe

Loads dropped DLL 17 IoCs

pid	Process
1676	Sky-Beta Setup 1.0.0.exe
1676	Sky-Beta Setup 1.0.0.exe
1676	Sky-Beta Setup 1.0.0.exe
1676	Sky-Beta Setup 1.0.0.exe
1676	Sky-Beta Setup 1.0.0.exe
1676	Sky-Beta Setup 1.0.0.exe
1676	Sky-Beta Setup 1.0.0.exe
860	Sky-Beta.exe
860	Sky-Beta.exe
860	Sky-Beta.exe
3288	Sky-Beta.exe
1760	Sky-Beta.exe
3288	Sky-Beta.exe
3288	Sky-Beta.exe
3288	Sky-Beta.exe
3288	Sky-Beta.exe
2076	Sky-Beta.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
62	discord.com
63	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	api.ipify.org

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
4920	cmd.exe
2040	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3964	tasklist.exe
5016	tasklist.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1676	Sky-Beta Setup 1.0.0.exe
1676	Sky-Beta Setup 1.0.0.exe
720	powershell.exe
720	powershell.exe
720	powershell.exe
3788	powershell.exe
3788	powershell.exe
3788	powershell.exe
1760	Sky-Beta.exe
1760	Sky-Beta.exe
1376	powershell.exe
1376	powershell.exe
1376	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1676	Sky-Beta Setup 1.0.0.exe
Token: SeDebugPrivilege	3964	tasklist.exe
Token: SeDebugPrivilege	5016	tasklist.exe
Token: SeDebugPrivilege	720	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe
Token: SeShutdownPrivilege	860	Sky-Beta.exe
Token: SeCreatePagefilePrivilege	860	Sky-Beta.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1336	860	Sky-Beta.exe	95
PID 860 wrote to memory of 1336	860	Sky-Beta.exe	95
PID 1336 wrote to memory of 3964	1336	cmd.exe	97
PID 1336 wrote to memory of 3964	1336	cmd.exe	97
PID 860 wrote to memory of 668	860	Sky-Beta.exe	99
PID 860 wrote to memory of 668	860	Sky-Beta.exe	99
PID 860 wrote to memory of 4920	860	Sky-Beta.exe	101
PID 860 wrote to memory of 4920	860	Sky-Beta.exe	101
PID 668 wrote to memory of 5016	668	cmd.exe	103
PID 668 wrote to memory of 5016	668	cmd.exe	103
PID 4920 wrote to memory of 720	4920	cmd.exe	130
PID 4920 wrote to memory of 720	4920	cmd.exe	130
PID 860 wrote to memory of 2040	860	Sky-Beta.exe	106
PID 860 wrote to memory of 2040	860	Sky-Beta.exe	106
PID 2040 wrote to memory of 3788	2040	cmd.exe	108
PID 2040 wrote to memory of 3788	2040	cmd.exe	108
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 3288	860	Sky-Beta.exe	109
PID 860 wrote to memory of 1760	860	Sky-Beta.exe	110
PID 860 wrote to memory of 1760	860	Sky-Beta.exe	110
PID 860 wrote to memory of 4440	860	Sky-Beta.exe	117
PID 860 wrote to memory of 4440	860	Sky-Beta.exe	117
PID 4440 wrote to memory of 1376	4440	cmd.exe	119
PID 4440 wrote to memory of 1376	4440	cmd.exe	119
PID 1376 wrote to memory of 2076	1376	powershell.exe	120
PID 1376 wrote to memory of 2076	1376	powershell.exe	120

C:\Users\Admin\AppData\Local\Temp\Sky-Beta Setup 1.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\Sky-Beta Setup 1.0.0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Users\Admin\AppData\Local\Programs\Sky-Beta\Sky-Beta.exe
"C:\Users\Admin\AppData\Local\Programs\Sky-Beta\Sky-Beta.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,192,218,118,111,122,74,164,64,163,38,154,151,69,200,225,129,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,43,198,53,56,60,158,173,64,46,88,150,22,150,74,187,10,162,35,140,44,194,181,226,8,96,53,28,241,227,95,72,133,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,102,101,34,50,234,149,184,54,179,243,5,180,220,157,236,48,3,140,208,250,50,130,86,214,249,202,131,208,174,19,48,179,48,0,0,0,101,181,136,200,32,24,200,118,33,230,159,117,175,31,130,153,187,35,81,54,254,162,142,197,9,70,200,154,182,118,147,21,86,47,155,233,186,26,170,45,229,96,41,41,233,239,151,110,64,0,0,0,44,142,18,253,21,65,67,0,192,174,58,149,232,66,42,90,118,74,43,1,229,78,42,231,161,75,234,179,143,155,184,141,46,195,24,219,63,97,49,7,90,101,67,17,152,32,183,104,236,22,2,146,68,74,127,88,178,142,78,131,25,63,114,148), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,192,218,118,111,122,74,164,64,163,38,154,151,69,200,225,129,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,43,198,53,56,60,158,173,64,46,88,150,22,150,74,187,10,162,35,140,44,194,181,226,8,96,53,28,241,227,95,72,133,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,102,101,34,50,234,149,184,54,179,243,5,180,220,157,236,48,3,140,208,250,50,130,86,214,249,202,131,208,174,19,48,179,48,0,0,0,101,181,136,200,32,24,200,118,33,230,159,117,175,31,130,153,187,35,81,54,254,162,142,197,9,70,200,154,182,118,147,21,86,47,155,233,186,26,170,45,229,96,41,41,233,239,151,110,64,0,0,0,44,142,18,253,21,65,67,0,192,174,58,149,232,66,42,90,118,74,43,1,229,78,42,231,161,75,234,179,143,155,184,141,46,195,24,219,63,97,49,7,90,101,67,17,152,32,183,104,236,22,2,146,68,74,127,88,178,142,78,131,25,63,114,148), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,192,218,118,111,122,74,164,64,163,38,154,151,69,200,225,129,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,201,230,97,125,240,15,113,26,243,39,203,109,36,159,227,153,24,176,220,244,135,232,118,95,13,22,189,3,220,32,148,128,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,227,14,209,42,3,149,123,15,186,217,226,89,144,161,234,86,128,81,66,158,124,161,224,147,94,247,210,71,122,229,64,50,48,0,0,0,87,26,76,98,25,166,137,35,42,36,178,81,91,209,188,75,165,169,34,40,51,94,90,219,183,188,10,128,116,142,31,226,61,123,161,5,9,192,40,151,152,169,184,87,118,178,175,147,64,0,0,0,86,197,110,156,197,95,221,79,211,15,146,26,140,170,247,130,90,255,169,126,20,43,4,78,172,249,146,43,123,49,193,191,2,25,241,225,11,103,214,38,72,37,132,171,97,107,38,187,12,240,239,239,139,86,241,90,119,246,172,254,232,37,229,58), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,192,218,118,111,122,74,164,64,163,38,154,151,69,200,225,129,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,201,230,97,125,240,15,113,26,243,39,203,109,36,159,227,153,24,176,220,244,135,232,118,95,13,22,189,3,220,32,148,128,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,227,14,209,42,3,149,123,15,186,217,226,89,144,161,234,86,128,81,66,158,124,161,224,147,94,247,210,71,122,229,64,50,48,0,0,0,87,26,76,98,25,166,137,35,42,36,178,81,91,209,188,75,165,169,34,40,51,94,90,219,183,188,10,128,116,142,31,226,61,123,161,5,9,192,40,151,152,169,184,87,118,178,175,147,64,0,0,0,86,197,110,156,197,95,221,79,211,15,146,26,140,170,247,130,90,255,169,126,20,43,4,78,172,249,146,43,123,49,193,191,2,25,241,225,11,103,214,38,72,37,132,171,97,107,38,187,12,240,239,239,139,86,241,90,119,246,172,254,232,37,229,58), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- C:\Users\Admin\AppData\Local\Programs\Sky-Beta\Sky-Beta.exe
  "C:\Users\Admin\AppData\Local\Programs\Sky-Beta\Sky-Beta.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Sky-Beta" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,11786531264134417876,10058012498776896927,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3288
- C:\Users\Admin\AppData\Local\Programs\Sky-Beta\Sky-Beta.exe
  "C:\Users\Admin\AppData\Local\Programs\Sky-Beta\Sky-Beta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Sky-Beta" --mojo-platform-channel-handle=2024 --field-trial-handle=1972,i,11786531264134417876,10058012498776896927,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "& {Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Sky-Beta.exe' -ArgumentList 'tDK7x7Oyfw' -WindowStyle Hidden}""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "& {Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Sky-Beta.exe' -ArgumentList 'tDK7x7Oyfw' -WindowStyle Hidden}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Sky-Beta.exe
      "C:\Users\Admin\AppData\Local\Temp\Sky-Beta.exe" tDK7x7Oyfw
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2076

