e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install Termius.exe
Size

174.7MB
MD5

47dd221e93e67afaec0c9da2faad8c2d
SHA1

cc6e78e778a6369022d16e218a8578ec4a7e64bb
SHA256

e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864
SHA512

30b4246bcdf4c34408fde8b0eb813301135b2e493ea069eda2f20e737bde667574b9c1ff08e2346977e945dc75a1c9e10211418a4d52703485e4906f5db6331a
SSDEEP

3145728:pnTEziz7qeKOmhoSiH9wwDTD5yCeEQ3Tdpf+5bCGMNMkWxoU5oPb60:BA67qJhiSNwHtyZEQ33vDfQA60

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	Termius.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	Termius.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	Termius.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	Termius.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 8 IoCs

pid	Process
4888	Termius.exe
5332	Termius.exe
5508	Termius.exe
5664	Termius.exe
5684	Termius.exe
5788	Termius.exe
5832	Termius.exe
5544	Termius.exe

Loads dropped DLL 31 IoCs

pid	Process
4960	Install Termius.exe
4960	Install Termius.exe
4960	Install Termius.exe
4960	Install Termius.exe
4960	Install Termius.exe
4960	Install Termius.exe
4960	Install Termius.exe
4888	Termius.exe
5332	Termius.exe
4888	Termius.exe
4888	Termius.exe
5508	Termius.exe
5508	Termius.exe
5508	Termius.exe
5508	Termius.exe
5508	Termius.exe
5664	Termius.exe
5684	Termius.exe
5788	Termius.exe
5832	Termius.exe
5684	Termius.exe
5684	Termius.exe
5788	Termius.exe
5788	Termius.exe
4888	Termius.exe
5832	Termius.exe
5832	Termius.exe
5832	Termius.exe
5832	Termius.exe
5544	Termius.exe
5544	Termius.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4360	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\termius\shell	Termius.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\ssh\shell\open	Termius.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\ssh\URL Protocol	Termius.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\termius\shell\open\command	Termius.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\termius\shell\open	Termius.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\ssh\shell	Termius.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Termius.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Termius.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Termius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	Termius.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Termius.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4960	Install Termius.exe
4960	Install Termius.exe
4360	tasklist.exe
4360	tasklist.exe
5544	Termius.exe
5544	Termius.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	tasklist.exe
Token: SeSecurityPrivilege	4960	Install Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe
Token: SeShutdownPrivilege	4888	Termius.exe
Token: SeCreatePagefilePrivilege	4888	Termius.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4660	SearchApp.exe
5464	SearchApp.exe
4868	SearchApp.exe
5028	SearchApp.exe
2444	SearchApp.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 1288	4960	Install Termius.exe	87
PID 4960 wrote to memory of 1288	4960	Install Termius.exe	87
PID 4960 wrote to memory of 1288	4960	Install Termius.exe	87
PID 1288 wrote to memory of 4360	1288	cmd.exe	89
PID 1288 wrote to memory of 4360	1288	cmd.exe	89
PID 1288 wrote to memory of 4360	1288	cmd.exe	89
PID 1288 wrote to memory of 4432	1288	cmd.exe	90
PID 1288 wrote to memory of 4432	1288	cmd.exe	90
PID 1288 wrote to memory of 4432	1288	cmd.exe	90
PID 4888 wrote to memory of 5332	4888	Termius.exe	101
PID 4888 wrote to memory of 5332	4888	Termius.exe	101
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5508	4888	Termius.exe	102
PID 4888 wrote to memory of 5664	4888	Termius.exe	103
PID 4888 wrote to memory of 5664	4888	Termius.exe	103
PID 4888 wrote to memory of 5684	4888	Termius.exe	104
PID 4888 wrote to memory of 5684	4888	Termius.exe	104
PID 4888 wrote to memory of 5788	4888	Termius.exe	105
PID 4888 wrote to memory of 5788	4888	Termius.exe	105
PID 4888 wrote to memory of 5832	4888	Termius.exe	106
PID 4888 wrote to memory of 5832	4888	Termius.exe	106
PID 4888 wrote to memory of 5544	4888	Termius.exe	126
PID 4888 wrote to memory of 5544	4888	Termius.exe	126

C:\Users\Admin\AppData\Local\Temp\Install Termius.exe
"C:\Users\Admin\AppData\Local\Temp\Install Termius.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Termius.exe" | %SYSTEMROOT%\System32\find.exe "Termius.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Termius.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\System32\find.exe "Termius.exe"
    3⤵
    PID:4432

C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe
"C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe
  C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Termius /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Termius\Crashpad --url=https://o76327.ingest.sentry.io/api/193727/minidump/?sentry_key=55af16af94074b88844cd7e16f535fa5 --annotation=_productName=Termius --annotation=_version=8.10.4 --annotation=plat=Win64 --annotation=prod=Electron "--annotation=sentry___initialScope={\"environment\":\"production\"}" --annotation=ver=21.4.4 --initial-client-data=0x46c,0x474,0x478,0x448,0x47c,0x7ff747ac06e0,0x7ff747ac06f0,0x7ff747ac0700
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5332
- C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe
  "C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Termius" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1888,i,1305549095772278672,2727805263418493023,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5508
- C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe
  "C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Termius" --mojo-platform-channel-handle=2484 --field-trial-handle=1888,i,1305549095772278672,2727805263418493023,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5664
- C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe
  "C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Termius" --app-user-model-id=electron.app.Termius --app-path="C:\Users\Admin\AppData\Local\Programs\Termius\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2660 --field-trial-handle=1888,i,1305549095772278672,2727805263418493023,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5684
- C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe
  "C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Termius" --app-user-model-id=electron.app.Termius --app-path="C:\Users\Admin\AppData\Local\Programs\Termius\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1888,i,1305549095772278672,2727805263418493023,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5788
- C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe
  "C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Termius" --app-user-model-id=electron.app.Termius --app-path="C:\Users\Admin\AppData\Local\Programs\Termius\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1888,i,1305549095772278672,2727805263418493023,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5832
- C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe
  "C:\Users\Admin\AppData\Local\Programs\Termius\Termius.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Termius" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1888,i,1305549095772278672,2727805263418493023,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5544

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\77322617e98a4a5f9aeae8c16c34c378 /t 800 /p 692
1⤵
PID:828

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4660

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5464

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4868

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5028

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4VHCF0PY\microsoft.windows[1].xml

Filesize
97B

MD5
b00643a38637847dab98bfa6c2d53f4e

SHA1
983055bd38dff9849c550ae053cd3592db217147

SHA256
a64b8e9193f1537d2bb5f68c17018abf732832ebe4885933819f019ff9410841

SHA512
9acf44ec12ef307e812442dfd45408a6d6db702b698ae1b47b9ea8643fb0747d38baae833e8e1b9d2b540c1bfb5e2e34698c7cf6cb73555075a17fd0da7db9e2

Download Submit
C:\Users\Admin\AppData\Local\Programs\Termius\chrome_100_percent.pak

Filesize
126KB

MD5
44a69827d4aa75426f3c577af2f8618e

SHA1
7bdd115425b05414b64dcdb7d980b92ecd3f15b3

SHA256
bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b

SHA512
5c7bdf1f1deb72c79b860bf48f16c19cb19b4d861c0b6beb585512ad58b1bc4b64e24edfcd97233e5b91dcd0f63ed1c7b278d22ec062fd0dfe28fe49cae52049

Download Submit
C:\Users\Admin\AppData\Local\Programs\Termius\locales\fil.pak

Filesize
379KB

MD5
f989a7215cac1e3fb4759e5fba9aef67

SHA1
5ecf35f160e1f8242b3bca163673e24cf6d77403

SHA256
448bc8eae353c188ffaa4c2466956598ad807f0f0aae7f12e1bc59584e1aac2d

SHA512
b872beb5b1c2702f4eae616f633318b4575f573c06a3f1f0f1e1ab83585a52caf2f3c788c0c3a0d499c381fb7f06a3ea355b8686ded2ed1e392662f2746db01f

Download Submit
C:\Users\Admin\AppData\Local\Programs\Termius\resources\app.asar.unpacked\node_modules\@termius\keytar\package.json

Filesize
399B

MD5
1a87aae4f22215d71482d165d5bf0f09

SHA1
271a61e3dcde8a38bd9dddadea93c31c39a6a555

SHA256
fe3a31e65d748b1e5d7fd7b657703e21eeed7da2f352fd1508b4ffd0fe567177

SHA512
0c3138ba1c184c73818f75c28429778735c9574949e0111d303ed55a2e7dcff4c3e698e63964c181028909cd43299ef203a7df5ecfb492c680b83558958d6ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\LICENSES.chromium.html

Filesize
6.3MB

MD5
34999967f735b07e9cbcf6c397cea4db

SHA1
8001fcdd6ce0c6e5a3d91fd45e4c9726fa67f3e4

SHA256
c5a05048505c00af46c75fb5ca22057f09dce001eada3a756c3839d59011758f

SHA512
b6c2f722b6551231801e453bba8f9593d9f1a82edb305869ee07ef77f286968eb6ad5db1abbe750e88c8af973c362ee161aa5c591ea04ff39e4f4b34e6fa4baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\Termius.exe

Filesize
147.2MB

MD5
ab13e2773bbd45e1c1da74f4a4b46f48

SHA1
8199ab7907b9aecd1648cec3cb0084ab60612a6c

SHA256
ecbd9e781023aa47748ac68934f2054ebc827083dd571574fb58fb891047a62b

SHA512
e6c7f2caeac5de3830f74ff6ddcd9a3e52a4f1b55ded62be4c44100a489d97fe3c2da10667adde5a28106e39ff0728b034e87cdeab237ca5c7de56b8175d5bcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\chrome_200_percent.pak

Filesize
175KB

MD5
9c379fc04a7bf1a853b14834f58c9f4b

SHA1
c105120fd00001c9ebdf2b3b981ecccb02f8eefb

SHA256
b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48

SHA512
f28844dba7780e5f5c9d77ac3d29069dfcd6698447d5723886e510eadd51d6285e06adbda06bf4a69f841afc161c764cb2e5b9ad2c92f0a87176709b4acd2c13

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\ffmpeg.dll

Filesize
2.6MB

MD5
f7478ad3e40fcf468bb7218a152c7dc2

SHA1
c81ef6dd8ddea5c23ad1afe05ff830720ffcd80b

SHA256
906b781978ee1524039abc6eafea3c66e7fa45748184e87fb4cf2931e774b6f4

SHA512
eac024adaf1958c8b858fbca65da11cf35b244770567f4d269bb90db9da65dd5897e9d431bcd5d5d8787631f1eaf3dedc71f5a1e2ec710cf296e386c9370383f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\icudtl.dat

