5293e722ecf4aa4b69f8b01bb782bf514c623ec63e22949410fcb938a1a3d8b0

Analysis

max time kernel
62s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Miro-setup.exe
Size

77.5MB
MD5

0a6a555b0e108417ac3aa45b80585bff
SHA1

7f3b07920258f9b9c356e8528d593a93fa5ab210
SHA256

5293e722ecf4aa4b69f8b01bb782bf514c623ec63e22949410fcb938a1a3d8b0
SHA512

c9e83d469cfe5e7e592a27b640f9a3c17684b9258f54edc69afcc15b70188efeba2455bfe28d5a44fecdb313b469b98cd542b72f67cf822c27deb16e09cade54
SSDEEP

1572864:AQ2um4UH03yOltL+o1IkqZRpjhQqRFRRHG5Yl6JVdX+KjHtTBxAenUGO/iUwkRed:AQTm4aMlx+o1VI5RFR5G5G6LFtB013Ez

Score

5^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Miro.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Miro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 7 IoCs

pid	Process
1080	Miro.exe
2164	Miro.exe
620	Miro.exe
4440	Miro.exe
3164	Miro.exe
1280	Miro.exe
5876	Miro.exe

Loads dropped DLL 19 IoCs

pid	Process
1048	Miro-setup.exe
1048	Miro-setup.exe
1048	Miro-setup.exe
1048	Miro-setup.exe
1048	Miro-setup.exe
1048	Miro-setup.exe
1048	Miro-setup.exe
1048	Miro-setup.exe
1080	Miro.exe
2164	Miro.exe
620	Miro.exe
4440	Miro.exe
620	Miro.exe
620	Miro.exe
620	Miro.exe
620	Miro.exe
3164	Miro.exe
1280	Miro.exe
5876	Miro.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3184	powershell.exe
216	powershell.exe
1612	powershell.exe
3112	powershell.exe
1044	powershell.exe
3460	powershell.exe
3232	powershell.exe
2100	powershell.exe
812	powershell.exe
4012	powershell.exe
216	powershell.exe
3760	powershell.exe
3136	powershell.exe
3664	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Miro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Miro.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Miro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Miro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Miro.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Miro.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Miro.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4544	tasklist.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\ = "URL:miroapp"	Miro.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\shell\open\command	Miro.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\shell	Miro.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\shell\open	Miro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\RealtimeBoard\\Miro.exe\" \"%1\""	Miro.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp	Miro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\URL Protocol	Miro.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
1048	Miro-setup.exe
1048	Miro-setup.exe
4544	tasklist.exe
4544	tasklist.exe
812	powershell.exe
812	powershell.exe
3460	powershell.exe
3460	powershell.exe
1044	powershell.exe
4012	powershell.exe
4012	powershell.exe
3184	powershell.exe
3184	powershell.exe
3136	powershell.exe
3136	powershell.exe
1044	powershell.exe
216	powershell.exe
216	powershell.exe
4012	powershell.exe
3184	powershell.exe
812	powershell.exe
1044	powershell.exe
3136	powershell.exe
3460	powershell.exe
216	powershell.exe
3760	powershell.exe
3760	powershell.exe
3232	powershell.exe
3232	powershell.exe
2100	powershell.exe
2100	powershell.exe
3112	powershell.exe
3112	powershell.exe
216	powershell.exe
216	powershell.exe
1612	powershell.exe
1612	powershell.exe
3664	powershell.exe
3664	powershell.exe
1612	powershell.exe
3232	powershell.exe
3112	powershell.exe
3760	powershell.exe
2100	powershell.exe
216	powershell.exe
3664	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	tasklist.exe
Token: SeSecurityPrivilege	1048	Miro-setup.exe
Token: SeShutdownPrivilege	1080	Miro.exe
Token: SeCreatePagefilePrivilege	1080	Miro.exe
Token: SeShutdownPrivilege	1080	Miro.exe
Token: SeCreatePagefilePrivilege	1080	Miro.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	812	powershell.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeShutdownPrivilege	1080	Miro.exe
Token: SeCreatePagefilePrivilege	1080	Miro.exe
Token: SeShutdownPrivilege	1080	Miro.exe
Token: SeCreatePagefilePrivilege	1080	Miro.exe
Token: SeIncreaseQuotaPrivilege	4012	powershell.exe
Token: SeSecurityPrivilege	4012	powershell.exe
Token: SeTakeOwnershipPrivilege	4012	powershell.exe
Token: SeLoadDriverPrivilege	4012	powershell.exe
Token: SeSystemProfilePrivilege	4012	powershell.exe
Token: SeSystemtimePrivilege	4012	powershell.exe
Token: SeProfSingleProcessPrivilege	4012	powershell.exe
Token: SeIncBasePriorityPrivilege	4012	powershell.exe
Token: SeCreatePagefilePrivilege	4012	powershell.exe
Token: SeBackupPrivilege	4012	powershell.exe
Token: SeRestorePrivilege	4012	powershell.exe
Token: SeShutdownPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeSystemEnvironmentPrivilege	4012	powershell.exe
Token: SeRemoteShutdownPrivilege	4012	powershell.exe
Token: SeUndockPrivilege	4012	powershell.exe
Token: SeManageVolumePrivilege	4012	powershell.exe
Token: 33	4012	powershell.exe
Token: 34	4012	powershell.exe
Token: 35	4012	powershell.exe
Token: 36	4012	powershell.exe
Token: SeShutdownPrivilege	1080	Miro.exe
Token: SeCreatePagefilePrivilege	1080	Miro.exe
Token: SeIncreaseQuotaPrivilege	3460	powershell.exe
Token: SeSecurityPrivilege	3460	powershell.exe
Token: SeTakeOwnershipPrivilege	3460	powershell.exe
Token: SeLoadDriverPrivilege	3460	powershell.exe
Token: SeSystemProfilePrivilege	3460	powershell.exe
Token: SeSystemtimePrivilege	3460	powershell.exe
Token: SeProfSingleProcessPrivilege	3460	powershell.exe
Token: SeIncBasePriorityPrivilege	3460	powershell.exe
Token: SeCreatePagefilePrivilege	3460	powershell.exe
Token: SeBackupPrivilege	3460	powershell.exe
Token: SeRestorePrivilege	3460	powershell.exe
Token: SeShutdownPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeSystemEnvironmentPrivilege	3460	powershell.exe
Token: SeRemoteShutdownPrivilege	3460	powershell.exe
Token: SeUndockPrivilege	3460	powershell.exe
Token: SeManageVolumePrivilege	3460	powershell.exe
Token: 33	3460	powershell.exe
Token: 34	3460	powershell.exe
Token: 35	3460	powershell.exe
Token: 36	3460	powershell.exe
Token: SeIncreaseQuotaPrivilege	3136	powershell.exe
Token: SeSecurityPrivilege	3136	powershell.exe
Token: SeTakeOwnershipPrivilege	3136	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1216	1048	Miro-setup.exe	87
PID 1048 wrote to memory of 1216	1048	Miro-setup.exe	87
PID 1048 wrote to memory of 1216	1048	Miro-setup.exe	87
PID 1216 wrote to memory of 4544	1216	cmd.exe	89
PID 1216 wrote to memory of 4544	1216	cmd.exe	89
PID 1216 wrote to memory of 4544	1216	cmd.exe	89
PID 1216 wrote to memory of 3516	1216	cmd.exe	90
PID 1216 wrote to memory of 3516	1216	cmd.exe	90
PID 1216 wrote to memory of 3516	1216	cmd.exe	90
PID 1080 wrote to memory of 3128	1080	Miro.exe	95
PID 1080 wrote to memory of 3128	1080	Miro.exe	95
PID 3128 wrote to memory of 4800	3128	cmd.exe	97
PID 3128 wrote to memory of 4800	3128	cmd.exe	97
PID 1080 wrote to memory of 2164	1080	Miro.exe	98
PID 1080 wrote to memory of 2164	1080	Miro.exe	98
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 620	1080	Miro.exe	100
PID 1080 wrote to memory of 4440	1080	Miro.exe	101
PID 1080 wrote to memory of 4440	1080	Miro.exe	101
PID 1080 wrote to memory of 216	1080	Miro.exe	126
PID 1080 wrote to memory of 216	1080	Miro.exe	126
PID 1080 wrote to memory of 3184	1080	Miro.exe	118
PID 1080 wrote to memory of 3184	1080	Miro.exe	118
PID 1080 wrote to memory of 3460	1080	Miro.exe	104
PID 1080 wrote to memory of 3460	1080	Miro.exe	104
PID 1080 wrote to memory of 3136	1080	Miro.exe	105
PID 1080 wrote to memory of 3136	1080	Miro.exe	105
PID 1080 wrote to memory of 1044	1080	Miro.exe	106
PID 1080 wrote to memory of 1044	1080	Miro.exe	106
PID 1080 wrote to memory of 4012	1080	Miro.exe	107
PID 1080 wrote to memory of 4012	1080	Miro.exe	107
PID 1080 wrote to memory of 812	1080	Miro.exe	108
PID 1080 wrote to memory of 812	1080	Miro.exe	108
PID 3164 wrote to memory of 3748	3164	Miro.exe	119
PID 3164 wrote to memory of 3748	3164	Miro.exe	119
PID 3748 wrote to memory of 2184	3748	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\Miro-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Miro-setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Miro.exe" | %SYSTEMROOT%\System32\find.exe "Miro.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Miro.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\System32\find.exe "Miro.exe"
    3⤵
    PID:3516