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
f48896adf9a23882050cdff97f610a7f

SHA1
4c5a610df62834d43f470cae7e851946530e3086

SHA256
3ae35c2828715a2f9a5531d334a0cfffc81396c2dc058ca42a9943f3cdc22e78

SHA512
16644246f2a35a186fcb5c2b6456ed6a16e8db65ad1383109e06547f9b1f9358f071c30cca541ca4cf7bae66cb534535e88f75f6296a4bfc6c7b22b0684a6ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f79387492e5d2264cb94e2f480feaf78

SHA1
13f478f478bf824d8cccb611ac9b2645d5523c93

SHA256
f7d942ea9e79af246b7a4e461133ed9434f980e837a8b96f1e35f856ddead9e7

SHA512
c1a16d6c0edeba6659f08ae115b4ed5c496063d9e4339ff0869a85295798fb66281dba43b6de8118bda69db0d34a65966f84c522b9adcf94581934438c015479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b9eb429e83ffc903f0d6bd242fc22f2f

SHA1
735820ab609d51433853fe2647949fb49f9a0209

SHA256
3fa890b1461a67503f89b906633831a175858fd03a8a757781f85da7aede6776

SHA512
289bfc56ea267486950f4dadff0299a6ec6804f6f98839ecf9c368b238c804dd13bb63466d1cc964ababd02f92abbde6b41d5dd8588478a07c735d4540561b89

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\D3DCompiler_47.dll

Filesize
890KB

MD5
f9ceef109e2853213286d27106a8b6ef

SHA1
3ccc6d31a3c759b23c38e806707627bfbddbbf6f

SHA256
9b9161ca2af718ad73c87d94f068ec2294dacd95600d8fbaa3eda704ba6d3229

SHA512
2f53b8fff4bdebd2c44ca298ff806a03eab1e96246f01af0f1e432f023ec9ca78f1c382678b444688ae2f05cd281572d8675b4f58d1c96c722ec7c5ce176a4a5

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\Sky-Beta.exe

Filesize
2.8MB

MD5
95dafdf32ec1c1200a362407f74ad62f

SHA1
1ccdc9b3ccca7931bf8d84190702e2b4793356d2

SHA256
b19520613809dbb89575e532df93cdb54ff43e86c71e6ff77dc34e5a376dcdd6

SHA512
8d6610df58fff1f5b597d87e0d166270e7e041452a041634eae98707fea61f384c81c3cf47e0ca50c7e19d4093681b5f22a3613cfcb32fc7b0bdb9601cbf9df3

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\Sky-Beta.exe

Filesize
912KB

MD5
bd0d44f723c457faed64c8d9a7cdc02c

SHA1
d8e6d282a52731469b4a8dd4f66ff26d512325c8

SHA256
ea5b12d5dfcefec78b07b525fa6139a0014e2ec5fcf198542d6b419a027e7cc3

SHA512
243f3a08f5b1b7dc3de11773a4a6ced291800363dfa24810c75dac33259d9b62698839e913009fe85c66b0a8accd669431b683296142bf1f87d225b2a090d214

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\Sky-Beta.exe

Filesize
1.1MB

MD5
dde0b1645e07f1a9955cd548b390386d

SHA1
e6ff46e3d567299e6d24ccb7346f85451e07054d

SHA256
58fe73d67b0a5fa937f7a272c5d750a30c1e6a495dad3ba1a30c3a0d81c14522

SHA512
ab9a520eda81e04432c16fb734e659eed80b03fcf48747f294681f5715866d11865a36004e466ac16d68c498d0f83dafee74affdb6ebfd2658f5e600c281fd90

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\Sky-Beta.exe

Filesize
909KB

MD5
896eaa532bc5ce9fffdf3aa0499e3b74

SHA1
39c37e0da3fe01347344b46cea75a7b0756590d9

SHA256
19d68c8b19ba573487fb1751756432410af5751c65a1f6ef46dcc8fc41fa36c8

SHA512
08344694e2a1e5c9efbce21d411fc78145fd76cfe52c79eb0998c1fd20f01dbbe6e495be2b150580831d5a8808d74cc0536c8a4bac226b08e4673730715c6496

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\Uninstall Sky-Beta.exe

Filesize
147KB

MD5
7f539ec758326061bc5dd596e7530873

SHA1
09fb544e9db686adfd187b1b6bcd7aba8fffaad1

SHA256
9f88ccf69067eb1d3ed636dc5613c1f2a0cb416925268d3a6c5b4d86159e2e83

SHA512
e671711fe03d3433a11c6dc320a6d5cfe4f7f4181a0d0700960d9cd11ad4f05be0f648f4dded251c040fbfc5ece2ffbf5051ecbc5ffed504401a44dfb053c928

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\chrome_100_percent.pak

Filesize
124KB

MD5
acd0fa0a90b43cd1c87a55a991b4fac3

SHA1
17b84e8d24da12501105b87452f86bfa5f9b1b3c

SHA256
ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b

SHA512
3e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\d3dcompiler_47.dll

Filesize
984KB

MD5
734c76eb5153031b5923d335b7c2f78c

SHA1
62369dfb651af41a1fdad5dd4497926364e352e7

SHA256
9e51216a4f69d6eb4379c69e1775f300325048b3acb2dbedf56f89bfd64a00d7

SHA512
51b984956b7feeb64db3606a4141824954d2a5bf5a088d367b20e16665f7e80161c9b7686b96652cc019af317b7e11c1a93dbeac6f93f460868d778927ff1ca4

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\ffmpeg.dll

Filesize
2.7MB

MD5
a007299c49fa50aeff594655859780ae

SHA1
d202f1f617023763a0e9418878e8ecac96be9fd4

SHA256
b78f0036621ad1d5833289f2ad509963ef78f1a89a3c7df0f1370fd2d35a2804

SHA512
444c4baa1e1d941bd04f78184cec519c6eb53a83fbc3aa3ea30522bffc9ecde73ebe7b910c1a37c345429298ada3c0ffcb3e3849e21b2009487b5cd1a02cb2a9