Filesize
10.0MB

MD5
cf9421b601645bda331c7136a0a9c3f8

SHA1
9950d66df9022f1caa941ab0e9647636f7b7a286

SHA256
8d8a74ca376338623170d59c455476218d5a667d5991a52556aa9c9a70ebc5e5

SHA512
bc9601e2b4ab28130bfadfd6f61b3ed500deb0bd235dc5ca94999c09f59d10bdcbf278869a9802f918830041f620c88e2c3b506608ade661db48ccd84c1977eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\libEGL.dll

Filesize
464KB

MD5
4b1c6fae4e5ad623642408f029dbcd93

SHA1
9a5e55ef7afb81061b0be90c183957db77268511

SHA256
71e4896016446bb46984a4cb11741a1fea9f2da40fcc2808847206147530fae4

SHA512
ae69e3b782ddfda96b8d168be0839c10bae5eaf297cf3a2f8676329c513259f9c31c81e0f1ea59ed69add79196c2793a5465da2a3ea12948ecc2629cff548232

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\libGLESv2.dll

Filesize
7.0MB

MD5
c4f82de52f2f0e59720c982f12c0dd35

SHA1
e9cade984f41a1e476b2cbdc65d1798245037326

SHA256
7de7578c77d402fa646ea6d051ce6c31e1c133bd44e45ac013f1175d2ad7fffe

SHA512
84ccda975f8b714f6e1f9c617ee0b32be18d304c2ca2785c2f467fae465801452f45562cf012a5b543fdc553ff850519fd8f14a44849e5db500de17e27319074

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\af.pak

Filesize
327KB

MD5
c9312ff081e600e5fb4483b46ddd7c23

SHA1
1ff05a6a06cc73caf2d7545a3821d90c228ac0af

SHA256
b1987cdcbb8d76598422aa1739a246ed6690dc1b211f950fcbf2f040491ed7a8

SHA512
20c136b44770aa0e06259687656675a3e14310ea4e8ba214726b216bc1bcad6026267bf0132cbca642c0b5c49293386d0a1bd93ba40e1c33b648ae70416e8898

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\am.pak

Filesize
531KB

MD5
e8bac983607c5432f789afdacdda42ac

SHA1
95c26f47f7102be338263fd7f7e365632651f22e

SHA256
ee363b88697a26d486c77bbf05f5f7f62d4b40c235e1d85e11448083070576f7

SHA512
5e26f40c8dc088d21b9b6a01041ece3bd4b2899ee33fdd85be995545c7a24860fdc9c672da8c9345a08891e0bac04ccf4d65de543f4cfba0bab0ae3fb32354c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\ar.pak

Filesize
574KB

MD5
d1d99f4f2045531edc47d37a367402bd

SHA1
825385e524ece779c641a4ce2a57d14ff126d509

SHA256
bfa2a3c3ebb3c6afbca42cb70b4da8f997068d511cf40ee8a952a893b8f9d7cd

SHA512
4255b02c19ed373d711068a2d4639d462372071cc2aadb6afce459d9fe19bda21ffcbf1604e4937617cd5fee996f9b3786be1c2bed4dc4919d849c7a988a6ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\bg.pak

Filesize
608KB

MD5
96372403a9ded96f3a699262029a4580

SHA1
07069b20fe303f6eef1fb6c8c0a19266a0c705c9

SHA256
6c10b64d31e0dc2c4befc6703ac17343ca473b4350cfb3c6e01833f505b69590

SHA512
0df60fe13818f0c3c6838e77686c5de9fa03b97cbf0943f7a2a4ae2f3a0890d3d64b3a7652d8c81c23de876ac92e4c6b71d584fb106c3520c96ef76ba30250fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\bn.pak

Filesize
780KB

MD5
cb203032925be270222dc2c20fe771e2

SHA1
2f2f20bbbd07ee01cc996247bd9c2f40037dff80

SHA256
297d52b252df0912490ddf26fa58706895e70c2a0f3f09d0dc756706720095ef

SHA512
052be75c51051949c84216566b462733b61026ba74e212b000cbed7d93cb852e74ae83d64d2eaadc3093af4265b6783184cf8e0368a75e077d4b75daba40f9b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\ca.pak

Filesize
371KB

MD5
de21c7d001b771d4d59e2acfdd67dd44

SHA1
ef5870e9cf34416edbec6aa76a6feb77b70b9acf

SHA256
78bbee9bf6c95d239418037fd4660d081ebc0f369e727e613b6b652e380e6dd0

SHA512
3276a84a4b4d90b47789a7ce6a3ae34afec187145a438fbdb7f398152b182e97ba10acda4941456ea2387c03c101bc2b1716a8950897ea3be180b3d8c073902e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\cs.pak

Filesize
377KB

MD5
3e2c49143f4718ddd9c1c74f8599fac2

SHA1
7cce45de66a3895c3493b998fef7bedf045b29e2

SHA256
08e40f5efc616cdc0588fb4b1a706d997c69d17ddaf97eb91a4aabafaa11cee6

SHA512
a849ca0d09e0d4c025d9de6c8008c13e13581961c321f53a552deeaa210db891914386fd51673615aec8b5d8d68a921a968db5d0fe447963892ceb0948861e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\da.pak

Filesize
342KB

MD5
f3a47e259c59de0aabef03e6b5a263ca

SHA1
c45bd961c8bb84331d652f4399675b365f5dfe23

SHA256
13c9583127d9d723801c946039e60f72dbbde898dd23fb9f675b9e299d0ce72a

SHA512
4249456e572403249580905f1b4b4471b6a8d84c6c71201c42adc862d4e0d33f957ae1057109e900a10a029a8dfc45257b0e0e283ad9eca21a30498a0795eff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\de.pak

Filesize
367KB

MD5
cfc9d90273c31ccf66d81739aa76306a

SHA1
ecab570041654b147b3dd118829e2f7ae668f840

SHA256
8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a

SHA512
c9a5058b34c4045ff1b7ae25f1f47bff14d06b3a97b7b1f30da65618ca7aeb0638d79f4e1cea4773cd92d9dfa7f9d2203e5734d0cfe11ee2d2a460d6cec18380

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\el.pak

Filesize
664KB

MD5
8f5a15560710db2af852512b7298b93e

SHA1
30a13ebef10108effbad8c24b680228660658415

SHA256
bc07e403272a4d65305fe24a827404d7b931d01cda547f8c07a840d19e591430

SHA512
e3cedc0eaa82b10a68a40aca8ec1379a6bb924766e1c5abd97e39c621dcbc195d6c1ff80921c2320f0f1c87d160bc2a6258108399876339e5104f98d90a861de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\en-GB.pak

Filesize
299KB

MD5
05ac84aa6987eb1f55021b6fba56d364

SHA1
58cb66bba3af0c6cc742488ccc342d33fc118660

SHA256
e1e357c853eed83fb6c4133f8f4df377a8eda4fe6f0e55395f21c5ab6e38faa8

SHA512
c615e1eb01412c5e2c0402242d442a6cf08965318d1c0d261ca5bc6df9acba5efa2c87ade20e1e4740d2239ea56d1ce4d3fc7a4c3eabe81b876ecb364b3e91b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\en-US.pak

Filesize
302KB

MD5
3fef69b20e6f9599e9c2369398e571c0

SHA1
92be2b65b62938e6426ab333c82d70d337666784

SHA256
a99bd31907bbdc12bdfbff7b9da6ddd850c273f3a6ece64ee8d1d9b6ef0c501c

SHA512
3057edfb719c07972fd230514ac5e02f88b04c72356fa4a5e5291677dcbab03297942d5ecdc62c8e58d0088aed4d6ea53806c01f0ea622942feb06584241ad2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\es-419.pak

Filesize
366KB

MD5
13c6d0a268545541f325375d431b41ae

SHA1
5f5c41348f00c5e5539d261c2b76ae6e3ec7af83

SHA256
943fa8774ade38d57349a5d27869097a782bc06bd34c40864a85ba829457d127

SHA512
09cbb2b21304ca8afa8b760b738adb5422e83550085f1aed8e8590eeef04a2b0e131e1ead6723c3e85383630c483d7720e55f71305ff4821d7822fe6d7aa4252

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\es.pak

Filesize
367KB

MD5
c8086dc25cf0a3c978b2c3b37edf8d67

SHA1
7b6d2ce8b3cc5a33ab2bcd23114fe65ccc568e7a

SHA256
11ef2c0229c1fe1c10be08e3d5f36c973bc3c272f37b40e05c534a118757461b

SHA512
230e6999a6fea1df3b2708eb331a2c25ca53677b3453745ff9cc7fbbc013b69148af5609166720255a2db7e63b25e2d0c599fb07057a6b47bf61f63ea9db9e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\et.pak

Filesize
330KB

MD5
054865950b3b9e8312a7f9490268eaca

SHA1
28b0176112eddb7af58386b4f8aed4a49b9a2661

SHA256
3599e7138a24a31839da877cc9718b9c0c9522437ea93a6222a119080f108d14

SHA512
bfc72f19ad1a52c0da82409accb33a27b2844ed29010207268c7d695ad7562a8867a87b70ac50142909b50b81a5c84d6f6a43968353ae7a72bc042aea8cbb59f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\fa.pak

Filesize
535KB

MD5
c27431f2de37b9643b83e383f7eae5a8

SHA1
16d068d9738e1aa9b94658299a4eac3972520864

SHA256
bb28ad47e95aefaa2d8d7b6a7f449f9707cfadbcd4c21bad8bd8a6578108d2cd

SHA512
4ccc46dc7756ea0e60e6d278bcac1262a54ba03742fd0eb4d9f1f962486394fa56491844871dacb4cb0501c6f594334d3f23f3db82bfdfa1f938e1ae609d6600

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\fi.pak

Filesize
338KB

MD5
aac0554a39bb1ae91e2ed4246e04c30e

SHA1
031785024765eda1534fd9504eccbe1b471ae618

SHA256
df8cefa4831fc2fdf817dd6d49a6373edee4f51f23cf990c690e72ce348f69bb

SHA512
a6afc9464047c75157dcb8ece086c1c5bf4dccb48d33da24e35c43110f300cfea503c4cca093f3d4bcc7a0fdcb306138da5be288ef646881b625751e40d93689

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\fr.pak

Filesize
395KB

MD5
13968778147dad5af68fdb7464ca517c

SHA1
42abb9873c472a82d400e6896e90731b7cae06b5

SHA256
7af39af49846fba6d6b8ee18b2a212f1323ebc1cff1af0053194d01d8d5433f6

SHA512
c1f54ccf4f82e158173d9db8464adca64a88f8ddee23afbb51d80535b4f25f138dac16a337504ca3ff8c3dbe9aff05ecc2aaa40afe8d77bbbd4f141b07e39100