C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe
"C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4800
- C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe
  C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\RealtimeBoard /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\RealtimeBoard\Crashpad --url=https://f.a.k/e --annotation=_productName=RealtimeBoard --annotation=_version=0.8.68 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=30.0.2 --initial-client-data=0x52c,0x530,0x534,0x520,0x538,0x7ff7cd950e58,0x7ff7cd950e64,0x7ff7cd950e70
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2164
- C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe
  "C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\RealtimeBoard" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,7879451130607945681,8857632549637561991,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:620
- C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe
  "C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\RealtimeBoard" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2260,i,7879451130607945681,8857632549637561991,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:812
- C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe
  "C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\RealtimeBoard" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-path="C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\resources\app.asar" --no-sandbox --no-zygote --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3080,i,7879451130607945681,8857632549637561991,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3664

C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe
"C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2184
- C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe
  C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\Miro.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\RealtimeBoard /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\RealtimeBoard\Crashpad --url=https://f.a.k/e --annotation=_productName=RealtimeBoard --annotation=_version=0.8.68 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=30.0.2 --initial-client-data=0x514,0x518,0x51c,0x508,0x520,0x7ff7cd950e58,0x7ff7cd950e64,0x7ff7cd950e70
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1280

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
a3385233376b5bf6c729fb3ddb8c6817

SHA1
0c3c990a34852ec9a17a4a84544f99e53a542d5f

SHA256
5841e188ddb62a357fe73d8f85f7f0bada85efb7f8e61b1fd67b8cedccd949f4

SHA512
90d51eef6b79c194f1840a8b8b1e03c01033415cb272f276475ae2c4e9376241cc092037adde309c8271ca0f7d56f9c0016c84ccc6184c690391b2009650b4d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
d13eefbd59b951097dc27c761d70e74e

SHA1
b73aae420fab6c7fc50960c0dc7d900c6072f361

SHA256
ea7636f1a16973b38d191d03c07376753e7586f4dd0c23623e914879fed997ca

SHA512
aceb5674f992b3730753dde54dae8dbf1297ad2ce169a5c34afb2799a620adb4c74301bcf9f7154537610ec981f040592989209ab663d4eda9e920830cfcf1dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
1f4278ba71f1710e0f1e59b37c7805df

SHA1
240bdac9b823d58213cf23a75067b6fdf12e722a

SHA256
6e7f70d1f51bfedbf3573c1f800dc64406f6917609076d95be734f4db15d6d24

SHA512
3e05f47f8085340986e785a7727b92d63360d49ae4dc118c6ed6cc70cb8dac52a2e86688eec46f62cd43b486c91a013767c2a4b52a13394db8ba0c50842bf265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
c1de2a85083da279df630b6f90d204ae

SHA1
3816ba30f841ba3fbccc4b2728424a85d06507ee

SHA256
5f08805fd093b57d973b27a6de1c68d3c90fdd44584ffb31b97e658365421237

SHA512
824898532025ad8be2ba606d3f1cf97d0895007f78bd909378ec53d5feed17466d43e2c5e79ebba0e640254ca7ca0ed96a39f4e465e3531eb87c64173a5a9d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
a16210cfc4016ae2ef5dae77133553dd

SHA1
aa462c400bd6d93e354ea4c2ea8680ab86c75dfd

SHA256
741aef95b75bb7a7da1453d5d414e23cd949f5dcec7b71b3722fe19c1d4ee2f3

SHA512
b5e991448c0afc43b8742e6008b645c6805ac8272ec1182b9d5c5344136ec432c88189a8761646048f9759da969f6e61a49c5580952dd645fb60da434ee6ad99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
2f87410b0d834a14ceff69e18946d066

SHA1
f2ec80550202d493db61806693439a57b76634f3

SHA256
5422bc17b852ad463110de0db9b59ffa4219e065d3e2843618d6ebbd14273c65

SHA512
a313702f22450ceff0a1d7f890b0c16cf667dbcd668dbafa6dbecd0791236c0bc68e834d12113cc75352365c2a2b6cfcf30b6ef7c97ea53ed135da50de389db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
28c65370f12e84b734af87ad491ea257

SHA1
402d3a8203115f1365d48fa72daf0a56e14d8a08

SHA256
4ea873fb3d77a2f8eefae82c943f621f16723516e181bde133568f8f0c91290c

SHA512
56eb34162b0a39da4aaf66aad35ef355a7709982b5060792e3b4849c36650725176e927815537ec58e7ddf0fb1763066b203d6b7f9d1b3dd2c8bc091c0c850cc