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\ffmpeg.dll

Filesize
2.5MB

MD5
ab78b373471923d4a9abb394216c1fa8

SHA1
0333a60711d05f1fc67502e02480ac8a10053998

SHA256
2f259ece343922b4aaee53c042ea6bc6fb0a0c30c4b50998963c5947c974ea3e

SHA512
5ac10ba530c25b93f717d478756ee3edcbbac10d92ee9ae1b20a44bf775ae68ac00ee2ce43951006ba861b2a91414ff1575980a42b6ba0010125db4653012377

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\ffmpeg.dll

Filesize
783KB

MD5
e690b8c9f13f212b99da0f9746c3ed13

SHA1
044efb8597a3e713c3264a11e64603ba5767d8b3

SHA256
5aacfa84d1b7b740e111a8bb7d732c2757b46c1cf85877359c05541762fcd5d2

SHA512
df0e83af8a29fa0dfa270b9c00fab76c281fe5884ef490f8284d5147ef8af7b8cea6aca1007cce5a2cc94bcba2df89125eebaf6f71ebab05d80d4036a70491d9

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\ffmpeg.dll

Filesize
997KB

MD5
8a50e299354f31648d00d273f4f95c15

SHA1
a85378e235337cd1908f8a7ee5d424d96ba4a84f

SHA256
baa582e924a794877ba982ba9dc6ef5c1a59dcfc77bd92177af2970bdba316e6

SHA512
71140eb6c0af7943dbb56c191ed336b56885e80b59854b060b5c50a5ee51d558148e186de6960322f3d4763ace77a50c826d2aa8921de1bc22e780880083b145

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\icudtl.dat

Filesize
3.5MB

MD5
89337d8d06eeb96d4cd10195b84d7490

SHA1
f902fc854b9a7e1d4600251d8e2c8ab5c784c761

SHA256
f5bff2a30f1464680cb32e34857be3536cf0cdfbbcbefbefac419ebc8866e509

SHA512
14004d677165daf9649ad2b56dcd973b53fbc9c2e8430eed5f443c6d44c05bf37af300fb8e5f1b3d032f1f876c3a373a14ededbf3ced0285cbaf3fbaeb42fd82

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\libGLESv2.dll

Filesize
803KB

MD5
318b6460c4e531f343888bf121d647f5

SHA1
09e8505065f2c6eaa4b02c7c15ba7e8b83959c68

SHA256
74cd016d3d9742e7c917695bd71b90d0857ddedb830b71aea20549028dcec5a5

SHA512
abb334d8798a4d4c8ee63da93c12ecdfdf38885f51713966280f78c372786f90047e0889043b6f2b148a78a8b27e96869cd9595f4aad169743a4f193a28d8558

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\libglesv2.dll

Filesize
960KB

MD5
81d92254abc99b96afba0cf1623716db

SHA1
f4b364991f4f999f82c048904ada3e359b63abad

SHA256
0667f4307ee928bac157357bbf13d343e6afbe93aca788e340c2f7b4e2cff425

SHA512
541dac36ccc0bd4b9395456bb349ed001d747711b2bf482f47cb1a195685effa74f2e000ceaf97d77aa0094cfcf7820a6d17585f932a8d8238a1dc50cf3b648e

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\locales\ro.pak

Filesize
420KB

MD5
19cfc7c8f1a2e4a2de1f9f64475469bc

SHA1
bf6c4f373c19b03e116d2593c64e1ceca47d79dc

SHA256
3e725f7a791aed1fbed57f075ca11ce389a5bd425ccce3c00537dad27e5a8dd6

SHA512
ff5254e3a3676b8f5e74cba6661ae43d5739c7363c66cb17f74dce158dc36cee103885f055846dd320b932f2e7fbdc831bcee6293d423ff9b842b68644f633bd

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\resources.pak

Filesize
1.2MB

MD5
ff07c8cfa2b852812917da88777141fc

SHA1
13ffe8af526eb2bb2605d5ca3d448d4e734c58c2

SHA256
c013b3763a5be3cce2f65acd32cb371ff632c9598029f9e792a9fd392224a5a8

SHA512
701244e39cd001f69e42853ff774c61e46136212dddf8e8eaf9b47c2e560af4e753536def6d154b2b3a55a0b2c204188b45686a7d4f5f8e583c64ebafe1df3b3

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\resources\app.asar

Filesize
2.0MB

MD5
57ce6923d91b575d7783d7bdc0b0568d

SHA1
945f3d22b0f0f87c5aef9a68a04263b9875b3981

SHA256
e410a59a1efc7493ade102fb589fe57c1434479df629593151a5e33f11617996

SHA512
fdddfe10c9ac99a612d5755b10751302f2517796b9bcdb31cf9581f7c3b5793169674829e6d67b7b2f8855e80be8d87b89ff0f189acd2e00ad56a263e9f03c59

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\vk_swiftshader.dll

Filesize
747KB

MD5
7b5276ceaac361c54c643ed0d707c356

SHA1
8c9db7f2f57b12806a741579b88a28b6cad6dd71

SHA256
759fc4c3dda1d3fbe764c36e5e31fdbf7b1118c839a4718dae79ba694e9d1849

SHA512
ad1ff98e3955ac0da64a677d3555dca5b3642f4feaa48cd4d6112e77e7ba715d54c03afd090d3a3f98e073e6acd94ea2b52d2958708622db1e6bfa7a60026c7a

Download Submit
C:\Users\Admin\AppData\Local\Programs\Sky-Beta\vk_swiftshader.dll

Filesize
711KB

MD5
96685f1e7ab5aa1659779c3fb79aa856

SHA1
3eee8ca55d1c37c4b56cdecf08bd8f8e6782d4cd

SHA256
dcc2f7dd4b79f991795303399d72a5dc9b1923aef99638829d8ecb4e692b4c00

SHA512
045c3efce81aae02f7586c5e9c4558fec6a7cc7a67c84d8c0e042070f5104c59be093a8413811de420cc7c0ee7baa5bd6dd53b091da44a3b1b3bfc085c2c459e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sky-Beta.exe

Filesize
596KB

MD5
30245cda9fc95545f6d91e093bc67e3f

SHA1
86858e872c2a25c660443096d13c00660cc377ec

SHA256
0a6fbac0e59c3b8a8413120240bbcc3c4305e87343922d82b59d2f4b19d4a604

SHA512
e8b390e12b1ef73e298e0a3e89e528811b71d8ed2f8c8c3af0094f61dd507a6a37031cec3dfd594e8343659f9a865e0e7943ab82f33d763a7db23a7c55e12801

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sky-Beta.exe

Filesize
2.6MB

MD5
367456b810b94775c654cb602b4f3ccd

SHA1
ebea08305912e3d27a1287c034f218b6f8482884

SHA256
806c37f90c1f9894308de6941e58f1ae33bd07e8812528b24f585dc786aab21a

SHA512
b1434755e9cf50211f52c35e5992f0900d825fe050fb6ea8e36f22cab72a03362b99145a8f7a31cea90bac03e35bc69d73dacbb8e5b9cff11e0ff55a2e644565

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aamnju1g.q3b.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5ee5ff8-9473-4e26-90b4-69de5227ba10.tmp.node

Filesize
137KB

MD5
04bfbfec8db966420fe4c7b85ebb506a

SHA1
939bb742a354a92e1dcd3661a62d69e48030a335

SHA256
da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

SHA512
4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

Download Submit
C:\Users\Admin\AppData\Local\Temp\d88696f5-2c85-4fb7-ad80-cab65a2bed2e.tmp.node