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\gu.pak

Filesize
755KB

MD5
7b476c423ce29e61b0b21d7b6a2a56b2

SHA1
5558dcec5b2580345b0797f1f2ea41952417335a

SHA256
047da4dfadcfc6bec8f4dc7d250b1757caf31a23bcfa2ea3e1f3b1cdbe9a3995

SHA512
a494ab32e45cf74e2b7e0424b4e3740470c5c6cfac8f6cc980a681eb8c21cab76255391b6884134593dc7b1029ffd861f74b47130533232881c137c41ef92cac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\he.pak

Filesize
468KB

MD5
f4dad4f97b5f75d6d7219d43f630c2b9

SHA1
ed8c790b3b5e3faf683aa978895f266eea5b823e

SHA256
6649a844f222cfcec01e75d3de3cb3658f1347ea3851d31b8124597b87e7b57d

SHA512
f00e7e38ec0da1c110b4142dd13b3cae8b912c16518eeb4cfd7f19a0cef2c6601ec1e4959597066703b12b7dffb44fd918c7170231c2b42e40b0d90241b85133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\hi.pak

Filesize
787KB

MD5
1185163466551aacae45329c93e92a91

SHA1
0dcbfed274934991966ce666d6d941cfe8366323

SHA256
eda355e3785313e3d982c1d3652266dce1b6e08832056fe58854b825e0712ca5

SHA512
6fad3e24eb868acf78db0591c7ba77abc84e92cda28e8bffee435ea89940a8607e7628c6c5159349377a8d933f373db2dfa4e5715ca404bc3e67fd4a0f22a606

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\hr.pak

Filesize
365KB

MD5
04fdc1dac2cae614b0f566310dc83bd0

SHA1
74e460e19a5e9c8b6181fa37cb9085f93bbc6233

SHA256
bada5828fc0d80c842d1409b54e8da516ae737ca30d86658b3fad5c8ace4722e

SHA512
a07bebd16f00b0b46059a7b80454664757687a59903bc36cb837cfb55e69bf7f683157372f74ff8355ad50c3b747c9674ee942aac95a9804c39acb3841721d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\hu.pak

Filesize
395KB

MD5
410d8966721ff8817eb3a57f95a4b885

SHA1
f0fbe70c772bd635b0c4a927420e15b96dae05a5

SHA256
688312f38488c7256370b1517b84963a3ff886b31692cc504fe169db241a43f0

SHA512
d0aa167ee919589ff3b80640e8db4c6d11f9159e4a246082f0a564482789011c260f124b9a7102649d998c6a89cbff58cffab5a40e33769b990e64d6cc703378

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\id.pak

Filesize
324KB

MD5
0e82cf23475ab7328741670f4dfa3093

SHA1
fd854e31f4ab212d0b3bca676420d5600d8daa83

SHA256
21368245d99265e760b1b57a3169feb72e6b5099c3f1855155d147b2f788eda4

SHA512
52d694afeb3e7272740192e6b4cab9acab460ae6e66912f090b049a1f431a5c17a4c3d037fc9c450b8a224ed793605e234b4d649a95289770997acd43b5dbb32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\it.pak

Filesize
360KB

MD5
9fbb2f5d9c70d9e46368538853929f75

SHA1
45daceb422478c5a7b7b61f5ee68cc08a19f2ac3

SHA256
13dd077e5e8c8b04ac0854e4466ee074df67c74cd29cc48a0c2c9f96f768fad5

SHA512
77d8607ba52190258ed2e7c6e43a44bad1669294a441cc6ee9d91fa28c26c6675225e41cc309200aee01fecc1a0d369a8e4458c0095c297ed237bba50798c4dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\ja.pak

Filesize
440KB

MD5
67a379c826f0eb60750bfba0b8e10468

SHA1
62662d8efd773b18c99169752996b11f30a64ca3

SHA256
2c5457b0fa6fe41b7b524aa726dae4dd69e7072864f73f211c731810d00b9323

SHA512
38c44dd6c83362cd118543b7619811c671283618a3081f07a015f8110388d71b7767eb0a7a49c37c8e2e9e900dae6aa7f8560e5494afe6b29e01ede402e4944e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\kn.pak

Filesize
872KB

MD5
8a3427385226ab72e8421d84225f7adf

SHA1
701a85bc6bca0ed33dbe1aa3a617ce26576c7421

SHA256
c315e791770cea204c7e49ef5b68fa46fe42864a33e77fa5a1d42f87ba85124f

SHA512
310719fb102c1f892d354f1478bba06e856bd45da08416be970a0a76e44c7d81aaa9ddd878234b2348b625e0d18cfe7c966379115f35d51f4ee78a986c1243b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\ko.pak

Filesize
369KB

MD5
3340fd0a5e8f97f122e1d6e9a2052ca6

SHA1
9c8504b78633b6d6e445723b351a08392916c7d0

SHA256
3ee7d79af9ec226bebfdd9d79907f1bc97d528d2009dbd0db23d74ad655e0256

SHA512
07eb8dab24ea8545cdaf38e35bc23a71a33bf87a1c0ac78ac564c103c6ae53357de2d4fd635b22995cefdc9d8e8241c66d78dd44d68a9f2f251be77c0afa7704

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\lt.pak

Filesize
395KB

MD5
c037c0d80be2c913c20e3fe96d9cdaff

SHA1
8dfd2a42fb2e0041d6ac9b90c78b3cad0283c757

SHA256
e7c133a8dc438870f97112587f5f223f5fcae4f1510874b95b72cc281fa150fd

SHA512
0a90dd7d39759e1e63205a827ed6611dc6e54b37c668795123de7f35c446ee41174675a0d813974dba7353c0a1cc4320049d4fd1368cdfccb9cf9afa47fcb4f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\lv.pak

Filesize
393KB

MD5
b14f9d61e064903bc73d18e40846e1ac

SHA1
5a3da27335194707ffeb07add46662df1fefd76f

SHA256
6e99a3ef823a651f5187c5c549a6885002a2f8523c014f989ec6d53d87e7aac7

SHA512
dab97f5d75d5f60c82969ac01dfc1ffffc0ec5fbe2063c6df0535130ea1432363be1475a440b6075440f68217cd6840a63bcfea0409586d755ff8e57c029baf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\ml.pak

Filesize
915KB

MD5
fc33673850c17a865cae7695fd3eb5b5

SHA1
72f3241ea35554c881e1849ba53b8f64b04502c1

SHA256
6295eb0b0d05d26b3fdaa19ad390ba30f267b7af7a60a214db558dcdbdb436c4

SHA512
6845293c0cd4ee1aa94972da1d58fd7085da5dd664d4031005200ae38fc4ab20f2c5cf44fe07ff80e003ef072f7f1cb23a452d6ce47124aa1efb3d26ae86b279

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\mr.pak

Filesize
743KB

MD5
d1f1c482775f60a868ca094108e3ac3c

SHA1
ba4396e5b585735e8505263ed42884876bdb564f

SHA256
f63460da44e2f71c237b2555eda621c8c211c13ae68927c27ad121f03daa0599

SHA512
2686c406b29750ee39b83247e4a4e6a0ce3325c1284ea11fc986696b43c672eeb0c5259c4834e4419c131941b9d1d35e53b05606168c766d27a614f49e223dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\ms.pak

Filesize
339KB

MD5
52c793391de0e946616d31f7d5b90761

SHA1
50e014d9715df658221edea402609d7b09c9fb10

SHA256
ad044cb5cc56f8cba19ea3319081c194661f072d6b1193509e3690769bbfc2d3

SHA512
d5db7fb23779bf1b258f949ce6af5115adf3bd93760041ef70f1e2f599ef3be6a7a1ec871b18858a1eaca906b98b0a04348a427d5ecd26bc99d8e6d986843478

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\nb.pak

Filesize
332KB

MD5
f15c568a9ed8b2ca497571453ce6bce2

SHA1
957ffec56ce14f33fa75f493936552751e966d16

SHA256
18512064afcc3fb5a0e1f36400e592ff34e8c6c9a7ed0bbe3432255c4759ad8c

SHA512
3bd27f9612b39836e5e7654e6f07c2fd5a31f2c338db36daa51e2c1462986cf4b651d555245ee2e97acd044e44a5beffb8cc9d56c1af11f52fedf9f7fbf7da97

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\nl.pak

Filesize
344KB

MD5
ae7b592c5885481f7bd8c382cf90bfa5

SHA1
fccf9ecbc0e9f3259e805a243928d80e8f3fa672

SHA256
bdb8fb52d8032a8f9cf5336698ca715b4beb4d567bf3657e12a47c36020ae256

SHA512
95dba1b426e4c396c4c4730d8cfc3f2fd1430864fae753423799142516c1d424c8534963676a6fad4061887754cc2b24fcbd0327f67de67b39420b96019e11f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\pl.pak

Filesize
381KB

MD5
cd2d3406f70bbc5ed427295da14cd92d

SHA1
cb9828b0ecf5db97cadb259b746590f03ed7c013

SHA256
65b6dd63aaba1692f36774413d372f6c6c66088d7ec4009a2dbee1648ca133f1

SHA512
bb18f667991900854d8e021e38b799828117f56c90d4d90bac1675a1786e5d1fa33186850e35f75de433f4c5717ac19cd81a424a692aca8d311d98d748e6e568

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\pt-BR.pak

Filesize
360KB

MD5
e4b1fb0229dc7a913012cb5313123c3c

SHA1
6c137b91712593040c6e02bedb82d90d85cc2b84

SHA256
7b171f2a6d46295147a8d10e475048bac4346c6a5162b32a0336334baccad520

SHA512
7224d310713d94f56aafbdb80a4a7ddab5e19dd18a7880f93770b86204e323072aa8e879d2f7e1fea25a6506836e8ca9ed73068e76f4ff9b74c0ecfb807c37cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\pt-PT.pak

Filesize
363KB

MD5
1df331064ff162d97dd13a78372487b3

SHA1
8c98bf3d6964f667df6bbc326c8bcb95ac264441

SHA256
f374bd5c54596aacbc35f47bdd4c9ab4045bebdfa479ae386fd2fdd2d0041216

SHA512
0dc4913b56900940d17c0780dccfff344b2b7f918b8c00dd1beb3fe020b7f61bb646ac636c152ef0bcb20a3ee9c4ee9a1ed6e01c9b7efa414022e4da3df5f160

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\ro.pak

Filesize
372KB

MD5
efd3112d1eac487bb3dd2839385eed39

SHA1
d7a45ffdc10d24425c8b1590ef1239de34737a2b

SHA256
c50f824e63806e5782b693f7d474c48684b9e5174e93463a9bc2876c94990879

SHA512
f604f37f59c17e7a231ecc55121620138ba3c458f532889cd4b70a6046f0aa3ca0d53e0f342977d5ae0c1edf23706806ed429f72442ff90603b896125243e406