Download Submit
C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\chrome_100_percent.pak

Filesize
146KB

MD5
6c2827fe702f454c8452a72ea0faf53c

SHA1
881f297efcbabfa52dd4cfe5bd2433a5568cc564

SHA256
2fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663

SHA512
5619ad3fca8ea51b24ea759f42685c8dc7769dd3b8774d8be1917e0a25fa17e8a544f6882617b4faa63c6c4f29844b515d07db965c8ea50d5d491cdda7281fc5

Download Submit
C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\locales\gu.pak

Filesize
1.1MB

MD5
0a481f022726165de676a6b9255932dc

SHA1
8643ad492e7e4424b43639341a641d5c21dd7709

SHA256
08c081c986d40cf5d7a24e94e2ae9651bcd8f54a17c1f0830d473ed92ff01943

SHA512
b825774bfcc80c6af373bca00d5a8b045dec24e426f8da2b224794299203bd578189d15eef7aff57b450c56cd1bf8c6bdc464300bc31224fa8a79d9b981d53b3

Download Submit
C:\Users\Admin\AppData\Local\Programs\RealtimeBoard\locales\ru.pak

Filesize
902KB

MD5
605863f501ec3f27134c2a47ed8a75da

SHA1
9234aa2ee07ec6a229d46b1f2830b79b65bb1b29

SHA256
9fc47ea38c6b53d5ba366405c232624550884c691395f0200e3fd98cf7711b55

SHA512
c8e3c5dcd303bcaa61ca8ad7b6002c907a0a9591e9892b11adbcafa9ba6e9fbde6baa41ac0b3c103c4c34dc0119fb8a3581887ccf10281b36fa591670f649bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qwg5p3jo.4ui.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\LICENSES.chromium.html

Filesize
9.8MB

MD5
b620990ddbd932d6475152e5a833860e

SHA1
70de0b3d7ffa77900f685c1788b32997a61ec386

SHA256
921452a09f92f10da4cfef0521acd6ee6c689c630661ed35189e793de2c99fc5

SHA512
ba84b5e6281dd64d5da41d0db35942b6c0b1ee6b47d24dedd5006be40b2d22d90f58dc653e17893347900fb1bfcd37b0f2fff5b532175ccacc3b63d98fe42ac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\Miro - formerly RealtimeBoard.exe

Filesize
123KB

MD5
5a5423201c13e51b4c7132122ec27795

SHA1
2eef19745b6c275b5b7df18e4ee2567bfe5d53b4

SHA256
23f0b110cc2e04a17773651ade934d2c28d5596f66a285f0a39fd1bf04a46b1e

SHA512
48ddd21aa1cc75795dc429d7562df52d408c724ab33c18ffa8e36b182fd43ed0a69fd6644b3615e679a5b10f077263c2512ac68ca81021d774cfba4f5a4d2230

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\RealtimeBoard.exe

Filesize
136KB

MD5
40a78bf9882e1d7b99352fdda1eef11a

SHA1
ed8f7830235a5be40d5af83fd55415b29b517f3a

SHA256
f3516fc05db7effe77ed049b0982018184e53a60315c773dbb57c25ceff6f094

SHA512
0ed063f74efa1b9436568b21132ff66118013a5444bc2c453e1d5b478709ac1495447b2b0dd009e35ba28e0faa98b7e83965df9e1c2ca2b34a6f45a5c55d5240

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\chrome_200_percent.pak

Filesize
220KB

MD5
77088f98a0f7ea522795baec5c930d03

SHA1
9b272f152e19c478fcbd7eacf7356c3d601350ed

SHA256
83d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d

SHA512
5b19115422d3133e81f17eedbacee4c8e140970120419d6bbfe0e99cf5528d513eea6583548fa8a6259b260d73fab77758ad95137b61fe9056101dd5772e8f4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
45caeef18351b2c91b99f167ba6a5e75

SHA1
e0c1c3f563ba6cb3be19729d8b79dff384ae7a88

SHA256
b04ca317886ae9a03a3bbacbf7e322802451666a28732eec3d3c59ffbe8d2fe8

SHA512
810a45a8fe9f653a1f60c3092b48cfdba318f6acb6796452ea5eb859f0996bc2e5f3dc1aefdca736c3b086c2b1bcc02234ef7b267a2d434b9b4b34e0f3ed9332

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\ffmpeg.dll

Filesize
2.6MB

MD5
9f2c07fa1787c0ae81e5f6b2645edaf5

SHA1
690595a4ae4454c6d1bc23a8b7c77d175b389bec

SHA256
6ce2779f7d606de4c2ebf0de20953881c07d00929f0ab76350def9a31240bdd7

SHA512
5d1438e240513c01b1cc5cd5cc3eff71c8a316b4d3b3d86377e26e1d87c243e19d285c40f560028a72a90b69ee7064a1008fed8277cb776ff5c93a42c6f53efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\icudtl.dat

Filesize
10.2MB

MD5
74bded81ce10a426df54da39cfa132ff

SHA1
eb26bcc7d24be42bd8cfbded53bd62d605989bbf

SHA256
7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

SHA512
bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\libEGL.dll

Filesize
479KB

MD5
f118bee403f9e77aea406b207b2a378b

SHA1
5adb967e49e43c172351f477ebf162f7aa528a7c

SHA256
98db02768b742302184377e3b828f4698308d8c885771354b8987beb1966b4cb

SHA512
137ae0cb1685135658fc9628d3460da2fc6ddf322d788cad50c151d747d0bbae335c99fe8c8b52d8fa8825cd31ca5c1cab365dc5377216aae8014dafd6c887a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\libGLESv2.dll

Filesize
7.6MB

MD5
31b2300bb6488ebb5647d1dc165a1d70

SHA1
2379b67dcb644cc42208cf11a1f3741cd89d8b80

SHA256
37d323a84426c1714c59f325b44fd99101e814c37ee6dca2dd8b72fe75d0a699

SHA512
215ad3e8c818e994772e7668d1557da0f9d8080514b5e08aa24193c04c044ea80683e3e3e0abfa765be970d49123ab1a0375539b8bf6a0a553305f889adfe4ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\af.pak

Filesize
482KB

MD5
e0aba0f324d8948e41e5a65003dafb29

SHA1
3d76b20e9885b283f29c09d5c4e92ec8bf8bd8dc

SHA256
f9820a9f78171f6baf8028f712b15fa4fcf6ffa4f1ef013efb32261e58403cc2

SHA512
90bbad88e7501f4706d42b6971bb9a5798b5771839093fea5c77529d1d24419694cd85628c4075ca3d2a098d586b6e0d2a45f5cf7d1d2e345f43df68958b3f8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\am.pak

Filesize
782KB

MD5
7c7425912d66c50dcc17f82da09965ec

SHA1
1cee402b8598ba5e31e97dec539731c2f38345f9

SHA256
91ea40cc15f4a35b32dcb60e26399b0fa9f98181241a19fbff0ed72909c8a738

SHA512
5c89ea0656cab74ba484544f614c2c2a38f288045b9dcd2c9f591e922a13302f9e5d958a583166f35dc046fbb49d49cdf11d3750da14b693f1931b7b4e2954af