Filesize
560KB

MD5
d962210e7b02f1eefa73d0945e673c02

SHA1
5c177d1db34807eb18c1081a741ad1c52dfd4ff8

SHA256
738df54a4671a706c0d40b1cab87d02783fa00bcadf89661362e3b39f6146cda

SHA512
e9abff6476eccfbd2393e21008a3a03158e86fb86afb99fc8dd271b4b075767b632af3075d4d8dd301142502dd24095210f38eaa47b89cc9b50aa1d7817e637a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\LICENSES.chromium.html

Filesize
2.3MB

MD5
bfa779717dc8376201e0ed50705fcda9

SHA1
092f4c5db1237544c1ecef06fcb32070a5ae9bf0

SHA256
3bd850349b75d9246b2acc82bb5eb01a46da1d2387624b9f12525c9973f5e465

SHA512
cbbde08a933efd21afaf5cb4bf5c1764bda5b7c1a3c5ebd55e71c239f80e0e63d950eff4632e7c20cccfe7257f489660cd23423060d1603e3559b7438e03b2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\Sky-Beta.exe

Filesize
1.0MB

MD5
6ec503589dbbcc25d94b911710d6e7db

SHA1
0d2b384477c05743801d40d9d09e42a1cb279d44

SHA256
656c2086bbe61c1e2fe038dfcc59d782aa46a2a1933bac97486888d29b59c7dc

SHA512
cb011005b6a8c1c94b70dad712951b54224f5210b776b3403d87fc3377ac75a096852f38cd39c4e03b490482592911c9ebfca8c8baddf6cd0563aebb17cc0945

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\chrome_200_percent.pak

Filesize
173KB

MD5
4610337e3332b7e65b73a6ea738b47df

SHA1
8d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b

SHA256
c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c

SHA512
039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\d3dcompiler_47.dll

Filesize
2.7MB

MD5
d61407c420a8183fa5a242f034217726

SHA1
ed767601b6f9fee365ed1dbaeed972bef8b54e97

SHA256
83af25075a86f540e3ebc8292c03a2b37cd00f4f7b6cc8b2399325dee6de8162

SHA512
3b98f573e3408f3b5773f6d95e78c205496edd6deb766116b6fe587ccd72457b729823f23d32cf567affffa9b00dabfbf10d40ade3867ea8cb21e96dbe8f06bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\ffmpeg.dll

Filesize
2.4MB

MD5
d7bd391f2fc72f1672f15a34100b80f8

SHA1
e441ace802b3b1a1d6f9065350c75cee387a049f

SHA256
5ad20ba8f55380da4f38e042fe70a33be9f7a16af66c82331d35cfb2bc773b4e

SHA512
a7cb93bc590f6a458cf7da8c9e024bfe1e69c600445ce14243cc69ed6a7d6957dd1b598e99e965ae41e482c8d00a8dbaee33ce5027ab6614dc40fac9dec2b32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\icudtl.dat

Filesize
2.4MB

MD5
9ede113ffa35de9a8d0e27b3d0731af2

SHA1
4a145f7b1bfa977df11aaa6e313c1ef80904574c

SHA256
a58d8b2c31e07612e99f05230ae8d621861c6fed292d82e33577bfce9456cd7b

SHA512
0c5e56e778187606e0e659a28dae6e3b95c14d664860b279799d1b3af43060a10e368c5b441999dabd29f10255d427143ae36c9cee379dc2389cf05f65c2713d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\libEGL.dll

Filesize
469KB

MD5
ca5bb0794b7700601e9438283d458665

SHA1
7fcf090b19820b9450937be800575c526448b581

SHA256
4a8be3b4d9fe790efdce38cff8f312a2f8276908d6703e0c6c37818e217cf1e3

SHA512
36ebab858fe7e014837548575389e7df2e86676888e4a9039c736d0f2e6463102e68989b794d949ddb16d9bcce43ce55737fcf2a4b09b1667bf968a9540e9f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\libGLESv2.dll

Filesize
2.6MB

MD5
7fcf17d73a084caed7a20652897283f8

SHA1
15545a9fbcca1b1183729641c313ec4a5a054690

SHA256
3d9e6aaa19da73c9c34c9eed6fda4a28e5166ad0d734153fcc8aea1c82819887

SHA512
9ddeb53bd1fdca9a9a2d0e429dce707d095669ef40df348ec4d593197bc046a8dfee6e2d74cca8e01f059edbc0fda92620d34ef58fa3acd6742d3dd6c3cb6bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\af.pak

Filesize
368KB

MD5
7e51349edc7e6aed122bfa00970fab80

SHA1
eb6df68501ecce2090e1af5837b5f15ac3a775eb

SHA256
f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97

SHA512
69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\am.pak

Filesize
599KB

MD5
c6ef9c40b48a069b70ed3335b52a9a9c

SHA1
d4a5fb05c4b493ecbb6fc80689b955c30c5cbbb4

SHA256
73a1034be12abda7401eb601819657cd7addf011bfd9ce39f115a442bccba995

SHA512
33c18b698040cd77162eb05658eca82a08994455865b70d1c08819dfac68f6db6b27d7e818260caa25310ff71cf128239a52c948fde098e75d1a319f478a9854

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\ar.pak

Filesize
655KB

MD5
56f6dc44cc50fc98314d0f88fcc2a962

SHA1
b1740b05c66622b900e19e9f71e0ff1f3488a98e

SHA256
7018884d3c60a9c9d727b21545c7dbbcc7b57fa93a16fa97deca0d35891e3465

SHA512
594e38739af7351a6117b0659b15f4358bd363d42ffc19e9f5035b57e05e879170bbafe51aece62c13f2ae17c84efb2aed2fc19d2eb9dcb95ebd34211d61674e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\bg.pak

Filesize
685KB

MD5
945de8a62865092b8100e93ea3e9828d

SHA1
18d4c83510455ce12a6ac85f9f33af46b0557e2e

SHA256
f0e39893a39ce6133c1b993f1792207830b8670a6eb3185b7e5826d50fea7ba2

SHA512
5f61160ff64b9490a1ad5517d8c1bb81af77d349541fed5045e7f6e5053b7d79b7e8f114630bfbe4d5af30258f70a6569462bfa39ccb765f8ca191f82ee04f3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\bn.pak

Filesize
802KB

MD5
567706068d23df003beca2356a6d10e0

SHA1
b7fcaf07fffd167c2c6963d75fd74a21d5d9dfc4

SHA256
dbf93c3977c440853e38ac4ef61835ba14dbe19e3ca764cdec05781fcbad7254

SHA512
36816d117370973409ee4181eeee63a98d3862eeccf77679411ffa53d7c6489aa16c37576c30cd8c15b95fafb43e02290e296a49c84e1475184c070a179b197c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\ca.pak

Filesize
416KB

MD5
01acd6f7a4ea85d8e63099ce1262fbad

SHA1
f654870d442938385b99444c2cacd4d6b60d2a0d

SHA256
b48d1bad676f2e718cbe548302127e0b3567913a2835522d6dd90279a6d2a56a

SHA512
2bd13eca1a85c219e24a9deb5b767faa5dc7e6b3005d4eb772e3794233ed49cb94c4492538d18acc98658c01d941e35c6f213c18ac5480da151c7545eedeb4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\cs.pak

Filesize
425KB

MD5
a934431d469d19a274243f88bb5ac6fb

SHA1
146845edc7442bf8641bc8b6c1a7e2c021fb01eb

SHA256
51c36a5acdad5930d8d4f1285315e66b2578f27534d37cd40f0625ee99852c51

SHA512
562f07151e5392cbffb6b643c097a08045e9550e56712975d453a2ebaee0745fbfba99d69867eec560d1d58b58dff4f6035811b9d4f0b1b87547efa98f94d55d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\da.pak