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\ru.pak

Filesize
606KB

MD5
ac07a58897f578635b29c5d7bddaad5d

SHA1
d506deb804112aa690c60995613cd9e49496dce8

SHA256
44f0cbb2d5414b6dfca6abb40a435200670e2a71607b158fcbaba67fd6b3ba08

SHA512
ecfa1cd37782e76a5685a385222b87884dd29ef63059f389ce8efce7e814ba50ef8ae03c7bd7b18bd7a8502f29ff6f1fa168ce6395baff2b59cbd434ff400cec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\sk.pak

Filesize
383KB

MD5
989d000fbe286c0fd4bfb35305b52f48

SHA1
5a30a2cc1abe9977b1ffc4c4712452e6d55bc7df

SHA256
dbd82a2a08f8e9ba9581b2672bc49e0fa5c89f073b58f152225f9e2815228ddf

SHA512
ed57c66237d5226d4d5cb63e98248c0df9d381ef86b6d4ef339523f430c54aab14f84121e05e9fedaf273323ec04b8a539c0aeb791245858890126de2ce38283

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\sl.pak

Filesize
369KB

MD5
234e628a62f822bd7b3546b91e79cab2

SHA1
10f48382495bdbfa3b30c15b91768817df13d828

SHA256
d0415bfa061b36a6eb93fa2c78563448da8b63c91e0523086c7eb2714933ab99

SHA512
51234fc3fb5199a3a86dcb7ca68d3c471f1b97897b1a9f90139cfff9846a6c6fd039a0c817e7611e0e59637746cc51045f6ce493cd6f2d4e144fec1c6a561456

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\sr.pak

Filesize
572KB

MD5
aa4e2e54b648f66794f485318651b730

SHA1
18c1d5badcc5c05dfcf9e68df66f53c69e33e0ab

SHA256
d459c1a781ddc344de76558211983dd07d47e3ca6cacffb518043bd78dc48fbe

SHA512
cda7b189f48f28463d045174f3641f16737288b159adcf41da0c131a05a396a40e562b2f0aa10b08d323290f19d864755f238b074a698efa3c573d2b5512948d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\sv.pak

Filesize
334KB

MD5
c5437bb175fed93e85c5e7caf76ff352

SHA1
0d74f7df049ea73a47fe93b75c98e356b9bdd4b7

SHA256
3f0acf6f6319636c3e72cdc392b7b80ab0cfd8ae1a5a8e319624e4b46bcd3c42

SHA512
00af14e7d89a12f4f39fb45a3f9c136e20c06752f98fdedbad426ac9a5b820260a329059659cd82fd089ab1d94c1f51ab4202fb6b142b27538d0139e67877239

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\sw.pak

Filesize
351KB

MD5
e37fc1c3dce484bd0ce496f548f14a43

SHA1
02b088a11363b0a4c0527053669af32737f1403b

SHA256
dea6947693fceb6457801d912ea7c716add3c0cfb4c34782a9cfa4c4e06b9402

SHA512
c5c39d54f4eb6b0659903ce9b5c8804a750a254bf88cc7c6e729e7813ecbbcc88df882af9294b5b795ef5b8afe8f1a60fcb46b3929a9b2cdf41c84188e5852b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\ta.pak

Filesize
899KB

MD5
5002d84bffb908a2dcc7e1b69836c265

SHA1
4cbbe387a6744aa6c51b15b5a3a223135a3f6115

SHA256
e0421b4cf2736bb465ec02cd85c2df09809f86479cb7624195373f25edbcedd3

SHA512
c2a4a46a27304eb080b066f049d2eae733470dbf0f8107220049eaefdd73fd8b41abd1b02b4a2ee6934b4cae18de97bca5360022a8e295427a0bd63603bec410

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\te.pak

Filesize
836KB

MD5
b1a4d471fd8af54dfb8ff252246bfde1

SHA1
2044ee38f8d8d76176a735e726de189feac14985

SHA256
f53e06181c9fa0f6028906a7388fd4e8f000ffb7277330634462433d34572395

SHA512
18248d3fa8f4cc409788d28a244889230b074fff416ba5998f25f3b67ad0c627172a5e7e3947e61e72ce28a5b4cb2134d6627b6252b3d282b54f84b424136c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\th.pak

Filesize
704KB

MD5
85f59bf2f1167e34ab2b666608805420

SHA1
f0d8e8fc644c15c52c5f9d3419f88e6072799736

SHA256
4fe2b7b6886e3ce068be0b7a0a71d45756eb797eda1e7d4fad52ab8a370e8336

SHA512
86d6061895c996ad1caa3f3871c014b656e7ba7bb91f05c72a591cb5877c3db61965bc1a5094dcf7c4127d11f8106622355464704fd0695372627d8400a16ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\tr.pak

Filesize
357KB

MD5
da4c47bef469c086cdb7e5b74310304a

SHA1
9f0569659eb21261003a232d5d92d3aae8d47b7a

SHA256
5df18798a35b502a18fb4f82e9b03b7ca100903ecd5d192ab2a3f0bc7646c366

SHA512
55c745cd8d0aba6f4a2454c494b80eb4cc74f733771e7279b9033d52716551a85154e9eb31eebe17dce05ba71e0213e581c4b98b59a6b88aa8b9569c411e397a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\uk.pak

Filesize
605KB

MD5
229325584cd98c8408f7fc5c5603c6de

SHA1
dd31356ede30833a138fc3a6b8838cef89344a00

SHA256
3fb15957c77f3635aa7cfca796b045a1ee1f1abfc0c12c163cfb537364f3c80a

SHA512
3b57f57649877700f03aee73bc6e6e863ad65ec7c13b9851a3fc7e5d06d11ea154ce087d0a64dc689cfc55aca9eb6492154c9eb18130f6d17b8d94ac8c37a6df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\ur.pak

Filesize
532KB

MD5
6310a289e55b1022f12b4f3cc29fe831

SHA1
150d81ec8db4d9aec6c0e83e5577dcb7f1956b38

SHA256
06a0c18d978b54dd163c7f77b7ee0f2ecf3607c5dc14032326f21b4a1f304d81

SHA512
acb538fce25486e6a01401aa0e9204a6f519cd1dfbca48663d6142e1fb6280bab271dfd2b4c5ddc858de6920805e539b791c48eddcad124d0aae298d479dcf48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\vi.pak

Filesize
424KB

MD5
1b1b14f542bb4a9f014d1801fb2e4007

SHA1
0f56c35b2515fc92690126c54d57aa763a5c3288

SHA256
f1602637e7f3e0a908d7a9a3f630b8dd38bfd26704cc64ef432d2c88a1ee7017

SHA512
3e98c44ad74d905fee06851eab16576f6261a15336f1c1f625f646af725988b75957ed89c16876ec6127150e2b28778a5b65f897b9540ad1e4cec98be705cde7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\zh-CN.pak

Filesize
308KB

MD5
32b1659c7abe8a01a702e46c69f0a3ce

SHA1
43eba1f94417109834f25006a81653bf635ce9a0

SHA256
97fe793b325d0c27669f62235bd157c51a3e1aeaffba30e7fe028c9d64939c5f

SHA512
72b932cb9e19788a67a1a7beaea0b9b076af0a5f1c568f9d2d6e8653d3c9fd4bc17db1a39db1f12b8184112b8e67125f443b8b2b60f31e62e16ef9c6a8e2c4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\locales\zh-TW.pak

Filesize
305KB

MD5
14f3f547a54713f91251b38459a096b5

SHA1
02ac592a2eb4a7c6631dad5aae83726ef9c33ec0

SHA256
280ba35171dfb6a54efb13fc4ddedc13a0283a9a6eebff4c15275767beb4ba77

SHA512
0ad8c6a6eb0dcbcbbf6f9e114c93bc2cf6004dfa9ad7b68dba31c2a9856c0a56acb66507f65b1823434b1ad362c1ac812b72c254e5329a2858e888a761f45ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources.pak

Filesize
5.2MB

MD5
f6dd61d802bfe64545deaf4c93eb6db9

SHA1
96be1ec4723a6dc2b1dc6e073a7dab026443b1fb

SHA256
f7fdde9650504d8872a7aa2b68e1f5b3cedd100ded1e19e44c2b6282eb637813

SHA512
33585e7f19222e43926bad8cdbf36bfd395feb4d043f524f82053920405afd933eec4d294b6558409ee9419c977553e513549470638532dc19bb93296387cf76

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app-update.yml

Filesize
227B

MD5
4bb15bfb907bfac157b20acc00c3ae17

SHA1
338c1772d699396cd81c5e3b8e1651be54a4c778

SHA256
b976b333c2315c4abafb99b367d48ad194e25e11d3ccb55f542fd79cd180e03f

SHA512
b76dae75360501d90c513ce4e3ac29c762231e386cd9f2a30fd7f59657ba1bbbfb8f3c921f9290f5662884a3aa2df817abd36e7d849465ba190be83dea50f636

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar

Filesize
61.2MB

MD5
449a7dc2c96400af82a5903bfaf6e626

SHA1
00250312ea0e91280682fb0091e048790b9bbe08

SHA256
1ee21da494b111cf02b07997d32f11e93a42b414b2346844e9b77bcf6867aac4

SHA512
fe683c79f66bc07204d32ceb6efbeba2a860d6a32065c3ee40385aeb7887b294abb4272cb7255683d8b6655d1d4a93dbbbe39d0581737e7bf27806ebd66e8f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\keytar\build\Release\keytar.node\index.js

Filesize
432B

MD5
ee6e2efa222bb1474534f6a2310bcbe3

SHA1
99d9649ed2e04ca0dc2a7604d14acc4f6bdad1ed

SHA256
83675a6e76853196f742a0186b7425c6cb6a31ce76306ff7336a16b060dc96a9

SHA512
38ba306c3d06babd3585c607263ead4f6bc0d3bc5e642ad45821a07162a05e18ce1b9e38d9ac014ef29da8426bfac882afa0564f198bd70644e60ca257f454b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\keytar\lib\keytar.js

Filesize
1KB

MD5
c02c937c0597ff8d0fe9824fb7a7ae9a

SHA1
ac0a580385a7d812c6e1eed071ccbd6c7ead4488

SHA256
e858194902d632e217b60b913829865749568fd43aee2d65bf7ffcefd7b1d6ae

SHA512
eb1cf4966e868c5997e59e7862d6857e0a6b85315e2e196704e999fb64523318ff160570aaba78b48dcc498667fde928fc26b597a1fb9122750a2cd6ac033d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\keytar\win-x64\keytar.node