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\ar.pak

Filesize
855KB

MD5
bb288e6e3e4cedf0a49330dc073d97ce

SHA1
47f12884344d6305310f3c0cb517368c4e46c8c5

SHA256
d7f9de16fad5b9ccee32332f6e51b29fbbdc978d7ed9cc9f9cb1fd43bfd82d00

SHA512
644ac70599808e66ee429302fbe18d95f0942b3ad14da5f193d289c947024211cd098e01d04299753edf9384c0f4984f29dccfc5aa0b19cce6f4d786caf3d3ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\bg.pak

Filesize
892KB

MD5
b34355461437b583d08f28924a8b33da

SHA1
7c48e72b4ca432ef4b37d4c6adbc20b92456ac7e

SHA256
3daa214ff66e4632b26fb1f2a609be20a44da1147eccc69a2f4a6364a9a889e9

SHA512
2a006d2415334b524a143ba1fe2ffb5c95be6c709ac01a421aa25d7102cb598a40b1be044734ad548946b76da9e7c20ee4d912dd28cf8392ea63be139966f02d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\bn.pak

Filesize
1.1MB

MD5
3696d04ffb836fb30c17c1ce3b636239

SHA1
0a21f8fd6dbe94646907447485bf07b00de8c44d

SHA256
d06b5502f0f9387c02ca835ecae622439c84ad5291f97a0c8abfbec80fffa86e

SHA512
a851cc4e1e1bd9b97268a6e35c3945b07b3051bb93d1259a5e33c054fe6af55828726c0123eb2e40a7c276ecab10300936c1a1d62ce6fda056fb9a27128c17d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\ca.pak

Filesize
542KB

MD5
7aa46e237d343e988a2ac416352971dd

SHA1
84f866551826bcf2d77685d8aea794f618e7ce26

SHA256
7601315f91898e69c356b938bb493e7a231c371b6c60d90910e2fb7c2d8efa42

SHA512
533e5cfea56915260911e7929ffce782783fd728e18d24e0fa46a3b4e975f301c3aea0a3d5903a631a5ec9082ffa4584db1650e605527957aabf74ff23148617

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\cs.pak

Filesize
558KB

MD5
013e4ff210f37a44c09d8ba942af6831

SHA1
c30dab2ec9d31da0b4aecd0d255d577af510a72e

SHA256
d221d61edebd3d8b99f14ce7d39d71c5e758ef6208c9abeaf11b7385cb36e94c

SHA512
f695d9d42aefb48c563dbff8721aba51accb206952c04f84545fa1e59f1d3de6576ba01dd1a47035dfe0e5269e579b724489e38dbae069c54002e22a5197154d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\da.pak

Filesize
505KB

MD5
77c28e3896434caadace50a9e816cda6

SHA1
69cf3956825ad554d1154d5e43530b07494dca19

SHA256
ca044e1a6e5d5f7e9195912d299d4225c1da24db09cf10b21f0eebaa7e68b585

SHA512
bd6206155838ea27cb68c5e0585bbb2623e3eab590819bd15f0dd3378b7e072819434d60e82ed4afdb415640ba50d5dee9eb9d3fde45babbaceb23445c3b8cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\de.pak

Filesize
539KB

MD5
d0aaa50e78a9c5670f3b0cbcec86e16e

SHA1
057a2c7c170c803906a0b4042ef8ab47fdf01ab7

SHA256
1916d605e3c6ad3c7076f9fe4d4f15868581a3a815170fa060e33bde4e8322d0

SHA512
20a4fcdb47bb5d2e59972e3e71312c5de28d2f3756976663234784b2a68b3d8c075ba6cdbfa1edd0d63d905e40a2e717ca378b0318143c2c35331bec3be45290

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\el.pak

Filesize
979KB

MD5
ab5b4fd6878a91a567a049754c4a3966

SHA1
d7632069678b3c714349c26361a24b2aabdd7a1f

SHA256
fc09b994efedd696d5596f5660082135f7c76fc503fac2bcde7a96d15d3fbb18

SHA512
162f099335767f7d6ec25d825c04d9e7ceb794894202a20a5272e0685f36af289e7c4a25c2922b868eb617e96702dc2ca0affa6597e58273969437ec0d48d025

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\en-GB.pak

Filesize
439KB

MD5
8886830c3360f060a991ab6a91acc19a

SHA1
f67e0855b6c585f89bd0f9b0d11810dc285506ba

SHA256
52484d0d97bd50263172d166b8135fa7c6f742146c41b9c8abf201c7ab130b06

SHA512
f5816d6cdfebde7b51e638af707069fa792631a9e6a6f075b408a7e02207d05e6bdf7d60a90abaac178424aa37d0f4a71b9726b1370eecd23ec02f834cf4f861

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\en-US.pak

Filesize
443KB

MD5
91bc201d9c29a8c701a513e4239be26d

SHA1
cfcc8a2030c57af17d481dc4c5432ec9403a1aa9

SHA256
68ef74342ede5098c3ccedb81830e406219cba1fbb5ce96b707a83efb1f90331

SHA512
1bfae810326d4da4a50d6837fba9dea84548f4c60208d9af2b5456e42e090f68fc78002db6f459373d1045853211a93ef4a144c7a98e5ab6b31ff64694340925

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\es-419.pak

Filesize
534KB

MD5
991edc3432694c74e966e7df4b5d4e19

SHA1
a88cb86e11040085a0701489e8a69e20d6de6f34

SHA256
5023751ba74f9f72132538636f413e1e8f0f0f91c1429223e183bb51580cc61e

SHA512
9412053ba4edb5867a2f375f6878dda1863e1ac3c60a37ddbc070e3652beade597cb9b157525efabc6c11c549ae3ca41642d880aa00ecda8f1ddb7dd88a60bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\es.pak

Filesize
534KB

MD5
1b3dcb0dab293de0ecb59817a80aafdd

SHA1
e166ac151901e8a577429a12ba776ce6e61cf95f

SHA256
fe6d1694bb52c240974107a6ee12cbb34b0c1c517147c7e57d5177b7851bcf0d

SHA512
fa5fef631b451bb97d17ca892e5ce1997f9c7227faf33feb3dc5fe1b8684b598c292ecc48977421f25a16b3972f7463a0001c579fc81b6a07d24a04b50b73d08

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\et.pak

Filesize
485KB

MD5
679dfe55bdfeb336528eb99134ea3a01

SHA1
4dc733f8711c9ecc83f144511aa08663acefda48

SHA256
ac9c41076623bd4323ac23644a28f259240eb8765ff357bfb8c9ae46bffafb25

SHA512
fb196443e42e120e8cd0dd68494851b1f164dcbe55507f440d767d96731ab459f0f6a59f8ce7adc9f4e97eee83fdd3b81c7638f9191f0df1444123aab9aecd15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\fa.pak