Filesize
387KB

MD5
bb5252dc6f0f3c01ce3638138bf946c8

SHA1
bfb584b67c8ca51d94bff40809410553d54da1cf

SHA256
c93f39d0ab9a2fab26977aa729261633225879ba6dc5ea8d0ca89814b2df9fa9

SHA512
e411fd3cc5285a6059c3fd80c3421253a4ce06b2d0cd1cd1efc25e88191a58fed176452d852922137268be2824e1e162cd4d4a6f8c695a50517a783d15b1c6e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\de.pak

Filesize
386KB

MD5
554fde4a3c6db5cd161514a8899b6811

SHA1
48efa4220322d61b44d1238f37f72a0bcf62f0ae

SHA256
819d5dbaaf471d424c7ba7054c724a90a19ef49685aa3eb85cdba40c1132b5bb

SHA512
7a9adbc1e5c61d88511c0dd2b9c3850363a0d055cdd414aec9dce8c564041466a324850a0e63b8187e7d848874ea0f11d692b6fd465a556e6898cc28d453c9e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\el.pak

Filesize
293KB

MD5
189643545bc8fb19d90b8399e9fb5c4f

SHA1
c6e04eb323dcd69870821804a4caa005a17acc1a

SHA256
80ac78cdeaa702fca6fd781cae5e11134f85bfadb9af721fc6180d477ed5edaf

SHA512
42b0867f27a656e14e9d7735cc04fbf5e10820c8e20a81e679c8fc534c7c0859ca427c14f8e448456260df2d42313c449265317d84f1a6b7bae92e3acb6caa01

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\en-GB.pak

Filesize
336KB

MD5
0db7f3a3ba228aa7f2457db1aa58d002

SHA1
bbf3469caadfa3d2469dd7e0809352ef21a7476d

SHA256
cf5aca381c888de8aa6bbd1dcd609e389833cb5af3f4e8af5281ffd70cd65d98

SHA512
9c46c8d12579bd8c0be230bbcdb31bdb537d2fea38000cf700547ca59e3139c18cc7cb3e74053475605132404c4c4591f651d2dad2ce7f413ccffd6acf7139e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\en-US.pak

Filesize
338KB

MD5
5e3813e616a101e4a169b05f40879a62

SHA1
615e4d94f69625dda81dfaec7f14e9ee320a2884

SHA256
4d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687

SHA512
764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\es-419.pak

Filesize
224KB

MD5
dd81e120b2e2a29761297284207b1ce2

SHA1
12e758044cc940ab3c3725c9fe765b53f9e30ad4

SHA256
4dd40136cb42ad835659d39b6d502cd3afe6ceaa218d16edd4f311db1db53e4d

SHA512
27f99dfdf09397526180e8ae11f94a25d9285d88e9ebfdde377fd9f62e5c866cedb9f4423456c2287204d6bd47fd4f45e50006371b0cc84eb91aebb618105aaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\es.pak

Filesize
386KB

MD5
4887d119e2ce8f8a4e818e06328924a7

SHA1
44d88f753cfb8a69ab19f5176be4f84dcf72d389

SHA256
1ce03db57d41295e982d22abab9e87782eb5853f2100ca6b5a98fa0732bc1708

SHA512
5dd715a0d9a8f83451ca7476d2b3cbbe538516c1f903a87651a6d4f7b4eba225fe2d63521ee1d8a189d3b32f5023b2b2b114072032f7611c0542e369123a626c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\et.pak

Filesize
367KB

MD5
bf52a6fb00d5c0fcc8197b6218c7e62d

SHA1
7bc61f9a849a1bde091b8320392b4a5d96dbb1f9

SHA256
9c30ba9e2ee1e838528779450348e940c5feead486091f867990f1537de83cf5

SHA512
7024dde42e43fdabd34a9cefbd5e379e13d3de16893d88c60fc8a6a97bf530a6679f6c30f0608858fbe5f9efac99438b85a720ecd4af7ad44196acab3b11878e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\fa.pak

Filesize
289KB

MD5
cb33f9f381dfbfdea4fd9d234ee2d46d

SHA1
ac800eb429803c75b684a773278dd376a3803faf

SHA256
007237c35eba111923891a2986d895a88224efaacfcdf6a6ac50315798134cf1

SHA512
85d3f04428b29a98da8c04c063ef978aefa97c27ae99be0d832e85e56198860f612514f1448125e0ca2dcd212121497aeeca25120e915c87ad5749ccfdc671ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\fi.pak

Filesize
379KB

MD5
5518b51d4af7f1b9d686cbea28b69e71

SHA1
df7f70846f059826c792a831e32247b2294c8e52

SHA256
8ff1b08727c884d6b7b6c8b0a0b176706109ae7fe06323895e35325742fe5bd1

SHA512
b573050585c5e89a65fc45000f48a0f6aabccd2937f33a0b3fcbd8a8c817beaa2158f62a83c2cae6fcfb655f4a4f9a0c2f6505b41a90bc9d8ede74141ebc3266

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\fil.pak

Filesize
427KB

MD5
3165351c55e3408eaa7b661fa9dc8924

SHA1
181bee2a96d2f43d740b865f7e39a1ba06e2ca2b

SHA256
2630a9d5912c8ef023154c6a6fb5c56faf610e1e960af66abef533af19b90caa

SHA512
3b1944ea3cfcbe98d4ce390ea3a8ff1f6730eb8054e282869308efe91a9ddcd118290568c1fc83bd80e8951c4e70a451e984c27b400f2bde8053ea25b9620655

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\fr.pak

Filesize
250KB

MD5
adf345b0f85f7cfb189a9239d7ebcee6

SHA1
590ea5ded5e490b1993c89a910e180da55c338b3

SHA256
c01165dd11d20fa4f68e845a8089cd1b80c9cc8683a804203d44066973a756a9

SHA512
bd66d909c2c4ea061b8f4df16dbcaa28f2e198c0c47f3fb7068c4f2f04780c4165a55765ee67ff4b8eb4cdd5303382f4ea1915083a8eeb9e16678ba005d51872

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\gu.pak

Filesize
226KB

MD5
fe4e8b7b91dd156c37e4b33194bcb792

SHA1
5564c3fe4811586d574d116c5551808cbf17cef8

SHA256
f7cfdb50db88f376efb2e0271f45424add8164eaf8cdd963c77a2c1bb2a877a3

SHA512
42864b81d315511a03b1685d992c5cb5797096e79f53e74a5e59553e3508f32e636a7c337c97ba34a9fd5ac02253997a16e97b417f50c59c011c62dda7d4afa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\he.pak

Filesize
186KB

MD5
c70833b4f894c65c48997ac968776180

SHA1
3477bd89bf32ce2a6f5a2434f094b0cf5b8b0f6c

SHA256
4fb3f2cc0284290292c89b99adabb612662ddaa9a900a1a16cfe13d11f329ec3

SHA512
2d6f9e0100b508401df7008e13eff326a8a150a343cd2bc2de9fb35b2a82a77c709fcfe5146754292ea5319436507b088a25d9f00d93c4971f5739e68bc49676

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\hi.pak

Filesize
320KB

MD5
ae95c6977032279f0557085e278517c8

SHA1
64485e37626cd4cfa93e5c965cbd906588399746

SHA256
ac4a22a08edfa9d4e77fa9d95a78d37ee80d5f94064f4d884069180ac059b665

SHA512
6a31f3f3fcd9384d3dc79821f3761596d0e5e5d10a7ead2801723c1348ea05b614046c76a5f184190606f3128e61883ce85bebf27e0795db47e6589b265a52ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\hr.pak