Filesize
147KB

MD5
84fce493888813ca1869c5ff3a6dbd69

SHA1
d23e7a00bdd210f03d25b81da361a7489d44404a

SHA256
ff4a5f97a0d90617c91f0836d5e18737223794bfff7bb836a6e3a813b11b1d1b

SHA512
51a5a2f85d2bd7134bff69830a3a38114f889da60bef55fd6ed16378ce273a2a467e96eb7b6b48fa458b8bd6903aecc325da084e7939f0e7056d9b5317a37cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libfido2\index.js

Filesize
486B

MD5
33eb3f81c315aa1cab4dfa57e28b8c57

SHA1
ed240e139d672e27c73f8987564328253fc6fa52

SHA256
7823e992fe7f6c4e8951b3ef32302fcd1c719bd8301511e36b9781cbac50b05e

SHA512
d4842523b4650017fd2dd06d0974e04bd87b1222a1143ac6c87b6a2cd5e6c51b050bcd1aed36af83cb87ed783037507ef80c87261330e12d2cbefef42f99169a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libfido2\package.json

Filesize
275B

MD5
90871d1d400a635c08a3ccd8b7dceb1e

SHA1
31e1211ffd7b101573c8ebf5d048ec2616d3a086

SHA256
291b7eb5fb05abc3a22504b74907665108fc989c738ffeae56606ee803c0ffbf

SHA512
27aee895cd88cbd456cdd93f89e38eeb2403dc2bf6279cd0bcecaa41a2525c99c4916eb96d7bb95796aa145f865fe40295d064a6184bed72faa06f23c07f88d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-x64\cbor.dll

Filesize
214KB

MD5
5e32e47d9d4427df51fa02de7e882d37

SHA1
9b437ac782e1066ac15301d284ca9519e15187e2

SHA256
ecacd637f02d8e99cfd81b2cd00875945f669651916b4b9480b3a6bb36e22741

SHA512
f42afceacb698d4c8bc5cddc51fb28a9711f5ee8dcf8c4a030fbba845ad4add84b6c34bd93e6d9296caf8a54a2194543f0487ac0497f2b48ece818b4dffcbf58

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-x64\crypto-46.dll

Filesize
1.7MB

MD5
23c14811aa62faf16146328bcd15f881

SHA1
5a8c173434e2f00d3f6aeef8e89fe88ac81c7831

SHA256
98708724b2b7260f58c9d05b5ef858991b180244b58551d14d378c641ac6bd09

SHA512
997a4b0c8df51802533da9fb023ba469bb1eacc5077aa2edc9820123a669d3b6da794e2abdc35655c96877ab9b56ccf46b8b9f6a12b0eb2f1aadc225643a2768

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-x64\fido2.dll

Filesize
264KB

MD5
e6458c53195a6033652cecaac0abe53b

SHA1
36745afb042d75643eed89281e6f408f6d09eedb

SHA256
a682834133685010790426d5686c21dd6beb457b1147cb3eae72b7fd8d81133b

SHA512
46038a11237d3b24356a800016ecbaf9527da7e1a2dd105041435dfd5d4b8edcf4b03db71770a20399071fb42d5ab446106718e7a9ebcb7cb5f949018214242e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-x64\libfido2-nodejs.node

Filesize
667KB

MD5
4f3f8786f05caf1b00aadb52c017f778

SHA1
99a67d1fb748efeb607e5b67b57dc751da7d74f0

SHA256
32b1d6bd92241af638ea3a58f7de5a8a6d8b3d4b42657077cd92716578bd7cab

SHA512
84577e68c505c5a31f653b1c5fadb11e6030e7393dff714dad89d1db9fb03dee5f2d1f55db00879fb3c9c448be94d5559180da4b437da940865b5287ef556c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-x64\ssl-48.dll

Filesize
405KB

MD5
2a646a1096e51d4cdeec42fcebcfd5a1

SHA1
edd5ef4ffdc597e66ae4db2f5705a9de6b38dc70

SHA256
8e220bcebcd79c45361768669527e9311937bb6c631fc608667ddeed460502a5

SHA512
53e24833ba4fd5403a6bc5cfe39a9ed36129190cf5fa795bf58126efdade9f8de325c1a799b01945afcdf65303d275fe16a8cd6821793f989641781f0e778456

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-x64\tls-20.dll

Filesize
157KB

MD5
f76c13e2bdd5766deb88d2852a55bc0d

SHA1
92f2786c7118db77c6b3ab83fda87aca84271df5

SHA256
9bd32a86827666469ee3e50511888e7edade2a2121b2c18106d62a09db5fe9a8

SHA512
3099f69364955281007a3700053dbdc0e4755406b30467c9a4c39460b026b4e7ff6cfc3f9a3ee70bd449e10bb0f317cb68a9ae19674e8564da083b2672af13cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-x64\zlib1.dll

Filesize
208KB

MD5
4ba6acb9ec1495d476cdf0a037a1903f

SHA1
26327ded9ca6fb9e821619e648ba5c4fd386185d

SHA256
a40f64b7888ae39e7c6327c7bafec6ba53837553fa7a30a33449f3abc0fce203

SHA512
65f3846c0bafc95f8431df83555a5f6b491db5efcf1afb20846ef154e0033e5cf67efe28ca593a8f154498f73cbd3d6f733dde3f78e3add393227a6f7e4882ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libtermius\index.js

Filesize
480B

MD5
19f58a187f3cbdfcf9d7a5d2874d7399

SHA1
1f3ef9dc9bac9eec4fbcf870adc69e0770081baa

SHA256
d87f0c77ab587a7714d760f7f5759b229c5fc2b3c0fde3b2f16d3db4c27d4312

SHA512
a2b24d1ba2f915eccac73e8dfc2586a03fda651e0890c970aa94f3b701f3360e4bd771913a20382d18c6ca29397f470aa6b0d61c4da2cee2aea211df07cede93

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libtermius\package.json

Filesize
238B

MD5
1b7affa29ee56fe5063b35dda7817bbb

SHA1
a2d916e3e05c59d7f6d2ce70c67d7821b93c47fb

SHA256
58c0069f70b3c59c689f1ee25ec3b48a3a4c2c66acd2b9c231f335045a318119

SHA512
04c16bd178cb1b64a36220be751615296b2045f01a5407a61779a9587b5df68382e51711a7e8d5a0a197383827c99347a261a2087ff6d3b3a9d296af14256b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libtermius\win-x64\libssh2.dll

Filesize
4.0MB

MD5
b0e9f3f9d49e2b51543c7915d4e53d5b

SHA1
6373e6f666ecfc14fc3ee825d8b439c6e97bcfaf

SHA256
73a99d6ea4d0b41d8f8f8d642c490d224bc5fd4a5ebde1d8c79d29c20962594f

SHA512
9e92dfed363bf3a10580557f225b45db3983c317cb5ac233b49736fb28904a56b2e1f621fcc8150266e4e0cb8174a5ae32717748aa35e8c060d5180629be8080

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\libtermius\win-x64\termius.node

Filesize
3.8MB

MD5
e01966ef6139d9a5da59ad64a5fb664f

SHA1
1fe38f9117ef2d47a9974d23b39d665f13cb840f

SHA256
d5f399441ade8d1a4ecb41e2210f3216616f8fbdc66b940e6a54af819c616795

SHA512
b1e513dd5c183dfd0c39ab13bfff0c8e8511d0621943fcf198aaf6e8ea28b67fea514182fa0b0c5b9bcb964319c64859aad5744797393d80cc39b16b6c72bd53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\mosh\index.js

Filesize
477B

MD5
02e6d746dd460d26e62fd87887a1eb26

SHA1
747c3df2bf72a3f4d3180b3709e78ec6b7fd3e99

SHA256
34210db8dc4f1dba249f9268dffdab6ceae44c03ff65845e3cd1e088e3180baf

SHA512
01c3f8f36e91e3eac06dac3ecbe298bead75405119a6a28c9bfcac3938900ae18dcb8971bab0593e63046834ec3e723c2682de77e5d6362576932d4fda9b990b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\mosh\package.json

Filesize
223B

MD5
1338f2ce44b5f8b4459c98255f2e2d85

SHA1
925dc62f4d6c11fa411ca0a5dc54ade4064c1aa4

SHA256
9648724a39b7c11271001de03459f71246b26d87e206832138ae62fd9f21ba77

SHA512
7244437c43b963f94c774f00619cd4721aff40b483c92357235140bee56ce54b46df387a4f9ae26af6d05388cdbd62ee0e97e1666c995004b9bfa3599fa79368

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\mosh\win-x64\moshclient.node

Filesize
1.5MB

MD5
286b2c1cc350e97dc300df8e6c3d479f

SHA1
3e2b61dadbe3ade7cb5d6991e755d13da5dbbc8f

SHA256
31fad05bdc8eb306d0a366f1341c99b10f070d3f1eeb143a4c8515d622a5e44a

SHA512
e5039933122679b65fc41adfda753d5ce32c56a8680439af03bf65010bc2fe5a8b12be60c465fec05b2afd8a67154dc155f6e20c9ae6f7315227623d1f6c4583

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\build\Release\pty.node\index.js

Filesize
431B

MD5
72155b9c01fc85026b8ed43a108d840f

SHA1
1cedfb72a7720aa0b7fcce8feee54515cb1fd8bc

SHA256
d7869728efdef2dfbe1ea824025d986019185a3fafa2d6099e2c8c0ef6ac4a34

SHA512
e08b7d49cdd0dfbf16edf46aa43b6fbe84b112073ad5a5a2a5967311e59251de99e9c1791947415b693fd60617e1a284973444536c7f74107a7428cdb9324f93

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\lib\conpty_console_list_agent.js

Filesize
775B

MD5
f6ad74fda649964d07434a14ab5a2ca8

SHA1
72c55d1d935bb8291b36339db91372420017221e

SHA256
0a9c63c2a054f6f0843dbc310fd7fa7de87a1483980ced58fdbea52a4af3f14c

SHA512
ae422c00ed398dada6d3f6ca506966da24e79c3f5adcd7a77718f894b4992d45f11d7c2f61c0b758fad4ab338ab4ed2f53b7552edcec14fcb7b0538572270955

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\lib\eventEmitter2.js

Filesize
1KB

MD5
1c7c2a107991b0a0f26a07c56fc7819e

SHA1
4a49eee04288c57afe2f09ce37563c82aee450f1

SHA256
f1c14613aa90c10def4ca7238329270871997eb26f919f7074dc25533e3e75dd

SHA512
93529d7d25bffddd1cffbe8060b310470b8dba533aeb3c6edb5ed56eaabe9ed749f29e444f935a1255c4becfb892f49aa0433067d16c6352195ef31b305be904