Filesize
795KB

MD5
b25c1b7195e74e3781c9ce39dc55008c

SHA1
bcc3a5517c8d3ffcdaabc3f5cd25797e8529681a

SHA256
2106410be2ba638660b3b4511ed162f33e68a812c348998ee5f540e31382ea94

SHA512
0354914fb172a047db6284a35cc287632cff6aa2195e57109798b419043113e9605935ed74d4ddba0dac4cb8d7389b60638d946746646a652a410c4b6cff1f0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\fi.pak

Filesize
495KB

MD5
2833baac54fb16bf38498f684fdd6cb8

SHA1
068070bebbcdc3ff31508d8ebaacfbb2d735cdeb

SHA256
958537c09081d179e33363c71403765334a1f3018cb81b776000db4e46ce4818

SHA512
dc95b2e0f9fc91c96a6cf2d776a1a4d86f8acf7ba4fccab68236b62e76436adf181b62957d00fecf3a3c39546076aa45de35da3757f9fba3baf565d0bb16f1be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\fil.pak

Filesize
560KB

MD5
d41b58e5e4c89b529f0dbd1e759d96dd

SHA1
16879cc60df8100c0161ca41e3cd4ea563d3ebd2

SHA256
e39e73ee60f025fa2df7ce7740b9d7ea127a02ceaabef20782788d0921f19ce4

SHA512
896fdd469b114e4d11357b68bd131a6324f863441fdd9c581336a7833d5c3a204415d300b5f6b6479fa79b888ff1bf4c8c8aefb0d2ba625ce5b683420b842a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\fr.pak

Filesize
577KB

MD5
6a111b7a98975869335cab57a60dfbc0

SHA1
514bd02e3410373719671103afcd2a264d50c367

SHA256
c8cae1c8c1f609bc076d4a1591c0f0023feb9b084a29151dd171d1f389ebfb3c

SHA512
24914c9cc9f8d63c335c71016acc98502e1fc201e90a6d5fff7bfe1ecdaf6328a5a40942d6a3979e2a696dedf224a54601b23936c68ba956382a6a63338b38dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\he.pak

Filesize
696KB

MD5
cebb10380c6838cbf903bf0314baab2d

SHA1
bb0ae7686d0453481c8676cedd56b62808814687

SHA256
9ea24b2b7cecf82b681aeb7d2c4bd07ec0533c518c2d98f4962ed2a369139e0a

SHA512
6692a9e0bf34dad164af52bdfb65fd50e012199ba896ed581b0f54ee2dd5cd9555b09ddcb496b1eb8e21f8177ea4ef849ba5f627112f0e2849fc5d67bbd846a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\hi.pak

Filesize
1.2MB

MD5
cfd2ca80bac09e9bc893c499d2cc6a35

SHA1
526a15772c2f0eb467ef2c8435317f923f89563d

SHA256
58c4998d749792af709d3af03c0ca9a315244d20711a6ee1132f42c73a2d752b

SHA512
cf33a6649dedbe80ab0a5bc8d954f13cca4d97e07a0b95c97dd1a703b89919a20fd9897b6b3a9be1d16f00e47bc3c8a4489d56d40509d198d6ac830de3513173

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\hr.pak

Filesize
538KB

MD5
cfd9b27f4c233ad596c69c85c6d32d49

SHA1
ed9725a20075c776810f01d2bbeb719e7765f3fd

SHA256
0fc49dde53bd7c3a16e7cf350fe2c6cfb68cd10de840ddccf3de0cb3f9e2c2c9

SHA512
973873a78b52fe90e238de5c1bd07d90233413f7fe83ca808404118217f8fb716cd463c9a69b256ecb1e93b8f6e7f7627d9f22919dbb3615d4a94ef9944b4f9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\hu.pak

Filesize
581KB

MD5
dc1ede2e069859baa2c010de651d1ad4

SHA1
5e1a985cfb153fda0d517bb3b380b383e8866435

SHA256
1487785efc79acb2a21c082b35981f36bf76efa3fb2643f6ef0b038c2c3fdf64

SHA512
c0a2c994317ed596a7106e78f601c3103071afc772d1f83629ed776261d23382ee95fce928d4985da3c8ed0e817b8348d3b3a2dda0755528ce3453ea4807de9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\id.pak

Filesize
478KB

MD5
dcf23a6c90db0ee1da2325913d0683b1

SHA1
5de1d97d782d0a5a2e8b4bda839e32ec7487d52c

SHA256
4663cda44174c163b4734dcc65b554b6238dc38b807d569a392d23a1e5398078

SHA512
21099dc6e5abdbf547179a6eda5db08936893fd573c994c5d420cda55ef892bec7474f5da16e0d27b6fd22390797a65ce60a7b2203f7b5f16fea7ed0632542e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\it.pak

Filesize
527KB

MD5
e40208d0d39e3cec19d9a4beb90f0a10

SHA1
26b409b0c1c80b611d49625eaae99e7f648dc4c1

SHA256
a3a4443e70e3403caa2f79003178b2f639e13f4fcc6ae73538650cc83f60470d

SHA512
b2d9614428bf0d2c00b6bbfcd29a32f42a32041c16e18b317516c50507b0a4df8950ab5f17ab5c40ca13d0a52d31162a2690d7684a9b8162c5d84633387ab109

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\ja.pak

Filesize
644KB

MD5
c9394f5bb135e93822c845679b423863

SHA1
622b1ac009bdb4c286cdedb88931e45e957edd0f

SHA256
90a95f5b14f4508d0e4b2df222e18e7f354c1452e597cecff851049b3e0f7747

SHA512
cb84a67c93c0e82f445e6a51a3aa00c4e6b23ac0ff7d8777c061dc449a79ab0bcc900c43d387a76fb8e7bbecbce3fc2cd702368753b9db1b5d68dc4010a20470

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\kn.pak

Filesize
1.3MB

MD5
afacba905143c5bda920c3a50c99de32

SHA1
25a85e575ed938de7f0801e1e435b084252bb600

SHA256
4225b47182082590dc73ac1950d9f12b1cc618e308937a0fc91fb9b475b2e81e

SHA512
e0884685e13ef6f734101d187e4b495a9f8b51aabf6ab345b2eda268c820b624b966357ee747b8367f68744bad700de07d3d7b97a2df7a7fb780c03ee7d7f87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\ko.pak

Filesize
544KB

MD5
d8f502d6515295b0436bda0e4f2a6f4f

SHA1
b08d80f4a1580ee203254e514dac2a07dfc4d832

SHA256
a8189c7ad331692e5af321461f1a1f77e97f6c58ea1d1a72c66564f0241ec6f0

SHA512
ebef4ca22c9e068ec3b282709996bb1c0cee157a6bd39e25617d563bf06f3f71f3615d8e412bca17da343765ec86df73fe545f31511842150551a8159707737d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\lt.pak

Filesize
583KB

MD5
224631c09ef808daf951e013a555f36f

SHA1
23354e7b6eda0221e4827e1642a3d87435ec8b93

SHA256
f07c67afcc3b39e992ac423c37c616c48af3111aeee633000f9bbecd62a3f779

SHA512
45455a420962281254bd28606b02e7937302dfb5380d6f7baa0271e7f8749ce68b068d5efa3609d89f35bb89d744660262b30d6af8abc906db7539b0f5d8e9ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\lv.pak