Filesize
280KB

MD5
711e64b6813cb54130667236813e2039

SHA1
ba75a65ba4857d59ddb7bb3504fa9cd199064dcb

SHA256
d9075b496d977735c3180296821463bc76e83e6e59b37943cec94cb67ce76441

SHA512
3961e13c247af3c819c1418ef3c1cbc751f4820603ef69af988591599ca76f83ace077d1bc3ff44c3728a746e491342ba7b8bff2c24c10f8eb9c963e4c743f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\hu.pak

Filesize
281KB

MD5
22f8e395d5f53a239f41f88563a7bdb5

SHA1
8ddab53191865663868f1ef75ef29f373eadd695

SHA256
eca52a618c4adcb060da151f4e7ea5719ca97f943780f7749814fbfb60c0cbae

SHA512
1e33c705d6861d16a20c5b49bef3f56b697789b6dac1b27b5233313b6dfc593e146d56f5910f84af0cd0b96a8dcb5069049cc281840f3a2ef9b1ae882b6c61ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\id.pak

Filesize
296KB

MD5
b685bdd0f6259a3930d42e34074d5c39

SHA1
8cf384054055fa333ce72c9f90c15ae58b4c82e6

SHA256
02fa937fa7b7c5c4d51c52a6757ff0428cccceaa07520a265c33146a5309ba54

SHA512
d7bc8335c06e751e71ca071f7368041eb0921af94b4d741d5d4d623afd790b6055b49779e86e6e0ebfbd60093e6cea6e2fc3e42f202db517de8918b4e5e0d988

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\it.pak

Filesize
285KB

MD5
f27fc5c1d0d666ab273b93baea6f64ea

SHA1
81f75c07ed8c6c69aa29b5915e51380212b2a308

SHA256
07b2b97fb4a162109fb04fe5bb8675bc8b23cb115d39d8d10e7291357e68358d

SHA512
7f765056980dd03a38be22ae6a8af66cc31f8478121826713ab0aa88bbc32e1fa5bb75e72d2178d41c1a2e4abff20df93f5d28d6303d20ee8d4994f592185956

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\ja.pak

Filesize
206KB

MD5
1adc69c0f0fe81ee83f85edc527e89fd

SHA1
6341d76fdb3ac27c24763da83b6299632e0e6472

SHA256
7111b2b37520b1388be8d01fac0783e51b2f4e316e4fd2f294d92cab9af85ddc

SHA512
ddf34f1aaca2722a5c158dd513bf1f76d7a82bb4ee7b38ed094c3d11d324f9bb4620b65d1c318acd2f3c6ad14c8383b358e6bbf9e4e357c9ec397822b55c5266

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\kn.pak

Filesize
124KB

MD5
fe02f596af9b387d44bcfd24b0680852

SHA1
edb54c6fe6ff889210c81c1763dc904c590cd791

SHA256
3898d58f8d140d305cec923704e08e73e43b1e8671bb73d5d7a88188f4ae99b8

SHA512
5f3fa2f9c25335ae50c6f04bc89a38f084a5eadc842a808a00ae409beca4558ebeef4adc078ae69bd9f8a25a2dc6e2827d0df9e794c40f6c8055466b26e588c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\ko.pak

Filesize
131KB

MD5
64c440148a94d7655aa33df91f4ed805

SHA1
4c38dde8754079041e9500950bbe61f0b9cf96d9

SHA256
d0e845efd429fe020aa5dbef61c1db9c4574b5b0d7a1c954a77da9e55a2157ab

SHA512
dd192bd08be5baebc3d82b115feaa5ff34a26a3d756eeb21e82dd148b2fad2f61b6e11e4d4a66670b0045afb0c5d7aef81e0cdf639437a9dd4a63a71cdc69535

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\lt.pak

Filesize
60KB

MD5
34a9837eb95ebd4aa6ccf5d4605534cf

SHA1
f6aa14041b4c1cc835b8d3142b0203a553f52f50

SHA256
aa7d148fb3607b5963d395906a5d52120bc9c652b9aca42a5d670349818fddd1

SHA512
6dd6e57f872bdf6fd30e4ab91fe23cdd0b26be1857085143c7b231692724b31fbfe55c6f63ef25db9eaa6d3ce609eeb00b2ad5bf406e65a9ed909636caf375f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\lv.pak

Filesize
98KB

MD5
dc02a2e52a466ecfc0474b395070b720

SHA1
4cc2eae61e6b5b68f07129bda0f64688cc9fe542

SHA256
4f1f79f97c27deb95fe1ec250d8489c06b70702c7114d8389672b1263d3d1f9c

SHA512
8cdaae5212db594b4d39f1ee479124af6b2bbd36113c1fea6f20ffd9a920030e382ef5c783686afdbb6ab8ef31e1a57d2bc3758a7e806d1bc3e249f9aae22d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\ml.pak

Filesize
33KB

MD5
dfd76793d628f56ebe9bdeac3ebd5a55

SHA1
4f18aa6b69577af683125efe191fb0fad8aae615

SHA256
b92e5b83bdc76f79536ffa2553dbc228b376f89498904897b815c5c25e001f72

SHA512
c66c88d7c055f9f01bd8c8f62d9c57401efd8b706c38f0a122a5657d917bfda6747ce33ae7f9a55622f22019cb3aca9bd5007553ac8d8e9f3a8d0dc9281ea9e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\mr.pak

Filesize
119KB

MD5
c63fa6465684a261e01ae9d109b318ed

SHA1
b3bac4766f9f06a4a80f38ecf8da8797d11b3bb4

SHA256
2821acf4f57f147f767eaf58b0637fc10211f3c855ccca943329a34454cd7e22

SHA512
8dff329ea8c6594c7ba1b77bbfe494dde1b5849fa92f14e1bf7558e182c972f8b0c00b172640bef028a47d2ac164fdeb271034e620d0c40a496a495b5251b4c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\ms.pak

Filesize
175KB

MD5
ce1106e9b10b1b3b6161a13786e18601

SHA1
c34a2e9b34acbf2693eecbac6cc2a6b3a9c5d9e4

SHA256
df54c69eb8dbf2b1a9b31712e17af82e5ba6cb7d16ac08a29903defe582f0497

SHA512
cf24ff21843405ac8c063e5880beb5648ec7fd0e8212c0bc13e64797c05e033cf458cb48194ffbd57dc94e9f3ab2fe6d9e2d06f79c8c2103a5377ce28f81a3df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\nb.pak

Filesize
71KB

MD5
bed83b4af00fb169d4acae3823f071d6

SHA1
d54fe9c79bc0719a2514d22fd13fe269868e8722

SHA256
00fcb40db9509f5265c3e4130d21ac86d3d4588ffdbf65f4effcc3951a38ea5b

SHA512
c0bf26102d89f86df4b53313a936496095f5589a4e96efc4f5911ed6eeff4fefb670fd36876f46d12324e940005882ebf1be76098f7b7bd3bb19e8d421d4f457

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\nl.pak

Filesize
94KB

MD5
d4500177af8d4e122a49066b7dc873a0

SHA1
99a8302390e3c80e68bf1d8906d0cdf2bcd69f23

SHA256
b6ffbb8fcc4cae9dd02be0e1c6ec229863d69042be7f911d533c7fe6e0b3f7bf

SHA512
ee5493edb7089a159caa74fce70e81b9f99bed27eab6a6574c482b78d6ae5f79eb2f57e61b0352418027e839f1e5de73752bd5ba27056cae20df3b63324f6072