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\lib\index.js

Filesize
1KB

MD5
d54ab508fb78d940a6793c488d7823d3

SHA1
e2b30ed24f5ee8b9e27c877199a2c57167f85863

SHA256
a417bef7e10455a2f538a729d722c22e91305ada0f87ada9c168a15cc9f01505

SHA512
8326b13db3b091816d11e50240c732c8445662538f17f878a8226b9c44869db5119bc39a323a399a7de7ccd89decb9d02cff4f8a21081df151c8c1f30b9fb222

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\lib\interfaces.js

Filesize
233B

MD5
4c9a3e0ca982c52d0cb6bb5e46a78a29

SHA1
2f21ecee4e625851a0d0c4289235702be2e69887

SHA256
56e4173f09aad26173f9d4c79800fda0b808c34424f987ef8d671cc931119a0a

SHA512
013fba949e8a748cb2ece477c0365fab50dca324e29c433ec3d0e828474d1ad9bc434a6b8286a56e20e6dcdbbc2bd5a3b6fe3631773942db792adb66c8c0f192

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\lib\terminal.js

Filesize
6KB

MD5
c347e854019b4f6a272858ac07923b37

SHA1
481a6239ac9664957a118379ca49d62bc54a3edf

SHA256
563c438fabfb9179581ec95a876afa62c1ada50ba969efed4f878735237af78b

SHA512
1828461d7342c421385f494955fe59e3851c596ac6b458e51b17ab3ab38fd94285362f23852bf1383247dd6cf0406da5a9489f931b5789de60779ff1cf82195f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\lib\types.js

Filesize
228B

MD5
3b536d02531f45ccc8b1a366be60b090

SHA1
621a4339defcb50e9b422a5aa1c1a980f076bf70

SHA256
408bf8287717b6322cc380ea66caf1b5e366dcf697707ae2f3cc454e08f3b151

SHA512
bf04a06ce72a5a9462543b43e1265fb37f15fb489a6fafc85e90897f123b40b85bbfbfb739c8af2d2464a6b2dea88bcfcc7eb1b559cef7b3b0a5a80aa6c881fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\lib\unixTerminal.js

Filesize
9KB

MD5
c0b5581e8c8bec90b875704abd225d22

SHA1
5ba9aaf74d391151373eaf28c4a07b0c5d0a1dcc

SHA256
206a1b35475ebddfabf43a62bf78daf49baba138a93faf4d1dae148d9aaffa1a

SHA512
0dcb24114b964ea21b4464a3325d056ceaa7ef94b1b35ab4e6773be6a5a872e785c32a2b2686b9ef0873ca67183ea02496c05cc7233b8882dd817cb932711eaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\lib\utils.js

Filesize
580B

MD5
8471accfc4e7871ae0fc945fcd4cfc7d

SHA1
42f94ced8c4c24dbe5aebb38d5bf3c01622cca59

SHA256
0765d919bbdb2651a789512df8d28df7ef74c9f17ff9ed99ac1d4f90dd0494e2

SHA512
1ad37c5fd8895377280657dde93c65fe3fd714d90d41fd7c737110849ca4e34354bdeee84b8e0802e700ec8ac8be8424fcd74ebc047bb1f5607072dd6db7bb0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\lib\windowsPtyAgent.js

Filesize
11KB

MD5
71845558765fb372fbe88ef4bdef6ffa

SHA1
257d96a69611ded267e664028cf34c26bb2b6f64

SHA256
1975bf1d16d2d567cbc2aa12fb3c3c2cbfbfdd5ce88f9ac0f1ce386f6b6e8cdd

SHA512
2c1fef734543f8c7314d7b0cee4c6d1a39bfbc558a1f68a43be81dad5af44fe561934767b5cf894e4a7e4cbe8065781df3212a9a03dc3fe3f9602e12252e8cd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\lib\windowsTerminal.js

Filesize
7KB

MD5
500218077dc1cb1660b4c62c4dccd9af

SHA1
a2609c9642382acf96fc0f8fe0b0feb4cf282ee5

SHA256
cfaad7a0d8be0f2494e122094b1b71bbeb0309f8741568f7e715810561449279

SHA512
3db4c72140752956a61274c9055a6099e5bf2fa218305d913c570164449ba8a8c425d39cbbadbeaa87cb19bac58aae75eef70c83680340f0917828c62c4f8a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\package.json

Filesize
450B

MD5
8423918dfcb0f481f00862cf147f0410

SHA1
467ec3357809537b9c67846a8fe400b92b16e6a5

SHA256
269dc395dd84cdf20bf96fdfe7cea8e49475bebc62a22a3525ed3617f3be690d

SHA512
d84b802da23bf000fde29c4a3dd8758dbcae3a32518a332a040982901d43fc66fb987b226d35dc0b98ae60bd4e42c286142923aabf2494ad4e9e8cf1f7f2c9e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\win-x64\pty.node

Filesize
1.1MB

MD5
13eff4c012d95537f304ab8a96d50d11

SHA1
6128b60474797e4ce847bc19e8ad8c9b4f4caf23

SHA256
b0dbea20f274f536bea9d32a0d0c2941aaea26977b45ac2cc3db98330e6311d0

SHA512
4cc38646a57362b75ce60cd74850ec3b44978e1ef29633abe37081eebb486aa3983261906c7db1be3c08ed6cd27927e2749c24279c139bce39057122e505029c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\win-x64\winpty-agent.exe

Filesize
872KB

MD5
efb2e54bffc4cecf05b9962b140fb716

SHA1
7b5b43adc35ed9929ce5d1057a22eb51287af31e

SHA256
ccfb19ef85308289c4c26336068e170e0a23ac7944375669b9fa695decd130d7

SHA512
646f8641983122e0ea641ce9598422a02902533b843798290d2af329f60666a4cc2b40100d6aeaf31999e7fca878e3dad6aa0740fe9bb380fdd84b4cab8fb153

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\node-pty\win-x64\winpty.dll

Filesize
746KB

MD5
a768f8d91d6ec91f6a84c3cd07cb4aed

SHA1
121e3365c8e4b152504a7957af96f7f05cbbfff8

SHA256
001a44b801cfb488bfbcd9c85e499f50ee14d9db0729de5ffde810ea8981f1bf

SHA512
ede91827eccc2e4b60361eb39136604e69d812b1a45ef5a09baafdf3fc6c66f45973e5a08536f3eda0a7e82ac62c52909df557daeafbc19be0071389b50431bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\registry-js\build\Release\registry.node\index.js

Filesize
439B

MD5
de6dde53e70e93d04012c87caa5d2ce7

SHA1
0360198048f95ed073a115f954f1ffabdc050233

SHA256
2aab1d3f934d7810e11aea9d7ae885eab8f5e9a7c65af2ca3543208acbe8edeb

SHA512
b64909170aae0a13cad3211517a361415cebfb63c6a16f46c01c1040b6cbda875bc12c7b3086c55aa3eea2d2e5ff755033f295ff1ab501a58f4fc978657be01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\registry-js\dist\lib\index.js

Filesize
645B

MD5
493826fb324acada79d24a3a1338faa0

SHA1
1d3fd0bd09dba9a7b560029e59f5f214a11d608c

SHA256
57d19d5e336fc60806050342d813199cfa21100348b4c195dbb6be934af33f1b

SHA512
18f025ec0da6af0894b667b2273deed294c7a203324785a131b7c849d6bfda23526fe8804ea805bf018e5dfc6fef5e65b7ff94242d4cade134c73f6c19fc9351

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\registry-js\dist\lib\registry.js

Filesize
5KB

MD5
138e5803a608d16807671d52e35b5f3a

SHA1
4af6bf0b0a90b3ad3e35617a9de1da63cefab1bb

SHA256
7e6f33a208a09123a9745207085632364b66411ffbd2faaf6d4b7a7d32a2ce89

SHA512
c28ab72c862f78cdaa3e4290338e3110fd4aea6ecbe72217c1fa7a8455bb9b7f7b7f118a82965e57a66d7231ab5bc35cdcb039659f57f8cf8fd398d9fdaa87db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\registry-js\package.json

Filesize
422B

MD5
c54488fe1d35093ebd1322ea912b93af

SHA1
a41db15260ca3cbcbdab90edf35dd8c26e817dd3

SHA256
9ad07835b66cbc25143d98e3a917c8bb90832bd31154772e61bde99fbc5fa9db

SHA512
0e0214fb5d70ae20712a2c5f69b134096920246f6b4a42fc20548a59d6dd5af3edb85853472cac1a846c5b272a03cbfc914491ccb0c088f7e3038e19fa0ae987

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\registry-js\win-x64\registry.node

Filesize
680KB

MD5
96198266da3da5a7dbe975a59e04301e

SHA1
c3ed6ab6dc949c14f3a286360c0a5aaea0a66550

SHA256
f9bf360e973246468fedf70dd057620b106f98b15d411889cb24f27a2cd8493a

SHA512
979cf58db281c25a28d8d8e023aee45f8df72d9c1d5a8eb87683ae87f07dff5e35280464d4a3d6f0c794d655ab8857a66e9fce50f54e00798084e8dd8ff10596

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\restore-mas-purchase\index.js

Filesize
460B

MD5
0a6b9616e9f700622deeb4ee5e28bb8f

SHA1
d7182bbfb122f58515ff616927ad4a3820a60ba5

SHA256
a8593c2673db5708c0e6aaafd42476de81e6f9ee65bed0953e145efbe82afbed

SHA512
8002d7a9d6bcaff7159e007b04ca1f128de82782268547bb23f74ef79926b7c9cedeeb108e94667f974a15abc7334d640671f48c5bfab9beb66d9b33e31d00bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\restore-mas-purchase\package.json

Filesize
341B

MD5
339330d8bba0340f2c98abd194c1c212

SHA1
a5ccbf9e275aa99c0eec7e823cfe82864d82579e

SHA256
71de8f645b205c6d42224fb73d3494b10d4487676d9f2a7717b268f59e98a2eb

SHA512
191fb7a90934cf4a594369553744d9e6ed50098033978474b868827c8ee3f4a525329a216220b84dcfe9c80a08b01730fbf836afa251021a5ef759196ff756b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\build\Release\bindings.node\index.js

Filesize
447B

MD5
ea34502cd402f3f829a1d2d5c0480ec7

SHA1
325a172672ed53149e09d3195d9ee981aff164a6

SHA256
e3e75309bb751ec37a84e2195339e166311f7a4fbf4880add14c98e8efc0ea39

SHA512
092c86fd12ed56ae40646ac47c19ce5965030723acc1ac23ff3d131b8331fb325cc4f01309ee89bbcca3404b77ee95ab30c74a52a14fd92c8c187c08bc067e05