Filesize
582KB

MD5
93772ce096cffaf7de88f2bfadec2df1

SHA1
630d20a94f54f5052950ae86d3569d4f4214ff6b

SHA256
b82fd6d57186a145f2e234bc941c5e326e7b141b2a29d6f915e6d18782492052

SHA512
bd03739b14d38731fb3b6602ad4d4d5c8914b13b4be4bbcdd27fab8e170afda8c56030d59db6bf5c1daeb11f3f198cbee68d4812e997480afab88305ddaf8efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\ml.pak

Filesize
1.3MB

MD5
80e7c4c0dbeb5b3cc9bd7d31f84b8b03

SHA1
c6016cd389cae9c78d51c7c4c32659ad1dda3990

SHA256
197f05ed66ed75f5675cd6a3ee8d8671840913e4ffcd5a72ed2b48739d0d6853

SHA512
c23f3e0e11bbce12752ea71e12b5d00e1980e723aeec158c5aff35e1acc41386a8c924eedcd6f0daaa012016edbc3c1a8718a1fcf107a2169353beab63d44b22

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\mr.pak

Filesize
1.1MB

MD5
66bc5765bb04e9196404c3a7db50d695

SHA1
0b71664f624f1ff530c58dd167d90c1dde181b6f

SHA256
675b32ef4ad9f8f90bc5620461bbf2a9e2a4d85b23f2ebe10cc38910af09676c

SHA512
761f7cfc7ca643e9af2b0edfc6133922c0e9c5961ce16f3f084c7cd38610e3a0c3e57bf7a38dc144fb85ea8e4a0cf6ae184fde2bb24039e6d094dc7bcc1ffec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\ms.pak

Filesize
502KB

MD5
5ce52ff3464ecefd97e801fc9ef5ab90

SHA1
d4182e762c2c6ae9e63a12ba1f5832923ea89123

SHA256
34afd2ad5529456f72d51b2b57f32a0103e0c17bf8e1a4f0f9ba65e56409b82b

SHA512
a18f8f9d9a2796406ce5f71a64c51de483724de1536d55e2beb769f654eef887f93f4b180fdb45fcb13d5a4bae52b4f4569b7c8210cf63011e62147efa146845

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\nb.pak

Filesize
487KB

MD5
b4870aa31838e8d61d1b7bc6889c29cd

SHA1
bc09a0b3657a7c22d0c2ca31753270180a2ee558

SHA256
4989ed047eb9cae91186d93dc0c73674cccb83764d3a00347323124b1fa44546

SHA512
8c87da2fc4d882712b130ba4aaff1a8f344ad9b0e3ce86d631d2bceafae2d70feb4f78312e78ee7e31cf00f0c8954acff3113d107fd985cfe0089fa6e0de266a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\nl.pak

Filesize
503KB

MD5
a8febfbf6a24982e920701fa304a8703

SHA1
ed01820d718512b2d2be282146553f6e5ae3542b

SHA256
2a9976d4efcfdf3d98de3e61ef32b6404e9d59182f0fa48f487c059d81415d3b

SHA512
25ac260f469084f2816891cd93cdd1aa20511c5e9c307cb59231a63242d521cd9c55217079358ca123b71eaca2e103877c5c4ff4661033ad183e82b762108b4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\pl.pak

Filesize
561KB

MD5
8448a71e89baa0d5cf57d047c99fab15

SHA1
8d7094b03274152fb74af048d3136710cd98c351

SHA256
9da6c8e6e1876031154859ce0bf98de5b781963e8ace134a93b806dd3b550952

SHA512
821539200b930ee70f85afdb0cb35f7f8ef8adc412a1113bbe36e3a23d11ebc468872116d1991afda8685576a1322449464d91763dca694cd188d8b97c27733e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\pt-BR.pak

Filesize
527KB

MD5
caf865325ef57ef339ccabf491aab747

SHA1
288e5c2c5ea161ee57a5e2b6b7b35b9ddc82bdea

SHA256
8c0b098e42a851810cdea2b5f158304d3eff9115b1cddf3b7a5287873f59ad80

SHA512
d7c38b2defb71536fcf5897a7498aca63abdf15322d4d0c6a99c0ecdae7753a200d649e0cc0020a3e5c8fc4e3eca65f9173e8d4fdf0d17cdf9aa7e3e4a28b3f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\pt-PT.pak

Filesize
530KB

MD5
51a01fd44f6c2c72a7d079e42b70837b

SHA1
b13d8676b926e24c6ad125a15aafe62644e74e63

SHA256
4b873898211e03c12e51d31f83591887fb2b5d81ec32f1ff6a7f0a770968ebff

SHA512
ea90da48b73673c8174e3592736f1a1d65e438669e09d06f75cb5d8f1ef677348735668a318cb98567c5e0980660c71eef0e81eeb4d00b2193fe4db67943ca7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\ro.pak

Filesize
549KB

MD5
e099cf5248456b94fdc75a5492bbf224

SHA1
e44fa85c2a258d2e907ae10836802bce3cc49cfd

SHA256
9b7326016e88b5eba6676ab171afe6360e26b5360650d7782a593423dff4dba8

SHA512
e190fc5b40ffdb3d7801519501abf2a9184c151f22f813f5b3d29a8d6df05f98642dc88f2d58e79c1b5dbbb7a7c4e15ef52f64d5777a37be4e99177b0a9c1f9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\sk.pak

Filesize
566KB

MD5
a0ac2c325c81d91405dfd1d42134e1fa

SHA1
84fc63d68658de482cac0cffb71bb60e280a2874

SHA256
35cc95d9745314c792564044c1e7f2df7819bcd43784064a18ccac3aa6ad0cec

SHA512
e15b5bbe50b71f211578a04021aa77c3a5a2ffc19b454195a83865b953023bbfd220e0bd49d5589980f46ae9f91b9ad4e8edf7ca78dbd13fce2995b218956a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\sl.pak

Filesize
544KB

MD5
d50671f241d8641d15242473782024bb

SHA1
9ec07351485e80ea2e37504597a29e4bea402cd3

SHA256
829010e4586b3cfae845a9c0ef8a704d79e328f2bb22537af635fbf513cfb435

SHA512
cacc76c5d2c5e06e378df907a8bc0d1e4fac1c7fa1022fd3e57fe3ac14bcae7da930e87639e922055751acbe2d03d2111517086183c1532e771687b163456bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\sr.pak

Filesize
839KB

MD5
2fa80f4dab2c71d3944459e401f31082

SHA1
68775501257378f5b6f46b241687ad4f31df54bf

SHA256
5fc5c977b8dbbda4331944a5b994dc4a4aa5ae3650d93c2caff31c6f5437073c

SHA512
78611b9c8e755ef1128b06e7b97f8daab1af62465fc4f237064b5dfe1402d3e9ee10f191f832beff11798770a66bd2279b4700c7caed931c1095234dd2564236