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\pl.pak

Filesize
57KB

MD5
2691ca73a88a30f2cbbe83ca0c7dddf7

SHA1
62bcd13c602c88520557e74f1a0e17be6532a624

SHA256
9bd7830ecd571a44a7c21ddfb0aaa06fbc44ac6a38afa9ef67e900010b675071

SHA512
4628c2b8612480b3c6cac3b0c97df91223d8a7d3c522fc45017f9808d86d08428b1b9864472b27b83a48b81d25a007d44bbe862caef8e1901ce26f9f04d483df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\pt-BR.pak

Filesize
88KB

MD5
e0116d6d18bfaa9b73d9ee0f2713e440

SHA1
dfe51f033b7653305c984ac846c48f1f37e98676

SHA256
bce42cfa7e8f45a5e2ca8cc5566dd1bf10175d422a5bc53afeaa194c02bf20ea

SHA512
45a7d8cc94ac3bcde0d8996d494e38f6f42f2f67430e06a262763ef72af5bd48e83c20d6c6930e0b0c02700bbf4b6b2edfb21a06b9d4857a1e40cec972a9e3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\pt-PT.pak

Filesize
105KB

MD5
9490a8858b994a58fbb72e1bd9a8fe10

SHA1
89085bf3ba98b2735b1711064015569d3bd5bf03

SHA256
a94f8a35615a4ee34b3f82fcaffd2fb28df7941b9fb2805d5e4c0ef7613b1a7d

SHA512
4cfb94bf528827b03bb30991cea384300c8d3e64a99fb53038520954fcd39570bb1cfada7611a6b8813c854d6a6781e1ebd2af8b25127d7d047bfca4bc842b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\ru.pak

Filesize
51KB

MD5
6e007440c658fb9f0be4bc360e14aea3

SHA1
462cbd50dcbdf58412dde55bdde5d48c8b58b5bd

SHA256
d438885dc280be9f05a0032e502b4d03ff5c0d72f7a1154fef8a87ee36e1df7a

SHA512
4c173e526c35b04cab48dce4184c03d6b0074fb7e80e288608e3d150546e7238001acd7d800da9d1618f621e836be4fd0735c7ac98b11194c2753065717f7695

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\sk.pak

Filesize
19KB

MD5
f94eabc1849ac4deefa099e5a8927818

SHA1
9490bc035788a9ea9d29203fb748580b4fd07026

SHA256
664eb8007d59b838183bf962b4c138a6a569a569c4f73054648f3f3ec448d5f1

SHA512
909cc55da27b75d1dc534c6e8cadca7eb295b36ee4f167890fd30bf04bcce05f6fd37e647c2c93add238ff59e4fb506eb156d9e47f7aa951b7b5a5ddb0a835de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\sl.pak

Filesize
417KB

MD5
4d9d56ef0b176e7f7aa14270e964ec77

SHA1
515aac37e4f25ca50bd52ea73889b70b1e79863d

SHA256
6ba684a8f06f7eb175955b15d30c7162d92c7e7c48864dfb853238263e1be8c7

SHA512
740adbb7d8b039f98e187f45a1a87d0354136fb48b75262e508f720bfcbeb2746f04d31a57dccd50e37ddb5a1b7c0ad79a01cac6ba5fb98a9af272ad99fcb169

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\sr.pak

Filesize
644KB

MD5
cf160983a86b51ec42845f4e60ac9123

SHA1
4d3bd86a7ef1eaadb8bec0b79ecc6c05b4273a48

SHA256
ef07512fb337005bb66696c69722a0d65bfb749b9d2f763f5b2ff2885cb247a4

SHA512
b909fc3614c3250856d2c502cbfed5eb6e398140b801669bf92427e7e8a5939b14052b9abf2c94749f1aea61946ff66be4978c68064196458733bcff0a963ffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\sv.pak

Filesize
376KB

MD5
bbe0785c5f9591e8a1e7c4830fe949d6

SHA1
da4f3286079d50e1c04e923529e03e7d334c7fff

SHA256
0ad84f6f95fd7505862278a7c1c92d00a7e7dd4a765569e9c3086f55c1d7059d

SHA512
38bab6f3a6c9395d3b57e63168045ad2e8188b2f04751a15253e7226ec3043c9678a77be1eb27a3b2e751934a024f3ffc89fffd9f1e229e19638be318b53e961

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\sw.pak

Filesize
394KB

MD5
ee8da42ffe40fbb916c56390e2cd99e8

SHA1
6d824f56afe6b3605a881d2c26e69a46e6675347

SHA256
192e248c7ac4644f8712cf5032da1c6063d70662216ccf084205f902253aa827

SHA512
7befe72b073000bc35a31323d666fd51d105a188d59c4a85d76ee72b6c8c83a39a1beb935c1079def8e3ffa8c4bf6044cf4f3bef0f1c850c789b57e1144ff714

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\ta.pak

Filesize
1019KB

MD5
a8beab6896018a6d37f9b2e5bdd7a78c

SHA1
64310684247219a14ac3ac3b4c8ebaa602c5f03a

SHA256
c68b708ba61b3eeab5ae81d9d85d6e9f92e416ecfae92e8de9965608732384df

SHA512
73b0a31235bf4b7c5ad673f08717f3b4f03bcdf2a91440ee7228aa78c2d15dd2aed32498e23ded78ec35bc731dbe16b6a1c236a170f2a84123a464857686c7b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\te.pak

Filesize
942KB

MD5
02415ded02cc7ac25e8f8d0e83365061

SHA1
5a25bf63ec97dbeb37e64ab3825cbbce6326a5cf

SHA256
97024f0cfac78e0c738e771beea1e35f5a8eb2b132b3043b59ce4ecd6c153523

SHA512
54e658c6d432b29b031be278e5b4396ac14b0f85e1f772a0a76c0431d4cbe2370ff2898077837688e2fb9700db1eab7a19e4e350a280a2ffad8176d861d93e45

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\th.pak

Filesize
792KB

MD5
293ad7c20c22d744e4db0fb001ec45bb

SHA1
486c9e0732306a45aceb633da2b3ded281197620

SHA256
d67d68f24d3347e244a7e8c3b63d47f18fcf37258256f48dad785cf98bb560fa

SHA512
ac2b2dd82095925b3229958e89dcf5283bdce0273734a0c338f5a1aa8b014644806ca517f0fc2003669910e58fedf9c2ca7a009fa3f53d58c07bc5e9191f2e2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\tr.pak

Filesize
401KB

MD5
9f24f44cac0997e1d0a6a419520f3bfe

SHA1
edb61859cbb5d77c666aac98379d4155188f4ff5

SHA256
3aff7dcbfb1a244cc29b290376b52cfb3e1f844c98facafea17b4a45ce064b8a

SHA512
65fbe2d7fea37db59b805d031f6ae85d628a51b254e76e8c2b4ef4b5153527b7e2412ed6a0961d174b8a5581b521b0436160fe5ed252f78303bcfde815733d81

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\uk.pak

Filesize
688KB

MD5
e4c4e3700469704b936460ca1a90fcc0

SHA1
e809990fc07a1d39fe623046382699e648e343c0

SHA256
29af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb

SHA512
68e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\ur.pak

Filesize
602KB

MD5
d7ec7d551dee1e1ef11be3e2820052f9

SHA1
d7f2d35841883103c2773fc093a9a706b2fe5d36

SHA256
05e45371159075048db688564b6bc707e0891303c40f490c3db428b0edd36102

SHA512
92e2d32fc106812e08163a26f202a5d0e7eb7028a871f3bc6cbc05ee6c7ce287032179322b19e396308968515bf214534a38d93afc259a780ad7ba8432fab56a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\vi.pak