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\lib\darwin.js

Filesize
2KB

MD5
ac51fbe32ec674a687df1b97d6d68996

SHA1
15269dc69e113e1b92ae56fafca5aa617702675d

SHA256
3805d0cb29dd6f7d22873a24faa0dfc0f1799e63ab01d51360755d6def131283

SHA512
36ef394d4686f75a1efcc2a05c1bab17f37c227a2f743402b86a01278b409661c91c2f530c7dea75920c215983d6c63de06c64a25c47356f8da674254030446a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\lib\index.js

Filesize
375B

MD5
b6b30af16a0e443558447f9a6dcb06b9

SHA1
fc1136c64ed450979f9d59c111813efeb2b5112c

SHA256
a1712039aa76f42c0bf5da9b0b3cc4080fc3da8b7366ad6f456d2348d1f55769

SHA512
d264ba285a0a6130c5160ddf89b579ba4466c03c40c518d27cffb91280c8b75c931b6e7b062b54c8d6b884926e2f3512a89adca7fa8acec5e7d6f5c5ca656577

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\lib\legacy.js

Filesize
653B

MD5
b9c1da89bc06d5be7abaccda352ed4c5

SHA1
bee9cddb45df4c110faab624d4c06a78c65c12be

SHA256
5b81d2da89374aca3e891db5f79186e1c7288e73e4be39aadc16377e81d276bd

SHA512
90acea408d18301c14186db71b0ff1cf99ad09f21f24cb0b5a699d3f71d09f44af5cb8c753f87e5b7162a2b39787144cd1e73f030127af3b2627a389873528f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\lib\linux-list.js

Filesize
2KB

MD5
e27c38498c90871916a1d58a90365c3e

SHA1
78f0474c257cb676a6f5229a7c21695ba9149226

SHA256
b18cbd1238e8e7b228517641670b0d31a8f4110dc96acbe4aa120d82a586b92e

SHA512
ed34b023a862292152b00763f60d43fd1d9927b97563ff9bc094f04c4cb6f617d6233577e457b32df30353bc2afda1953f3cd73134ece4240574140a084e5af1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\lib\linux.js

Filesize
2KB

MD5
c2ee0accbab5fd0c5faef21ba8df71c9

SHA1
2a92a6d023f5b8bf0b78f0476cce146719604ab4

SHA256
33141436365765d92db7e67261d83016fb5b491f90d73d13ca47e849f141f9b8

SHA512
09821248e135d27f4c9c5b944d275f23f760ff169f2982f86962ee33b0651feec76aea696052861c52be3d0dcb2f78b80eced9c0b17bbc924d7b95f875d07737

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\lib\poller.js

Filesize
2KB

MD5
551b10be9013921f9e7e1625ea38f581

SHA1
9e0a5de3abdb274fd38dbd96ea07b6e52776b436

SHA256
424e965a6ea648b39177e2755c8ea6b50b5d40b41c0c29d26bc227af28f60dfb

SHA512
447eae850c38ca1609d433b436296af8578c08e37b8a5b3367e6f1ace857a4e5e6a9898b242cca1e39b90d52447376efb4d796a11a89ccc2800e42b6e873afb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\lib\unix-read.js

Filesize
1KB

MD5
0c90ce2d28026c8588862a0daf1923f8

SHA1
afcc1222ec212012160b68e932307be94fb7b68d

SHA256
8d3cfaedd7aa7a565f73cd0bcb3e7dac1d5d74b231f7e966f5dcb982d12a1289

SHA512
dae9945a35f5c0989ced6532427d2086777663c76585dc1436cf4767aafc171529f4fd434112d23a455cf6b2ade2b34d0b50512d7fbbcaecdb39b6bcc801f97d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\lib\unix-write.js

Filesize
1KB

MD5
ccca0472defa0da2ea5055dd3c74bbe3

SHA1
75646446c938fab8d8878282e754c225ef8cc3fd

SHA256
75416bc5bca63b31889fdabe6e29d6f00f696e05c469f868c70829da062fa8f8

SHA512
699f36b33c8aae4432515c21c3caf48780e0b713cb17ab0177c6f88d92136a5d7b3b2abedf81d59bab7e4d584337f5c16b8a229786106f720ae59c1611028361

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\lib\win32-sn-parser.js

Filesize
263B

MD5
40bcfdb5ee6eaba2dc0b6caab9477679

SHA1
34e36ea3b9074a8406c6e103a56e20e42400e51a

SHA256
5e814ca196ff403a42fe5ab90c7555325496841f410ae6a35b1f0aa6415364e7

SHA512
bec28e2df2dd85c520cec4b9c6d96f48492e382b5c2444bd1b00a2db8b87f0e083f6c567bd9fb27da4d352efb06336c9e6f8ccd67722e68ac7612c977513fdfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\lib\win32.js

Filesize
2KB

MD5
159e0262a8e1bdbdd5c9845b8445ffe7

SHA1
49d53bd70b327d0c30c3505d8929dca59d1bdb88

SHA256
e51b6213a8da449e23cc99a4858a51269c1a662d95c37b8cc55f85566469e501

SHA512
a8f298c2c492fa58c5d20f3c1f6d86b2d33ccfb280134acc0cd484c0a6394369a61d1c50094a750b64aad8ef1cb03d516fe95447a1101eeac9c952ccc14c24f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\package.json

Filesize
475B

MD5
2d2e7fb4f7435fa48da94de36b668d53

SHA1
ef89d5c34089d410b77721fd93f4c5fb15b73612

SHA256
5aba38b1f259d1e26b17fa5d6f17d400484b7ab2765577451586d9ad06e2c598

SHA512
3a85e5eec99dd2f19fd90ff222895c286079335ef99fe0b2161e7e42702e040c8f38746820f5bdac44826af851820dd44a3003fe809a8825a96a947a611cc277

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\win-x64\bindings.node

Filesize
730KB

MD5
197a211298fb0c93dda85865b5471b65

SHA1
967a8e0735dcea8fafd72b6eae407a3f586877e1

SHA256
50aa3785a77492faec599a30841f165d1427508ae7f22f72d962ab7a9c70ae1f

SHA512
13e1c505f379ce88f97124efd3c0fdc7eadbfc9b51b481d519f72eb753e8105efc3a11ce591c8090aa89c925a9f96228cc7476ff6ed1f5c19dbd3d9ed093c5cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\windows-iap-bridge\build\Release\binding.node\index.js

Filesize
445B

MD5
15dda3a05bc8bd8bc55e5dff76a6d027

SHA1
c79d7121a06d9100937ceb006900c74ecde6d1c4

SHA256
344f250e0df725f02292fe3296cebe37f2b5958cf76f690ef22409e0e9b89235

SHA512
956d01a7ffe7849375330969e3eec020a5de77952f00f0379d19adbf519dcedff069ec2378ec96384fdf70b5d2dd0dcbfe54d4c1df7724d3cfe014cfcadff013

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\windows-iap-bridge\lib\main.js

Filesize
268B

MD5
747ec0e0fbef1db6b6b240f78b94b8f2

SHA1
dbceb5807f94f8d2caf962e11a2130aea90bc55f

SHA256
37b4437a8e833d38aa914efffa033c60363b31eff9005b805e1b54db3e340772

SHA512
c6ee1906491445e066e9cd8852075155e2a624f28e3d21ef60dd44ef2722e49f27eb604e6a6ca1dd7140d37ec49023b316b044ec84f83d1ba615466c7ec6277b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\windows-iap-bridge\package.json

Filesize
372B

MD5
24dcca8cccc4b13648a438ab581fcf2b

SHA1
90920ee39bfaeb6b9f797a2f23438d9b61abba99

SHA256
b8ee281887ec18962edbfe122a76de2a6aa826a6537d887f4167aff12f7515c2

SHA512
c40dee51570d220f9360bb3f8aea200bdc2512ea50e39285c9d33eb493dd9f5e1cc9ff5dcd6f0c9cdf5a322a007b9d4d878343f340ac4c94ea05028cc7dc09b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\node_modules\@termius\windows-iap-bridge\win-x64\binding.node

Filesize
890KB

MD5
1a6bdc6f94a6ba383edc524bb0bcbd55

SHA1
84b825349a6ef4e05a0c63081f931316b12a5dde

SHA256
8522fff296b531d9b09ef9ef12c7b5820559808f979697b91c85a04310167ea8

SHA512
1db3889b1b0889cb035a547ef8e7ad6aa358bcb2d6ee35c3a63b1bc5240b46e0c7c7cd60903da6b994c698ef9f7154715ba155ee6c2ede0c49124d1c78085ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\out\shell-integration\.tcshrc

Filesize
256B

MD5
b2adaf1b0a2f657484d065e31298fa1b

SHA1
db690c5f11e84dc40ab2e59a2631640b62b1c880

SHA256
691a6c5c2dd14719903adcb125a7129cbbb8f749d225f164a7c9c8bb58a22658

SHA512
d62a98761130092fbff447565b0a01972a90b5cceac01401c4e14dcf43b2bc729c2d2db41a5c265271446cbffc1a84a0011ed91d944703560dfdd223e2f9d061

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\out\shell-integration\bashrc.sh

Filesize
1KB

MD5
b97b17710549e1455a522e49d4f691d2

SHA1
43bdf9c6250029cc207ab37e482fe572842a68fa

SHA256
7ebf5ff6a15228778758f14d08c3abbd6098ab6bf6a8cbcfbe5f74eabb054cb7

SHA512
d0a7c8fcadfdd104e60ffb7e7ef1527dea64d0acb0b83d692b87d3eef895f72bbfd185214350adb61f14cb11b51897e8e64995f34bcd53a920f7bf322f2f9cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\out\shell-integration\shrc.sh

Filesize
473B

MD5
c7eb4ba69b991df27bc493b4e941a3be

SHA1
be81457a0b35cbc496945de6a18558b454bec59a

SHA256
83adce96883210f34f102c13de0406dd6ad06d0cb6fbb93ed511be701b329e45

SHA512
d65d2450d4d6eae177615d129ce4882ad00e0178f7031ef151fea1ca50ea7a24669db273cfebad12277b512f97c9d7333abb42275e0585b257707a5b2c4c8e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\out\shell-integration\xdg_data\fish\vendor_conf.d\termius.fish

Filesize
753B

MD5
1c9a186119a54a2920151af8c9639260

SHA1
ad76cba899924ed2bd7797b1af79b6c7e866c7fc

SHA256
f9815408560c1c2724bf5e901219c158871f0f4fe2baef29df14a655d172636d

SHA512
4bfa13f61a992761cce2920c99dd2a3d3afff805844c779aed285e07a83fb748bc070f2079c35bb5fcdf8061c13d6fafb01720399e9d0cf058f3794b371653c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\out\shell-integration\zdotdir\.zlogin