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\sv.pak

Filesize
489KB

MD5
c5b0a69fc0c1214bf5a5d181818272f3

SHA1
464e3295074d722c491e6960641a114498792e31

SHA256
c10f1a4d0b5b262e8edcdd7d49977b780ccd7ce73e37a678e05f7769f150a15d

SHA512
df744bae50e358d4d0ca3e11fecad0b23f8dc3e7c072f2a3fc0220be17e08dcebfaad55c88f82b9a8d7ad16ef881743b51a364a2e0dd97c7d3f2da080436cdfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\sw.pak

Filesize
515KB

MD5
728705c2c748edbc0c77f4025a09189b

SHA1
25b7df79cce45939df432b652d7d3dc4bb0b9a2f

SHA256
a5181d0221fc843e8795b5f3d588c029e9cfb28b6e937506cc721c9ecba0f673

SHA512
b4b59bf09fbc600e2ba9c24b9e946bc565e73a9a49d1bb2175c9ac9b9176bd73e113796c6bc6013c4aa927c70d0b6633983cfe482421cdeae046c9e79347e221

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\ta.pak

Filesize
1.3MB

MD5
763e64d272ded67ac43b4b09bce87184

SHA1
774119e4b10dfbb3ad50d332a852b6140d0cf937

SHA256
0072b0978c7a939cef05213c05aa8083f7f7694ba5f3e1adf300307e446d3b76

SHA512
70c2d752d09d0eee825c8244cfdcf8508f82ed34814cc388bb8649789b6bc59df01826e3792acb2757440af6e2ec26fed02f6e23308e1e618c0dc53d6c24d08f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\te.pak

Filesize
1.2MB

MD5
079180380426e20d31f65817435470a8

SHA1
8e0a19a8f2e1de97b82853643c39339065da281e

SHA256
6d74738dad050b21b1be46b125d82d91950a7d970de87f987b912bd1dd334d94

SHA512
260a78c9b178477af61bd4744714dc1d1d97adb636ccd349f50f76d99b10a6cabdef682cd966bd88d598790ced0a3707848e05ed0fc1406ddfb815350940961e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\th.pak

Filesize
1.0MB

MD5
392ff26334fa520b44eb686b75bc0a0b

SHA1
9ee257f80a96c750d4220c860fb06716dcb042f4

SHA256
0858fbd2fe2e10c0f39cc7dd3dd3e2561f97e82eef129f3e2eba5396521aa780

SHA512
1e17c70d52fe947f4e81b0c342441fbc35b20ae7846170805d41b6aced1783496b165e6aab13c9154b7dcbd2d65f08e5fb0369eebc20af70537f6701924f61a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\tr.pak

Filesize
527KB

MD5
12d241d54dbd4496eb4af5a1824a35fc

SHA1
056b93aab6079acf51582e0839fb01d844f2be2e

SHA256
207c29d7e2b80b5df2b4307d4d06067fce637116eac420f2cca04851aa3e7e70

SHA512
a6fccb5307dbc878763a6f1482ab0d535e3b46cf927db8e54ede6c1abc4ef28b9637ab3267017210ec61932832e0c9c3a791ce2c6c300274afab055470010401

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\uk.pak

Filesize
902KB

MD5
8ba142724dd81398a2d389b4b117e551

SHA1
d6bc1d86f160e55c6e699a7a2a25f60380465b5b

SHA256
322739f001840ed6d910a7f68b9bf87edce25f150716b091af833c575e082f8b

SHA512
62d4296f4feef83f25b203c767f2e993f87c2fd4143e316b32ff5f222a14e756f31c782ce3aa3b35c8854f9a9f40c79345b898ce9c0562f1e118eb661e49d2d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\ur.pak

Filesize
790KB

MD5
31d760ddebc9c6982e6325814a3ceb55

SHA1
561ad246d10c914e664b390cffb25369f968b9c6

SHA256
4d1238dc767814774c08a2239804c1f607df4481ae9293f8d6c54ec8b7bd5b4a

SHA512
5c1d157577565bdd318ad869f1c412275f6c7b79376196b02e7dba787e5876b984ad297749acb32e88863c4c69caa1e649add841f57b5cf84039623bd17d77d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\vi.pak

Filesize
624KB

MD5
22081e6b7b8336362f6399ecd5463f1c

SHA1
43a79b04c824093c2bc68d655089e20d1c75489d

SHA256
820d85f56197a602c56b1db47bcb62cfbebcb183c8a945f8d7a981d4dd539963

SHA512
a95e9cbd595dafd3f3818bb15edaac057623bae01f6766cbd8126923c38d877d79721064f597fd450b38a3b61de24e1d2da30e8cdcb7d4c393236b0646e74d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\zh-CN.pak

Filesize
450KB

MD5
17a1a680b45742aac74c3a9e155c1d2a

SHA1
8d1bee1f3b3e9363f64e6e9032ab7a952f3372f2

SHA256
c322ccba2c7ea7ec20b02a6eea9ea7260443c96b99a8ef348a3cb834f7ef91b0

SHA512
03c8ffece42b2659f39bbdb24607e502f9ec92591710bcc89700f4ae814ca2c8065741ae51a6867312abe9f38c5f875ba3a56f98b5bf1b5cbd4db38540a6c55e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\locales\zh-TW.pak

Filesize
445KB

MD5
13f40e10ed5b980699a8b864b34d339a

SHA1
00d9180139c8c07bff763c99a9b43cb9da1725b7

SHA256
c92aa68032d86caa1d62097c93c01c7a405f2184562e07da419e85a9a32aca75

SHA512
2e585c4bcdc2a29b435deefc3af9fae6dd937d73f9a2ca0dc29183c99e31ad2b811fd75e8fd647c7579743b90c394432807c7079db80bcaeb547c7b023250ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\resources.pak

Filesize
5.1MB

MD5
f5384c745e5209c503f2f802a87b3b8f

SHA1
636ffdb0da79decf10a191261c8e737eb51729a3

SHA256
4c4bbdff552e2a443afd31ab07f2e1233962db7d07b9de436443732fc18ba262

SHA512
a913a2c5fcd3fe87e707900655d50ee8ce780681aa9781a6c81ad9495da39025d62423021072ceb9091e3a220c36e3298bb97de3650eed23f19d3106e0ca5a92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\resources\app.asar

Filesize
32.3MB

MD5
69144accabee5feaecf8014499504426

SHA1
8a4ae8f93a6c4f449ca57a47b3fb6ce8d44786a4

SHA256
0aadfc68cc1b0be2fa9308edf7c1a6bb00bc3a0018236091d46329b8bb5e1e15

SHA512
d7e164dc83bd4bea343cf834d67c32b4892ee12d94dd28b9af98dd53de50847b0d2a4e0bc6b25b305be0823f931b98d9392968073d23c8b0ccf285a024d90077