Filesize
476KB

MD5
9274866d7c6314f43dd63ed293293e25

SHA1
4af0e6ec1bcb99588810a9fb69c1dc2bbad892fc

SHA256
dcbdc6d9e11dd10fc1364c10be5438ce2697f61ec5f32997c43b87238087c4e3

SHA512
3c8c9e9960a49469af83cae31790a03e41846163c14d3dae45fd92a1a412c82075bdef3317baca02399eb53de0f9164c0a9a17b7cd63e0fa61c3e4617393c42e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\zh-CN.pak

Filesize
345KB

MD5
9d4f54eb5a12cf4c2f34f5f538dff90b

SHA1
c31b892ce78c733bde0571b6236170103cc9fe7a

SHA256
58b934a09858f037f1966a495e73d44416180afcdebfaefcee1f5e3377de63f7

SHA512
46bf6099c50f7959a6f0800ec679b61a78efabe87985cad8dc0d7d0006470a9c61e659bde0258da6cf7ed6104749a157f5ad133f324479c3460a19fc14e31c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\locales\zh-TW.pak

Filesize
341KB

MD5
8f67a9f38ad36d7d4a6b48e63852208d

SHA1
f087c85c51bdbdef5998cfc3790835da95da982a

SHA256
92f26e692dc1309558f90278425a7e83e56974b6af84dbd8cc90324785ee71ca

SHA512
623034bbdfdf5d331de78b630f403aeb9cef27b1827e0d29ec66ad69310f56c7db96c6775df0e749f8112a4a8e75754bcf987903d415fc7ae360e3c39e6e18e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\resources.pak

Filesize
2.4MB

MD5
8a875d4e0e5e431a11f7c90b90546f72

SHA1
b537f3b4d9a9bade33968afcc809d711fbf7d6a6

SHA256
3d3bb5a3955e60546f869f3a36411577b3312557338bcef355222c9ac065d5f3

SHA512
e219eff8df89ba8e57bf524c80f9eee64cdce0f5cc07dbc6bd4134e4a2b0087da8321e96dd7b0585959642d910e0b93c8f5ebb9acbf2728a52732b08502dbfcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\resources\app.asar

Filesize
1.3MB

MD5
40cf4390c7be69d0566e6e519a49bbd3

SHA1
e3fd0ffe8f7121cc606aaf3f82d6656637bd31f8

SHA256
41d4ea52a1cdd4740c48462c3cb5aa61f09ad81c5f944484bc2edc44d006c99c

SHA512
dfc3206528cb04ad86165e1ff44da0525d3f20ffc14ef43435e4a81d026f94e41aadb7e30aa8e94bdd427f15e017d62b99359678b9c76b8ecde32967189d17f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\snapshot_blob.bin

Filesize
266KB

MD5
4ebd06bdf6cf8dacf6597586fd1704b5

SHA1
e6819ef37f99f91468f4b94370a4ab467a075a6d

SHA256
148e4b85983f0d27adecd9c6431b66379ac5538688f320e89d74ff6d48bb740b

SHA512
17ed5abe702748b4626b3ee6de4d0916738f095c913c2700eee06b65a2bbcaf72afc1f87af7ce0fcce8bd15fe6881508255d397a346c45a82c7791b9b9833ddf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\v8_context_snapshot.bin

Filesize
574KB

MD5
146e284750735ef4798527dc1cd0e741

SHA1
6408985b7d05c768a62bcb912234f14e1898ffdb

SHA256
3820e8fa1077d02606fea8e1b3a9ca4bf7f4a71d0569d9a8ea9ee7a009d0ce80

SHA512
46824df5d20e02fb72c3efd07bee6d832b1ab78c0163688fa84edb831cbfbef2dde12ba9da01f9dd49c4008bd3862a95699a2f6d55b8d4b3165976d3851c7278

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\vk_swiftshader.dll

Filesize
1.1MB

MD5
5a1240a188443cea76d506a0d8f9c5b5

SHA1
30d4cbd57cfce36a64b00498d532d8a6e220035f

SHA256
59c328455144b1888099c7609bf9993b05cafbfca0d5041c62f45d4d4cf245bd

SHA512
faff15c44595c40a3348f3149be3765a152daf1134f455767ac65c2fa114ba058cf73f0997b92f818a4c12527974189fad3f82db98597a22d369e81c1297ebb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\7z-out\vulkan-1.dll

Filesize
906KB

MD5
6c70aab071c4febc5921e0d39811937a

SHA1
20d87b3a5333ea3f6d0d7b0333f2c30a281937aa

SHA256
2233fef6788711089fc5c1a008bfff6559cf2fc3e8363cd8a50196e90d1d9825

SHA512
7f786c44376b59be7d7c51d3c40ecb80f30645551b582d042b641ea0a6464daf367ddf7eafaf00a1558e1f11570d99a699d33d224b01048d09f8f00ea501c4bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\2bbf61f1ffa4c6e6cdc20d2a758068fe0569950f59526bc7370d4e448488c560\boukiapi\build\release\boukiapi.node

Filesize
134KB

MD5
536fb6a0ae07677d64dfac8fb614f153

SHA1
36dc1d21ab3879dfbe3f2159391c17b37ecf2b87

SHA256
2bbf61f1ffa4c6e6cdc20d2a758068fe0569950f59526bc7370d4e448488c560

SHA512
715ecdb01d03a6ab2d9a7b78edcd58d0bf787a1cf3d5d3a5570b77d506d7c280ba315857d88be46205113451e82f8b5d584b4b466c6447cbaa80b21c94988b2c

Download Submit
memory/720-746-0x00000247B4AB0000-0x00000247B4AC0000-memory.dmp

Filesize
64KB

Download
memory/720-744-0x00007FFB74910000-0x00007FFB753D1000-memory.dmp

Filesize
10.8MB

Download
memory/720-734-0x00000247B4A40000-0x00000247B4A62000-memory.dmp

Filesize
136KB

Download
memory/720-745-0x00000247B4AB0000-0x00000247B4AC0000-memory.dmp

Filesize
64KB

Download
memory/720-747-0x00000247B4F80000-0x00000247B4FD0000-memory.dmp

Filesize
320KB

Download
memory/720-751-0x00007FFB74910000-0x00007FFB753D1000-memory.dmp

Filesize
10.8MB

Download
memory/1376-825-0x00000202C61E0000-0x00000202C61F0000-memory.dmp

Filesize
64KB

Download
memory/1376-824-0x00007FFB73590000-0x00007FFB74051000-memory.dmp

Filesize
10.8MB

Download
memory/1376-826-0x00000202C61E0000-0x00000202C61F0000-memory.dmp

Filesize
64KB

Download
memory/1376-830-0x00007FFB73590000-0x00007FFB74051000-memory.dmp

Filesize
10.8MB

Download
memory/3788-769-0x00007FFB74910000-0x00007FFB753D1000-memory.dmp

Filesize
10.8MB

Download
memory/3788-764-0x00007FFB74910000-0x00007FFB753D1000-memory.dmp

Filesize
10.8MB

Download
memory/3788-766-0x000001CCDDDC0000-0x000001CCDDDD0000-memory.dmp

Filesize
64KB

Download
memory/3788-765-0x000001CCDDDC0000-0x000001CCDDDD0000-memory.dmp

Filesize
64KB

Download