Filesize
733B

MD5
498fa00e91a9fe37cedc9b5e511a6e9d

SHA1
b1b42a359ac7d83d4371456473a6173b984a8928

SHA256
70a6a21f4cda70c2085948c2f97bcf1e29b85b66b092c2b9e5c5b2ed8b9c927c

SHA512
8a6ae4c4b51bda7cdf474f6bcd4782bf1c128c0f9d0746fa45384915a2e366f91573941976620441cc6ecb760dcb442a2694570a9ddf22a06eec6a41a336508e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\out\shell-integration\zdotdir\.zprofile

Filesize
842B

MD5
9b8bf92136721325ecc887b624943676

SHA1
ceb68be8fc6955dc268e1f3844e288e2cc794640

SHA256
ff8b48ec936885dcea4c32f7a8d8e39c8cd90708723b521f069d0ac2390a58da

SHA512
508f18e7fdb72554ed3630fdf823405bc0257ce9356aa4b033c0a432fc344c9baedea2aa1f957645ba6f7dc1bd76ebe73812664dd2e5da547b98d2bf82ea69ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\out\shell-integration\zdotdir\.zshenv

Filesize
730B

MD5
968ffcba6e5950f9b4fe48705968b821

SHA1
b0c2b6b73685da6c950fcc55c2cd427d5fd79687

SHA256
f024f51835431216592fb7a3092a0926c2aa04658cc26b27efd3269ae2bf6ae0

SHA512
80ac05ba339bee6479eafb3d153a8f8349ab91418c6376d174bad24782a2818160596e316e39158578a55fe785f06228ee0ec515212cb559a5c9aba6f992ac3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\app.asar.unpacked\out\shell-integration\zdotdir\.zshrc

Filesize
1KB

MD5
b10d2abd3e6ca0ccff68dda16850b853

SHA1
349fbeb9f23a3efed5eda1537ee7a42e94e59b66

SHA256
6a109949a6dd0135eb6c7c8d952839c9d769b96c14d75fdee0aa3b1bc77a124e

SHA512
e8c9d03e502f5e8aa97384f687b4697aa07d0837d70537e1370e1d5358a99b2be1fec383dea2f5c3e99c85f701627750aba4f9038707a34d50442159e87223fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\resources\elevate.exe

Filesize
125KB

MD5
a1bef2eb1cc365116a80ea26bd308ac0

SHA1
bc07d4a3ec1eb0562d26afe25d8b6ccdfc3527de

SHA256
df07b16e70a01ece44a5889aabe6de72b4bb16cc7af11ed9fb322783abeef64f

SHA512
ce136a61e9a6a6c9f8387b6729540a0cc00e621a76ea8b0c50f9237166bdca727aba3c5e8924d62c743686423f6ebf263bfac10d2c5eb5cb3cb2cd85bd1c7a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\snapshot_blob.bin

Filesize
410KB

MD5
c5d06bf7a12109e49dce962b6888f051

SHA1
63189d373271fd89079b4f55d035b7746f96ff00

SHA256
ece191beef3b53272a925c1f5e8c02a0dc78b00559799d27a0665fc480380b3c

SHA512
622854c9310ccd84dd100ced5eb3ba3d52f75dc68597cfb550b9b84e3798bbb90d39a41d3f9fa7b0fa58654e2ba0ac657d70b8dd89677126d39889abf9e0c008

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\v8_context_snapshot.bin

Filesize
710KB

MD5
4d582d568efb15b489a15be358d9a68f

SHA1
295393f0707d04ed60ebda8ea7c0297c411c7f33

SHA256
ea2ea0f97ac908fd127a423f505241ebf4acea0ba5d02635cae40f7cd9c2f464

SHA512
ed8a6af3d51904020abc8e8f3e734ccbf1663d8bd3c0f526e1d69ebfdf47b6061fcf3660b70239ba755f1273f6c608054d6dccd3721a4bcd81e7e9f3a3c7daf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\vk_swiftshader.dll

Filesize
4.8MB

MD5
78063ec6110108c74579751e27276989

SHA1
89a45e07df44bfb2802938efe1415a3d9e0297f8

SHA256
56809fc84c83b7b651014df670631399546e6c335fbb69ece77681cbf0163866

SHA512
2fdc6d61a7b12c432458b9d6a47487b294f3ab0cf70650958306bdc809bdfaf27241ace9970afd8b686edd4e4ba2bd5ef7cfd5ec69fe078805f467d66efee977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\7z-out\vulkan-1.dll

Filesize
858KB

MD5
7935f27952b085cd1298323b3905d4ed

SHA1
08ca6df7475ccf536178fef17114b6e945a03258

SHA256
7adaaeb870b6c3220527cfd971e75c22567d8f921a0737dc2574419b36cf8b4f

SHA512
775c33c56aa29854883e496c27dd8d3d1bbdf53612bec78cd8fccbc2625cc18d479629911590a7de36fad214b93e86ee17f0f67080732ccfd5412c0eb1dde8ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm7281.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Termius\IndexedDB\file__0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Termius\Network\Network Persistent State

Filesize
537B

MD5
215a43278e146ee50713a0fa805158a1

SHA1
de069696287dbd38faa39bc4b411ff913e7aa484

SHA256
53241fb62baa51b8f5e19e3782cedb1f0cbc4f65c1b317077ac363e580f67d88

SHA512
55cb27d5cde40db1bd568ddd95198124b7146189475e4ebfdf13a35dc681810a9d160eaa64f73d09f7f5eb7493beb2d778243c9e3ed15334942cc49a771e3b07

Download Submit
C:\Users\Admin\AppData\Roaming\Termius\Network\Network Persistent State~RFe58f0a4.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\Termius\Preferences

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\Termius\Preferences~RFe57e81e.TMP

Filesize
86B

MD5
d11dedf80b85d8d9be3fec6bb292f64b

SHA1
aab8783454819cd66ddf7871e887abdba138aef3

SHA256
8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

SHA512
6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

Download Submit
C:\Users\Admin\AppData\Roaming\Termius\sentry\scope_v2.json

Filesize
2KB

MD5
f2ada3924fd0c4a23a930c904ec11236

SHA1
2c24100c7ec994d28623739c370a20a4016048c0

SHA256
4fc03f7375cfa9d9563b08c4286c1943c83de48387248d5b70c376f2e726c3d6

SHA512
812bda404a07485b441f81f45b0a555615498ca5e9661bff4fb8c7d7711e83e319e3ecc261250638124165d9fb45164ccc3ba48472f723aa16ad9b03ecb8bab2

Download Submit
C:\Users\Admin\AppData\Roaming\Termius\sentry\scope_v2.json

Filesize
6KB

MD5
3820ad9bf21adb2e9273c87708a00593

SHA1
2363d055d26b0879d6df39cea8def242186526b3

SHA256
ac6a7aa8a9eccbc11a1e38110e41b7e51557560ab7a8d00ec247a6e3ee3ebb02

SHA512
47207adfa69f9896a0f78601ba679ab439884d376dc96aa705f96e0418fe579c9a258c22a5aefcf753407f90a5ae8450243de6a2c58f31bd73f5d467b3be3062

Download Submit
memory/2444-1606-0x000001CEEA530000-0x000001CEEA550000-memory.dmp

Filesize
128KB

Download
memory/2444-1615-0x000001C6E8000000-0x000001C6E992F000-memory.dmp

Filesize
25.2MB

Download
memory/2444-1608-0x000001CEEA940000-0x000001CEEA960000-memory.dmp

Filesize
128KB

Download
memory/2444-1604-0x000001CEEA570000-0x000001CEEA590000-memory.dmp

Filesize
128KB

Download
memory/4660-1534-0x000001EE40000000-0x000001EE4192F000-memory.dmp

Filesize
25.2MB

Download
memory/4660-1523-0x000001F642BC0000-0x000001F642BE0000-memory.dmp

Filesize
128KB

Download
memory/4660-1527-0x000001F6431A0000-0x000001F6431C0000-memory.dmp

Filesize
128KB

Download
memory/4660-1525-0x000001F642B80000-0x000001F642BA0000-memory.dmp

Filesize
128KB

Download
memory/4868-1565-0x0000011A28E40000-0x0000011A28E60000-memory.dmp

Filesize
128KB

Download
memory/4868-1567-0x0000011A29250000-0x0000011A29270000-memory.dmp

Filesize
128KB

Download
memory/4868-1576-0x0000011226400000-0x0000011227D2F000-memory.dmp

Filesize
25.2MB

Download
memory/4868-1562-0x0000011A28E80000-0x0000011A28EA0000-memory.dmp

Filesize
128KB

Download
memory/5028-1583-0x000002CA35290000-0x000002CA352B0000-memory.dmp

Filesize
128KB

Download
memory/5028-1586-0x000002CA35250000-0x000002CA35270000-memory.dmp

Filesize
128KB

Download
memory/5028-1588-0x000002CA35660000-0x000002CA35680000-memory.dmp

Filesize
128KB

Download
memory/5028-1597-0x000002C233000000-0x000002C23492F000-memory.dmp

Filesize
25.2MB

Download
memory/5464-1541-0x0000018AB4800000-0x0000018AB4820000-memory.dmp

Filesize
128KB

Download
memory/5464-1545-0x0000018AB4BD0000-0x0000018AB4BF0000-memory.dmp

Filesize
128KB

Download
memory/5464-1543-0x0000018AB47C0000-0x0000018AB47E0000-memory.dmp

Filesize
128KB

Download
memory/5464-1555-0x00000182B1A00000-0x00000182B332F000-memory.dmp

Filesize
25.2MB

Download
memory/5508-1355-0x00007FFECF790000-0x00007FFECF791000-memory.dmp

Filesize
4KB

Download
memory/5544-1628-0x00000197B8BD0000-0x00000197B8BD1000-memory.dmp

Filesize
4KB

Download
memory/5544-1626-0x00000197B8BD0000-0x00000197B8BD1000-memory.dmp

Filesize
4KB

Download
memory/5544-1627-0x00000197B8BD0000-0x00000197B8BD1000-memory.dmp

Filesize
4KB

Download
memory/5544-1632-0x00000197B8BD0000-0x00000197B8BD1000-memory.dmp

Filesize
4KB

Download
memory/5544-1633-0x00000197B8BD0000-0x00000197B8BD1000-memory.dmp

Filesize
4KB

Download
memory/5544-1635-0x00000197B8BD0000-0x00000197B8BD1000-memory.dmp

Filesize
4KB

Download
memory/5544-1634-0x00000197B8BD0000-0x00000197B8BD1000-memory.dmp

Filesize
4KB

Download
memory/5544-1637-0x00000197B8BD0000-0x00000197B8BD1000-memory.dmp

Filesize
4KB

Download
memory/5544-1636-0x00000197B8BD0000-0x00000197B8BD1000-memory.dmp

Filesize
4KB

Download
memory/5544-1638-0x00000197B8BD0000-0x00000197B8BD1000-memory.dmp

Filesize
4KB

Download