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\resources\arch.arch

Filesize
3B

MD5
9c16d991c79c6330e655aa29ea623492

SHA1
fba3e0dfa6c8985b41bcbe3594ee941ce98b740c

SHA256
5609f728403e197bb255ef50c62aeabb1f93b09f7b7c379903440b65cd4319cb

SHA512
6079dac4c3998723dd7b73c6af882b8d0a8341212e1165b96e0b425df8965fa0cd600941aa000e232ac71bf16c058312d29c831853d38bca508b79b5a9249d44

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\resources\elevate.exe

Filesize
115KB

MD5
cae8d54b866d18d626829a734c47e016

SHA1
a353c5dffa9cf0fafeaed96d34a452a450dc1842

SHA256
b7fc9dea82b979a628dcc2f8662d325caf9b39e0a1a795080d271f9b2b35174b

SHA512
3274816877956dcd4564b1dfacf0e77a7e9f713261a9fc544714526907deb3c9b341b6106ff92b078e1aa6354529a382ae62f478a0143fcb77e0ee4de5e2305b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\snapshot_blob.bin

Filesize
300KB

MD5
18d6031e56295b21b7abffc3def212e6

SHA1
136453475d30a4c5eb722ea3c34170d50a5a6ce7

SHA256
6071b9c03c0bafcf141cf6a90626b996723147d1043af29b3bcc3bb9197b7a41

SHA512
1319b03cce7becf3b59b2a0725d99a0535b0c5393cc36dd903f771bffedd053134c479819671af0c491d5fc7fc8aa25ac46bc53591a5a5757346d15947f62477

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\v8_context_snapshot.bin

Filesize
641KB

MD5
a2fb889d7239bf0e78dde370e64a725e

SHA1
0a380ef50439d4c6689274d43990ab3ef2b82abf

SHA256
27c3c94b49b09dcf37ece19432144d1af5dd49df8fbc38f8ed91d5d53d1f06e9

SHA512
50d5f862d787e238afc8c5b687c8e67ba3cbb2f74a6a7fd5f0fa17832ac133cdd1e2f8870b38b6609e13ff5db29e33a7044a76300d4141cadf8ca3022999f64a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\vk_swiftshader.dll

Filesize
5.1MB

MD5
bc68585e9975a376782107a4546b72aa

SHA1
881949c4be7c39f6a8d3e18d3092c9fd39c486a5

SHA256
e6c95a1e9b59650b12e6851ab1504605eed224010b7b2376d6bf3e1cbfe13db5

SHA512
7dc6b0ce2277daf4055052b3a4858c9f10771854256d3126a5d9f299ffa6e05f6ad9ef678e43294d9860fa446830a14884a4bab37661be0b3c582299e1549bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\7z-out\vulkan-1.dll

Filesize
945KB

MD5
acaa5b5bccc7d4f6a716eaa1126c338e

SHA1
163c91445d71f940d6a4ac2be7f6277f8a5f5c35

SHA256
c29e906df1854f629986288bc24409dd300e9a7b4a2cab93e40c8ef12b5d7470

SHA512
c83745ce97fc1ce9a042e3f7123f7f00edad2caa8bc1dc7e63359ce26cb561ae792ec647ba1804f0f8a2c6b63e6eb209e9a7d63718281ebf085c65a2a597842e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshB0F2.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\Crashpad\settings.dat

Filesize
40B

MD5
16a8452bcde1a9baf0b290b7c3c15add

SHA1
dcfa86b8efe9367f5babeac857a1e0d5aa445673

SHA256
2fc9594b87b05b1f6267b350dc3e55adfe1682d69406a1624927c69422c767d4

SHA512
f638f5c6f64e711564a272513ecfb5e7d287c0e820160f8a24389ac8391a2ce444d284994b50591fa4caa7f08c060d2a23438c706bcd9131961afd95faf36b1c

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\f1e7ba5e-38f1-4434-9e01-3de3401bcf26.tmp

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\settings.json

Filesize
139B

MD5
e7b2933fbfb7f6e4e6114c025500fcee

SHA1
c3c7e3f37b5ef4dc933199c6e660081bee98c2c7

SHA256
bef7467620457cf0aff69b43b97f19ce40a7c104994b874c66bc1195454924ba

SHA512
72061b135929a9fce7437d671e5ea5ac588afe40a3425713ab92a74c2c0d162a5ba5afbeb4614f14e3e7dca31d62f5fdd9aea3e8015eb7c3b6ae909f82d169f7

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\settings.json

Filesize
221B

MD5
d06446b006cd179794cc818f99268e47

SHA1
64e33416d072eb99f03ac6c8dcfa7d0d2e3a2a55

SHA256
2ce0addd87b732fec8df0982ad05c61b103826065cb33bac52a346a76361c295

SHA512
a47256fb09fb41c93d025ad16c7167a548af11bb73cab274fa20c8f07c905cfa538c928bad244d2670de9c801026470a7e09c5726213e2150fe9828059f8c214

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\settings.json

Filesize
201B

MD5
dd8d798e719a89d60f6cab00bba8e394

SHA1
a1570b02c3205d2ea80853d0d2c19aa38e152881

SHA256
aa1dbee7ceefbf25248befe3e40bef9ddbac4320b7a2082f55176bd9812ee8ba

SHA512
77ada68d0b316e7794931c55dcb3f4207e1566fdcfc59602a9dcd8b8fc3bde8e5085c39505b0d85b91a5ad993f4da300cb7373c3123540e520ce64a9357a068d

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\settings.json.tmp-16340140464e6f66

Filesize
182B

MD5
2a8138d260045691ba83da50e4bedb92

SHA1
e0fcd9e202cccc75a8ad30423909bd71af590052

SHA256
3b39e0204da4d06775de04046416c11d381275b5e29712e5e753af943906bbf3

SHA512
d48813886a2c10b4585509c0da24f8f9ad41aa53b0b9bb7132b86ed0526eb2cc3b1cb16e53a7535a34e926ac52e0afc63844a1267fa2ac2c403e3295d932abd6

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\settings.json.tmp-163401860383a164

Filesize
283B

MD5
3bb82f62f2ae2eccdc8db2a026c63d28

SHA1
34fb0617a3e76f93fe89aab702ea14b048ecea6e

SHA256
80e7283b4901ceede0b47b71b2f0b750ed84b1aebcd9ef8b9d5b352b1088e38c

SHA512
ea0edd5074952ff824e10d62f4592409637b3bf79bcf0e42d81cf0cba1fdbfb78e5899c24fe225cb2205af67aaea2801100772125ef9d81954705c205e951b24

Download Submit
memory/812-885-0x00000193F3C00000-0x00000193F3C76000-memory.dmp

Filesize
472KB

Download
memory/4012-893-0x00000191E6B40000-0x00000191E6B64000-memory.dmp

Filesize
144KB

Download
memory/4012-892-0x00000191E6B40000-0x00000191E6B6A000-memory.dmp

Filesize
168KB

Download
memory/4012-884-0x00000191E6AF0000-0x00000191E6B34000-memory.dmp

Filesize
272KB

Download
memory/4012-820-0x00000191CE4E0000-0x00000191CE502000-memory.dmp

Filesize
136KB

Download